Multi-frequency smartphone positioning performance evaluation: insights into A-GNSS PPP-B2b services and beyond

In August 2023, Xiaomi unveiled the Redmi K60 Ultra, the first multi-frequency smartphone integrated with BeiDou-3 Navigation Satellite System Precise Point Positioning (PPP-B2b) services and employing PPP technology as the primary positioning method. The positioning enhancement service is provided by the Assisted Global Navigation Satellite System (A-GNSS) location platform developed by the China Academy of Information and Communications Technology. The signaling interaction between the server and the users strictly adheres to the Third Generation of Mobile Communications Technology Partnership Project Long-Term Evolution Positioning Protocol and the Open Mobile Alliance Secure User Plane Location framework. To comprehensively evaluate the Redmi K60 Ultra’s capabilities, this study designed six distinct experimental scenarios and conducted comprehensive research on multi-frequency and multi-GNSS observation noise, Time to First Fix (TTFF), as well as the performance of both GNSS-based and network-based positioning. Experimental results indicate that the GNSS chipset within the Redmi K60 Ultra has achieved a leading position in the consumer market concerning supported satellite constellations, frequencies, and observation accuracy, and is comparable to some low-cost GNSS receivers. A-GNSS positioning can reduce the TTFF from 30 to under 5 s, representing an improvement of over 85% in the cold start speed compared to a standalone GNSS mode. The positioning results show that the A-GNSS PPP-B2b service can achieve positioning performance with RMS errors of less than 1.5 m, 2.5 m, and 4 m in open-sky, realistic, and challenging urban environments. Compared to GNSS-based positioning, cellular network-based Observed Time Difference of Arrival (OTDOA) positioning achieves an accuracy ranging from tens to hundreds of meters in various experimental scenarios and currently functions primarily as coarse location determination. Additionally, this study explores the potential of the Three-Dimensional Map-ping-Aided (3DMA) GNSS algorithm in detecting Non-Line-of-Sight signals and enhancing positioning performance. The results indicate that 3DMA PPP, as compared to conventional PPP, can significantly accelerate PPP convergence and improve positioning accuracy by over 30%. Consequently, 3D city models can be utilized as future assistance data for the A-GNSS location platform.


Introduction
On May 31, 2018, Xiaomi launched the world's first dualfrequency Global Navigation Satellite System (GNSS) smartphone-Xiaomi Mi8, heralding the era of highaccuracy smartphone measurement capabilities (Zangenehnejad & Gao, 2021).The Xiaomi Mi8 is equipped with the Broadcom BCM4775 chipset, enabling it to measure pseudorange, carrier phase, Doppler shift, and carrier-to-noise ratio from five major satellite navigation systems simultaneously.Following the release of the Xiaomi Mi8, other Android smartphones, such as the Huawei Mate 20, Google Pixel 4, and Samsung Galaxy S20, featuring HiSilicon Kirin, Qualcomm, and Broadcom chips, were subsequently launched (Geng & Li, 2019;Li et al., 2022aLi et al., , 2022bLi et al., , 2022c;;Wang et al., 2021).These releases have further propelled the development of high-precision positioning technology in smartphones and played a significant role in advancing the application of GNSS in consumer devices (Chiang et al., 2023;Li et al., 2022aLi et al., , 2022bLi et al., , 2022c;;Sun et al., 2021).
Real-Time Kinematic (RTK) and PPP represent the two predominant techniques in high-precision GNSS positioning and have been the subject of extensive research.RTK technology relies on high-precision reference station data and robust communication links to facilitate real-time GNSS correction for mobile devices.In practical applications, this positioning method is typically offered to users as an instantaneous service through network RTK (Baybura et al., 2019;Zou et al., 2013).Geng et al., (2023aGeng et al., ( , 2023b) applied a GNSS RTK strategy based on factor graph optimization to smartphones, achieving better positioning accuracy than using traditional filtering algorithms.Furthermore, they observed that smartphones' channel-dependent phase biases and anomalous clock variations impeded ambiguity resolution (Cheng et al., 2023;Li & Geng, 2022;Li et al., 2023aLi et al., , 2023b)).These findings have propelled the advancements in the high-precision positioning of smartphones.Unlike the RTK method, PPP technology is not reliant on dense reference stations and can achieve wide-area and highprecision positioning using a single station, which can support the positioning requirements of large-scale smart terminals.Particularly following the completion of BDS-3, the continuous transmission of PPP-B2b corrections from three Geosynchronous Earth Orbit (GEO) satellites has significantly facilitated the extensive adoption of high-precision positioning services across the Asia-Pacific region (Chen et al., 2022a(Chen et al., , 2022b;;Liu et al., 2022aLiu et al., , 2022b;;Yang et al., 2023).Yang et al. (2022) comprehensively elucidated the basic principles, system composition, and positioning performance of the BDS-3 PPP-B2b service.Xu et al. (2021) analyzed the accuracy, availability, and real-time performance of PPP-B2b corrections.Their studies show that the orbit and clock accuracy of PPP-B2b corrections are superior to broadcast ephemeris, with the root mean square errors of radial, along-track, and cross-track components for Medium Earth Orbit (MEO) satellites being 6.8 cm, 33.4 cm, and 36.6 cm, respectively.The satellite availability of the PPP-B2b service in the Asia-Pacific region exceeds 80%, and the horizontal accuracy of realtime PPP using the B1C/B2a ionospheric-free combination can reach 11 cm after convergence.Tao et al. (2021) conducted a comparative evaluation of the BDS-3 PPP-B2b service with the real-time service of the French National Centre for Space Studies.They found that the availability of BDS-3 and Global Positioning System (GPS) satellites broadcasted by PPP-B2b message reached 97.5% and 91.5%, respectively, with the DCB product accuracy on B1I, B1C, and B2a being generally better than 0.5 ns.Zhou et al. (2023) studied the impact of the PPP-B2b service on the positioning of Multi-Frequency (MF), Dual-Frequency (DF), and Single-Frequency (SF) real-time PPP.The positioning accuracies of SF-PPP, DF-PPP, and MF-PPP are better than 0.20, 0.09, 0.08 m, with convergence times faster than 51, 10, 8 min, respectively.These studies indicate that the BDS-3 PPP-B2b service meets the demands of mass-market applications in terms of product accuracy, coverage, timeliness, and autonomy.
Despite the better performance of the BDS-3 PPP-B2b service has been proved in various scenarios, earlier smartphone models typically lacked the capability to measure B2b signals, which posed a considerable challenge to the direct application of this service in the mass consumer market.This situation was changed on August 14, 2023, when Xiaomi Corporation officially launched the Redmi K60 Ultra smartphone equipped with the Mediatek Dimensity 9200 + chip.This type of smartphone was the first to support the A-GNSS PPP-B2b service provided by the China Academy of Information and Communications Technology.To thoroughly evaluate the capabilities of the Redmi K60 Ultra smartphone, this study designed six distinct experimental scenarios to access observation noise, TTFF, positioning performance based on GNSS, and cellular network.
The remainder of this study is organized as follows: "3GPP LPP and OMA SUPL-based high-accuracy A-GNSS positioning service" section describes the specific processes and principles of high-precision A-GNSS positioning services based on 3GPP LPP and OMA SUPL.In "Methodology" section elucidates the PPP-B2b correction model, multi-GNSS PPP model, 3DMA GNSS algorithm, and the network-based OTDOA positioning algorithm.In "Experiments and analysis" section presents the experimental setup, positioning performance, and the results analysis for six experiments.Finally, "Conclusion and future work" section summarizes the study and outlines future work.

3GPP LPP and OMA SUPL-based high-accuracy A-GNSS positioning service
This section comprehensively overviews the standardsetting organizations for the A-GNSS location platform, their current developments, and anticipated future trends.The primary focus is on standalone GNSS positioning, the 3GPP LPP and OMA SUPL protocols, and the intricate details of high-precision A-GNSS positioning service.

Standalone GNSS positioning
Initially utilized primarily in military and surveying industries, GNSS positioning technology has gradually expanded into civilian sectors.As industrial technology rapidly advances, the cost of GNSS chips is decreased, leading to a proliferation of devices such as smartphones, wearable gadgets, and tablets equipped with GNSS positioning capabilities (Paziewski, 2020).Concurrently, location-based services (LBS) in smartphones have dramatically facilitated travel and work, becoming an indispensable tool in everyday life.When initiating positioning, the standalone GNSS mode requires a complete search of all visible satellite signals.This process involves scanning all potential satellite frequencies and codes to find usable signals (Wesson et al., 2018).Once the satellites are tracked, the GNSS receiver must decode various parameters from the navigation message, including satellite orbits, clock offsets, code biases, and ionospheric data, to calculate its position.
Satellites in space routinely broadcast navigation messages.GNSS receivers typically need 18-30 s to receive a complete broadcast ephemeris (18 s if frame synchronization commences precisely at subframe 1), and 12 min to receive a complete almanac (spanning 24 frames).Additional GNSS corrections must be downloaded if precise point positioning processing is necessary.Taking the BDS-3 PPP-B2b service as an example, satellite orbit and clock corrections are updated every 48 s and 6 s, respectively, which results in GNSS receivers consuming more time and power.Moreover, the validity period of a broadcast ephemeris is significantly shorter than that of an almanac, necessitating regular ephemeris injections by the ground control system.Commonly, the broadcast ephemeris tables for GPS, BeiDou Navigation Satellite System (BDS), Quasi-Zenith Satellite System (QZSS), GLObal'naya Avigatsionnaya Sputnikovaya Sistema (GLONASS), and Galileo navigation satellite system (Galileo) are updated every 2 h, 1 h, 1 h, 30 min, and 10 min, respectively (Chen et al., 2022a(Chen et al., , 2022b;;Duan et al., 2023;Hauschild et al., 2022;Montenbruck et al., 2015).Ephemeris updates mean GNSS receivers must regularly establish satellite connections to download and use the latest data.Since GNSS receivers are often loss-of-lock due to obstacles and interference in urban environments, this situation may cause more positioning time of standalone GNSS (Hussain et al., 2021).For real-time navigation tools such as smartphones, positioning delays ranging from tens of seconds to several minutes can significantly degrade service quality, rendering it unacceptable to users.

3GPP LPP and OMA SUPL protocols
To enhance the capabilities of GNSS positioning, Snap-Track, later acquired by Qualcomm, introduced Assisted Global Positioning System (A-GPS) technology by integrating mobile cellular networks with satellite navigation (del Peral-Rosado et al., 2018a, 2018b).A-GPS represents one of the most emblematic and broadly deployed outcomes of successfully integrating mobile communications and satellite navigation technologies.With networking more satellite navigation systems like GLONASS, Galileo, and BDS, and the comprehensive establishment of Fourth Generation of Mobile Communications Technology (4G) networks, A-GPS technology has gradually expanded into A-GNSS technology.Given that GNSS receivers exhibit varying range errors across different types and regions, it is imperative to account for the specific conditions of each device during the positioning process.Therefore, open, scalable, and interoperable data representation and distribution are crucial for achieving high-precision GNSS positioning in the global mass market ecosystem (Del Peral-Rosado et al., 2018a, 2018b;Razavi et al., 2018).Incorporating GNSS assistance data into a standardized framework is essential for maintaining the coherence of the ecosystem across billions of smart devices.3GPP and OMA are critical organizations in establishing relevant positioning standards.
3GPP is an international organization dedicated to developing the standards for mobile communications, with a primary focus on mobile communication networks and technologies (Damnjanovic et al., 2011).Consequently, 3GPP has established a series of standards related to mobile communication, including the Global System for Mobile Communications (GSM) in the Second Generation Mobile Communications Technology (2G), Universal Mobile Telecommunications System (UMTS) in the Third Generation Mobile Communications Technology (3G), Long-Term Evolution (LTE) in the Fourth Generation Mobile Communications Technology (4G), and New Radio (NR) in the Fifth Generation Mobile Communications Technology (5G).Within the LTE standard, the 3GPP has defined the LTE Positioning Protocol (LPP) to facilitate high-precision location measurement in LTE networks (Lin et al., 2017).LPP, a control-plane protocol, principally serves to exchange positioning assistance data and location information between the server and user equipment, thereby supporting location services for mobile devices (Ghosh et al., 2019).Implementing control plane positioning necessitates the utilization of dedicated control channels and consequently escalates the operational costs of mobile networks.This is due to the requirement for software and hardware upgrades across various network components to facilitate the transmission and processing of these control plane signals.Within the framework of mobile communication networks, control-plane positioning solutions mandate that operators install a significant array of location measurement units throughout the network infrastructure (Maaref & Kassas, 2022).OMA is another international organization focusing on standardizing mobile applications and services.OMA's primary objective is to foster interoperability among mobile communication devices, applications, and services to enhance user experience and augment the functionality of mobile communications (Wirola et al., 2008).OMA has defined the Secure User Plane Location standard, an independent location service standard not confined to any specific mobile communication technology and is integrated with different versions of 3GPP standards (Huang et al., 2017).Figure 1 illustrates the relationship between OMA SUPL and 3GPP positioning protocols.Operating within the user plane, SUPL facilitates location-based services without impacting the control plane elements of the network, thereby ensuring the efficiency and real-time location services of large-scale mobile terminals.As 2G and 3G mobile communications gradually phase out, it signifies the future obsolescence of the Radio Resource Location Protocol (RRLP) and Radio Resource Control (RRC) protocol (van Diggelen, 2020).LPP or LPP Extensions (LPPe) for supporting the SUPL 3.0 protocol are becoming the predominant positioning standards for the present and future (Fernandez-Prades et al., 2011).The application of LPP in the user plane is realized through the SUPL.LPP messages serve as the payload of SUPL messages, acting as the actual carriers of positioning information.

High-precision A-GNSS positioning service
A-GNSS represents the convergence of mobile communication and satellite navigation technologies, adhering to the 3GPP LPP and the OMA SUPL protocols for the rapid transmission of the assistance data required for positioning.Figure 2 illustrates the overall architecture of the high-precision A-GNSS positioning service.The A-GNSS location platform comprises GNSS ground stations, the cloud database, and the A-GNSS server.
The GNSS ground stations continuously track satellites, enabling real-time reception of navigation messages and PPP-B2b messages.The cloud database receives these messages via terrestrial optical networks and stores them in standard formats, such as Radio Technical Commission for Maritime Services (RTCM) and 3GPP.Upon a positioning service request from an A-GNSS-enabled user equipment, the A-GNSS server retrieves the corresponding data from the database and rapidly broadcasts it over the cellular network.Once the user equipment receives the ephemeris and correction data, it can swiftly search for satellites and acquire GNSS measurements (including pseudorange, carrier phase, Doppler, and the carrier-to-noise ratio (C/N 0 )), facilitating the location computation.As the entire process predominantly occurs through high-speed transmission over the cellular network, the time required in A-GNSS positioning mode is drastically reduced from tens of seconds to a few seconds, substantially enhancing the user's navigation experience.
In A-GNSS positioning mode, once the GNSS function is activated, the user equipment will establish a connection with the A-GNSS server over the cellular network.During this process, the A-GNSS server must establish secure communication with the user equipment, specifically through Transport Layer Security (TLS) authentication.During the TLS handshake phase, the server presents its digital certificate to the client, who then verifies the authenticity and validity of the certificate (Li et al., 2020).This procedure ensures the authentication of both parties' identities and the security of data transmission.The exchange of SUPL messages, conducted over a TLS-encrypted channel, aims to protect the privacy and integrity of positioning data.Figure 3 illustrates the process of exchanging SUPL messages between the A-GNSS server and the user equipment.Each exchange of SUPL messages necessitates a unique Session ID to guarantee the singularity of the content in the current session.The specific process of each conversation from the beginning to the end of the SUPL message is as follows: • SUPL START: This is the initiation message for the SUPL session, initiated by the user equipment, to notify the A-GNSS server to start the positioning service.This message may include the cellular cell information attached to the user equipment, the supported positioning capabilities, and other parameters.Upon receiving the SUPL START message, the A-GNSS server is prepared to commence assisted positioning.• SUPL RESPONSE: Upon receiving the SUPL START message, the A-GNSS server sends a SUPL RESPONSE message to the user equipment.This message confirms the positioning capabilities and the assistance data related to the SUPL START message.• SUPL POS INIT: Upon receiving the SUPL RESPONSE message, the user equipment must send a SUPL POS INIT message to the A-GNSS server, indicating its readiness to begin acquiring assistance data.This message may encompass details such as the cellular cell where the equip-Fig.2 The overall architecture of high-precision A-GNSS positioning service Fig. 3 SUPL message exchange process between A-GNSS server and user equipment ment is situated, its positioning capabilities, and the types of assistance data requested.• SUPL POS: After receiving the SUPL POS INIT message, the A-GNSS server will issue corresponding assistance data according to the request of the user equipment, including primary assistance data and high-precision GNSS correction data (if requested).The LPP message is the actual payload of the SUPL POS message and used to describe the assistance data types defined by 3GPP.• SUPL END: After receiving the assistance data, the user equipment quickly searches for visible satellites and performs position calculations based on GNSS measurements.Once the position calculation is completed, the user equipment will encapsulate the location information in the SUPL END message and send it to the A-GNSS server, thereby realizing a complete SUPL message exchange process.
The A-GNSS service broadcasts satellite assistance data via mobile networks, aiding user equipment in improving capture sensitivity.User equipment can access this service through a software upgrade alone, without any hardware modifications.Consequently, A-GNSS has become an essential feature for smart devices in the Internet of Things era.With the deepening integration of mobile communication and satellite navigation technologies, the types of assistance data supported by the A-GNSS location platform are expected to expand and grow continuously.According to the latest 3GPP Release 17 technical specification, the assistance data types supported by the A-GNSS mode include (Ghosh et al., 2019) Open, scalable, and interoperable data representation and distribution are crucial for achieving high-precision GNSS positioning in the global mass-market ecosystem.The A-GNSS location platform established by the China Academy of Information and Communications Technology covers basic SPP and high-precision A-GNSS PPP services for the four major satellite navigation systems.In addition to the BDS-3 PPP-B2b public service, the Galileo and QZSS navigation systems have also started broadcasting SSR corrections in recent years, essential for implementing PPP or PPP-RTK positioning.Table 1 summarizes the list of publicly available satellite-based high-precision GNSS correction services.QZSS MADOCA (Kawate et al., 2023) and CLAS (Hirokawa et al., 2019), based on Geosynchronous Earth Orbit (GEO) and Inclined Geosynchronous Orbit (IGSO) satellites, broadcast SSR corrections for implementing PPP and PPP-RTK services.The Compact SSR used in the QZSS CLAS service is an efficient and RTCM-compatible public format, which has been included in the supported formats of the 3GPP LPP (Hirokawa et al., 2023).Galileo High Accuracy Service (HAS) also adopts a structural design similar to Compact SSR, broadcasting GNSS corrections on the MEO satellites' E6b signal to achieve global PPP service (Naciri et al., 2023).Precise Point Positioning via SouthPAN (PVS) open service will initially broadcast data on the L5 frequency (1176.45MHz) and then transition to the new navigation signal at 1207.14 MHz (tentatively called LX) (Hirokawa et al., 2021).These public services are expected to extend the assistance data for the A-GNSS location platform, significantly enhancing the positioning performance of user equipment, especially in urban areas.

Methodology
This section primarily discusses the specific algorithms employed in this study, encompassing GNSS-based and network-based positioning algorithms.Sequentially, we detail the PPP-B2b correction model, the multi-GNSS PPP model, the 3D-mapping-aided GNSS algorithm, and the network-based OTDOA algorithm.

PPP-B2b corrections
The BDS-3 system comprises 30 satellites including GEO, IGSO, and MEO.As depicted in Fig. 2, three GEO satellites (C59, C60, and C61) utilize the PPP-B2b signal as a data channel for broadcasting orbit, clock, and code bias corrections for BDS and other satellite navigation systems.Upon receiving the broadcast ephemeris and PPP-B2b corrections, the GNSS receiver can perform PPP processing to achieve high-precision positioning.
The positioning algorithm based on BDS-3 PPP-B2b mainly corrects satellite orbit, clock offset, and code bias.For the orbit correction of PPP-B2b, the user first uses the broadcast ephemeris to calculate the satellite position vector X b , and then converts the orbit correction into the ECEF frame (Tang et al., 2022;Zhang et al., 2022aZhang et al., , 2022b)).The specific correction algorithm is as follows: where �O = (�O r �O a �O c ) T represents the compo- nents of the orbital correction vector in the radial, along, and cross directions; X s B denotes the satellite position after correction for orbital errors; X s b is the satellite position calculated using the broadcast ephemeris, and e r , e a and e c signify the unit vectors in the radial, along, and (1) cross directions, respectively.The methods for calculating these vectors are as follows: where r s = X s b and ṙs = Ẋs b represent the satellite position and velocity vectors calculated with broadcast ephemeris, respectively.
The clock correction parameters are the estimates relative to the clock errors provided in the broadcast ephemeris.Once the orbit has been successfully aligned with the broadcast ephemeris, users must match IOD Corr from the clock correction message with IOD Corr from the orbital correction message (Xu et al., 2021).The method for clock correction is as follows: where t s B denotes the corrected satellite clock offset; t s b represents the satellite clock offset calculated with the broadcast ephemeris; C s refers to the satellite clock error correction parameters provided in the PPP-B2b message, and c is the speed of light.
When processing satellite observation data, users usually must deal with signals of multiple frequencies.It is essential to eliminate their biases to process these various frequencies and types of signals synchronously.Users can perform real-time corrections of the satellite's code biases by utilizing the differential code bias (DCB) correction provided in the PPP-B2b message, enabling synchronous processing of various signal types (Liu et al., 2022a(Liu et al., , 2022b)).The DCB corrections can be expressed as: where P s l denotes the raw code observation for the signal l , and Ps l represents the corrected code observation; D s l stands for the differential code bias correction for the corresponding signal as provided in the PPP-B2b (2) Table 1 Publicly available list of satellite-based high-accuracy GNSS correction services for PPP or PPP-RTK The abbreviations "G, " "E, " "C, " "R, " and "J" represent GPS, Galileo, BDS, GLONASS, and QZSS, respectively

Multi-GNSS PPP model
PPP is a high-precision positioning technology extensively utilized in information systems, land surveying, and traffic management.By correcting for the influences such as satellite orbits, clock offsets, ionospheric delay, and differential code biases, PPP technology can achieve a widearea and high-accuracy positioning (Lou et al., 2016).
The undifferenced and uncombined PPP model can fully exploit all available raw observation data of multi-frequency and multi-GNSS raw observations, offering higher accuracy and reliability.The fundamental observation model for undifferenced and uncombined multi-GNSS PPP is as follows (Gu et al., 2021;Shi et al., 2023): where the subscripts K , s , f and r denote the satellite sys- tem, space vehicle number, signal frequency, and receiver, respectively; c represents the speed of light in vacuum; P K ,s r,f and φ K ,s r,f represent code pseudorange and carrier phase observation measured by a GNSS receiver in meters, respectively; ρ K ,s r indicates the Euclidean distance between the receiver and the satellite in meters; t K r and t K ,s are the clock offset of the receiver and the satellite in seconds, respectively; T K ,s r and a K ,s r represent zenith tropospheric delay and its projection function, respectively; I K ,s r and γ K ,s r,f represent the zenith ionospheric delay and its projection function, respectively; N K ,s r,f and K f are the integer ambiguity in cycles and wavelength of the carrier phase in meters, respectively; b K ,s f and b K r,f represent the code hardware delay associated with satellite and receiver in meters, respectively; B K ,s f and B K r,f denote the phase hardware delay associated with satellite and receiver in cycles, respectively, and ε K P and ε K φ indicate the observation noise of code pseudorange and carrier phase in meters, respectively.
The tropospheric delay and ionospheric delay can be corrected with a priori error models, while the residual components are estimated as unknown parameters (Gu et al., 2022a(Gu et al., , 2022b;;Zheng et al., 2018).Satellite orbit offset, clock offset, and code biases can be corrected using PPP-B2b corrections or International GNSS Service (IGS) products (Geng et al., 2023a(Geng et al., , 2023b;;Gu et al., (5) Song et al., 2023).The reference datum for GPS clock offsets originates from the ionospheric-free (IF) combination of P1/P2 codes, thereby incorporating the signal delay biases of the IF combination.For smartphones utilizing GPS L1 and L5 signals, it is necessary to consider the unification of references across different frequencies when adopting an undifferenced and uncombined model.The precise satellite clock offsets T G,s can be expressed as (Shi et al., 2021): where t G,s is the real GPS satellite clock offset; b G,s P1 and b G,s P2 are the hardware delays for the P1 and P2 codes, respectively; α G 12 and β G 12 denote the combination coefficients, with their specific forms being: where f G 1 and f G 2 are the frequencies of the P1 and P2 codes, respectively.Based on Eq. ( 6), we can further obtain: where P2 represents the DCB corrections between the P1 code and the P2 code.Furthermore, considering that smartphones track civilian signals on the L1 frequency, Eq. ( 8) should be further converted from the P1 code to the C1 code: C1 represents the DCB correction between the P1 code and the C1 code.Similarly, the hardware delay correction for smartphones on the L5 frequency can be expressed as follows: where indicates the DCB correction between the P1 code and the C5 code.The PPP-B2b product takes the B3I signal as the reference for the BDS-3 satellite clock offset.Therefore, when performing smartphone positioning with the signals other than B3I, the unification can be directly accomplished through the following formula: where Bx represents satellite signals broadcasted on the BDS-3 system, such as B1I, B1C, B2a, or B2b.After the DCB corrections with Eqs. ( 9) to (11), the reference (6) unification for different frequencies of the GPS and BDS systems on smartphones can be achieved.Therefore, the linearized error equation can be expressed as: where P K ,s r,f and �φ K ,s r,f represent Observed-Minus-Computed (OMC) of code pseudorange and carrier phase in meters, respectively; u K ,s r is the partial derivative of the geometric distance ρ K ,s r with respect to the receiver position; x r is the three-dimensional vector of the receiver coordinates; T w and I K ,s r indicate the residual tropospheric delay and ionospheric delay in meters, respectively, and f stands for float ambiguity in cycles.The observation model in matrix form corresponding to (12) can be expressed as: where V , X , B , L and Q represent the residual matrix, the parameter matrix to be estimated, the design matrix, the observation matrix, and the variance-covariance matrix, respectively.If the receiver can track n frequencies and m satellites in a given epoch, the specific form is as follows: where T represent OMC of code pseudorange and carrier phase, respectively; T is the float ambiguities.Since the code hardware delays b K r,f on different channels of the receiver are linearly dependent, we set b K r,1 = 0 to obtain a unique solution b K r (Lou et al., 2016).Each component in the matrix B and V corresponds to the coefficient vector and residual vector of each parameter to be estimated.The matrix Q typically encompasses the variance- covariance information related to GNSS observations, which describes the uncertainty associated with various unknown parameters (Zhang et al., 2022a(Zhang et al., , 2022b)).The form of the variance-covariance matrix is as follows: (12) where diag(•) represents the diagonal matrix; σ 2 rep- resents the noise variance of the code pseudorange or carrier phase, which is used to quantify the error or uncertainty of the corresponding parameter.The GNSS observations are typically weighted according to the variance of the observation noise In GNSS processing.The weight matrix can generally be constructed by inverting the variance-covariance matrix.The elements within the weight matrix represent the weights of each observation, determined based on the information from the variancecovariance matrix.Observations with higher reliability are assigned heavier weights, while those deemed less reliable are allocated lighter weights.
The elevation-dependent weighting model is commonly adopted for survey-grade receivers equipped with circularly polarized antennas because the observation noise decreases with increasing elevation (Gong et al., 2022).However, the measurement errors are predominantly related to C/N 0 for smartphones equipped with built-in linearly polarized patch antennas.Consequently, in this paper, we employ a C/N 0 -dependent stochastic model to weigh the multi-frequency and multi-GNSS observations collected by smartphones (Wang et al., 2023): where (C/N 0 ) K ,s r,f represents the observed carrier-to-noise ratio at a specific frequency for each satellite; υ K r,f and η K r,f are the coefficients of the stochastic model.We recommend employing an inter-station single-difference model or the code-minus-carrier model to determine these coefficients for each constellation and frequency (Liu et al., 2019a(Liu et al., , 2019b;;Wang et al., 2022).σ P 0 and σ φ 0 repre- sent the mean of the code pseudorange and carrier phase observation error, respectively.In this study, these values are set at a ratio of σ P 0 : σ φ 0 = 2 : 0.01 .GNSS observa- tion accuracy on L5/E5a/B2a frequencies is generally better than L1/E1/B1 frequencies for smartphones.Therefore, this weighting scheme that differentiates between frequencies and constellations can more accurately depict the GNSS error characteristics of specific smartphones.This enhances the accuracy of positioning solutions and ensures that less reliable observations do (15) � not disproportionately affect the outcomes (Wang et al., 2024).

3D-mapping-aided GNSS algorithm
Smartphones are equipped with small linearly polarized microstrip antennas, which makes them more sensitive to multipath signals (Zhang et al., 2019;Groves & Adjrad, 2019).Multipath errors may introduce discrepancies among GNSS measurements, potentially leading to an inaccurate covariance matrix in the filter estimator (Hsu, 2017;Li et al., 2022aLi et al., , 2022bLi et al., , 2022c)). Figure 4 presents a schematic illustration of NLOS satellites formed resulting from building occlusion.NLOS signals typically arrive at the user equipment via diffraction or reflection paths, potentially leading to more significant ranging errors compared to those caused by LOS multipath effects.Therefore, accurate detection and exclusion of NLOS signals are crucial for smartphone high-precision GNSS positioning (Li et al., 2023a(Li et al., , 2023b;;Zheng et al., 2024).
In recent years, accurate 3D building models have provided a solid foundation for detecting NLOS signals.Firstly, a sky mask centered on the user equipment is created through the mapping match between the 3D building models and satellite rays, delineating the areas obscured and unobscured by buildings (Wen et al., 2020).The elevation and azimuth of the satellites are then projected onto this sky mask, effectively distinguishing between LOS and LOS signals.To facilitate the map matching and standardization process, all building coordinates are uniformly converted to a local coordinate frame with the initial position as the origin.Assuming the edge coordinates of a 3D building in the ECEF framework are denoted as (X i , Y i , Z i ) , the local coordinates after rotation and translation are (e i , n i , u i ) (Cao et al.,   2022).Therefore, elevation at the edges of each building can be calculated: where arctan(•) represents the arctangent function and E i denotes the elevation of each building edge.Figure 5 provides an illustrative diagram of a sky mask generated with the user equipment as the observation center.Within this diagram, the satellites in the grey-shaded area are NLOS satellites (indicated by red dots), while those in the white unobstructed area are LOS satellites (indicated by green dots).By scanning the projection relationship between the all satellites received by the user equipment and the sky mask, NLOS signals can be detected and eliminated.
The initial position of the user equipment is typically obtained using single point positioning.However, this position may deviate from the ground truth, as we do not have helpful information to exclude NLOS signals before obtaining an accurate location.The satellites near the edges of buildings are likely to reach the user equipment via diffraction paths, which can easily result in ambiguous detection outcomes.Therefore, to reduce the impact of initial position errors, we have established a secondary screening process for the satellites at the edges of buildings.First, we set ±θ edge near the edge of the building as the fuzzy search interval, and assume that the satellite elevation calculated by ephemeris is E s < E i − θ edge , we assume it is more likely to be NLOS satellite and exclude this signal in the following filtering processing.NLOS reception generally occurs in scenes with low signal strength and large residuals.Therefore, for the satellites located near the edge of the building E s ∈ E i − θ edge , E i + θ edge , we further adjust the var- iation-covariance matrix in ( 16) with the C/N 0 and the pseudorange residual: where ψ ∈ {P, φ} represents the symbol of the pseudor- ange or carrier phase; σ 2 represents the adjusted variance of the observation; θ edge is the given edge threshold, which is 5 degrees in this study.indicates the decision threshold of the C/N 0 , which is 30 dB Hz in this study.ε P represents the median error of the code pseudorange observation, and the median error of three times is taken as the judgment threshold of the code pseudorange residual . β 1 , β 2 and β 3 represent weighting factors, which are assigned values of 3ε ψ and 1.0 in this study, respectively.
Once the 3GPP Release 18 or subsequent standards define the format for 3D maps or building models, it will become feasible to broadcast such assistance data through the A-GNSS server, as illustrated in Fig. 2. The primary advantage of using the A-GNSS service is that users need only acquire the 3D building models of their immediate surroundings for each navigation session, rather than pre-loading extensive city models.This methodology promises a considerable reduction in the storage requirements for 3D data and meets the real-time positioning demands of smartphones.

Network-based OTDOA positioning algorithm
In the preceding three sections, we focused on the GNSS-based positioning model, the most adopted Radio Access Technology (RAT)-independent positioning technique.Nevertheless, 3GPP stipulates that User Equipment (UE) must support RAT-dependent and RAT-independent positioning modes (Destino et al., 2019).This requirement aims to provide a broader array of positioning options, ensuring that UE can acquire location information under various network and environmental conditions.RAT-dependent positioning technologies generally offer faster localization, (18) UE requires the measurement of the Time of Arrival (TOA) for the signals transmitted by at least three base stations with good geometric distribution to calculate their plane coordinates.Assuming that the downlink PRS from the i -th base station is transmitted at time t i , and the TOA of this PRS is T i , the following equation can be derived: where x i , y i is the plane coordinates of Base Station (BS) B S(i) , i = (0, 1, . . ., n) ; c is the speed of light in a vacuum; ε i indicates measurement errors caused by noise and interference; and the Euclidean distance between UE and BS.In practical applications, the UE and the BS clocks are not perfectly synchronized, which invariably introduces an error in the TOA measurements.To mitigate this error, the discrepancy due to clock asynchrony between the UE and BS can be rectified by considering the difference in arrival times between signals from two separate BS units.The RSTD measurement R i,0 formed between neighbor B S(i) and ref- erence B S(0) can be expressed as: By combining ( 19) and ( 20), the following hyperbolic observation equation can be obtained: where R i,0 is calculated by two separate UE measure- ments; Both the transmit time offset t i − t 0 and the B S(i) coordinates x i , y i can be obtained from the location server, so the equation consists of only two unknown parameters x, y .Determining the plane coordinates of UE requires at least two equations, which entails using at least one reference BS and two neighbor BS.In a typical scenario where the UE can obtain measurements from more than two neighboring cells (assume there are n such cells), the observation equations can be expressed as: When n ≥ 3 , the equation above becomes an overde- termined equation.The least squares approach is the most commonly applied solution method in such cases.However, due to the significant variation in signal quality across different cells, we recommend using the weighted least squares method to achieve a more stable solution (Fischer, 2014).For Orthogonal Frequency Division Multiplexing (OFDM) signals, the variance can be derived from the symbol duration T s , the set of subcarriers N a utilized by the signal, and the relative power weight p 2 m of the m−th subcarrier (Liu et al., 2019a(Liu et al., , 2019b)) where σ 2 i represents the variance of the i -th observation; S i denotes the Signal to Interference plus Noise Ratio (SINR) of the i -th PRS received by the UE.SINR can characterize the signal quality of each PRS, thus obtaining the weight P i = σ −2 i of each RSTD measurement.When employing weighted least squares in the positionsolution, observations with good signal quality are given heavier weights.
Positioning systems based on TDOA are susceptible to timing synchronization errors between cellular base stations (del Peral-Rosado et al., 2018a, 2018b).In the absence of NLOS signals, the measurement accuracy of TDOA primarily hinges on the time synchronization precision between base stations.A rough estimate indicates that a time synchronization error of 1 ns at the cellular base stations can lead to a ranging error of approximately 0.3 m.Even though 5G communication networks offer higher timing synchronization accuracy than 4G networks, achieving 1 ns synchronization is still far from attainable at the current stage (Chaloupka, 2017).Furthermore, the accuracy of RSTD estimates is affected by TOA measurement errors, multipath errors, and the geometric distribution of base stations.Consequently, location determination based on commercial 4G/5G base stations using E-CID or OTDOA typically achieves only tens to hundreds of meters in positioning accuracy (Del Peral-Rosado et al., 2022).Although cellular network positioning cannot yet deliver high-precision location services, it provides a valuable contribution by supplying a coarse location and time reference for A-GNSS positioning, significantly enhancing satellite signal acquisition.

Experiments and analysis
In this section, we designed a series of experimental scenarios to assess the Redmi K60 Ultra smartphone's capabilities.The detailed description includes the experimental setup, an analysis of observation noise, a comparative study of Time to First Fix, positioning performance in various conditions, an exploratory evaluation of the 3D-mapping-aided GNSS algorithm in challenging urban areas, and a subsequent discussion and analysis of the positioning outcomes.

Experimental setup
To assess the positioning performance of the Redmi K60 Ultra smartphone, six distinct experimental scenarios were designed.Figure 7 illustrates these scenarios in various testing environments.Experiment 1 was conducted in a laboratory environment, where smartphones were integrated with a survey-grade receiver to form a zero baseline, thereby evaluating the observation noise for multi-constellation and multi-frequency GNSS.Experiment 2 was conducted outdoors with good cellular signal quality.The primary objective of this experiment was to compare the TTFF between standalone GNSS and A-GNSS positioning, emphasizing the notable advantage of A-GNSS in speeding cold start speed.Experiments 3 and 4, which were static and kinematic tests conducted in an open-sky environment, aimed to evaluate the performance of cellular network-based and GNSS-based positioning under ideal observation conditions Experiment 5 assessed the kinematic positioning performance of network-based and GNSS-based positioning in a realistic environment.Experiment 6 was conducted in a challenging urban area, primarily to explore the positioning potential of the 3DMA GNSS algorithm and its feasibility for its integration with the A-GNSS location platform.Table 2 summarizes the scenario descriptions and objectives for these six experiments.
Figure 8 shows the GNSS constellations and frequencies receivable by the Redmi K60 Ultra smartphone, encompassing GNSS signal types that other smartphones can receive.Compared to previous single-frequency and dual-frequency smartphones, the Redmi K60 Ultra can receive BDS B1C/B2a/B2b, Galileo E5b, and NavIC L5 signals.The direct benefit of receiving a broader range of satellite frequencies and systems is enhancing satellite geometric distribution and observational redundancy.It should be noted that, given the current capability of the   Redmi K60 Ultra's built-in A-GNSS service to acquire PPP-B2b corrections from the A-GNSS server directly, there is no longer a need to track and decode B2b signals when network connectivity is available.
Moreover, this study employed other dual-frequency smartphones and a low-cost GNSS receiver as controls in Experiment 1 alongside the Redmi K60 Ultra.These devices included the Xiaomi Mi8, Google Pixel6, Huawei P40, and Septentrio Mosaic-X5.The specific parameters of each experimental device are listed in Table 3.The multi-frequency and multi-GNSS observations were collected using the BUAA RINEX Logger software, which directly generated observation files in the RINEX format.This software is available at https:// github.com/ Jia-le-wang/ BUAA-RINEX-Logger, facilitating interested researchers to access GNSS observations from Android smartphones.
The reference trajectory was provided by Vision-RTK equipment, manufactured by Swiss advanced technology company Fixposition, and was compensated for leverarm errors.Vision-RTK device integrates dual-antenna GNSS, computer vision, and inertial sensors to ensure the real-time output of highly reliable centimeter-level positions in various environments (Dong et al., 2022).

Experiment 1: observation noise analysis
Multi-GNSS compatibility and interoperability enhance the service capabilities of various satellite navigation systems.However, consumer-grade smartphones exhibit different error characteristics across various systems and frequencies compared to survey-grade receivers.Investigating these differences is vital to gain an in-depth understanding of the measurement quality of GNSS chipsets, thereby facilitating the optimization of functional or stochastic models (Zhang et al., 2020).To objectively represent the noise level in multi-constellation and multi-frequency GNSS observations, we conducted a zero-baseline experiment in laboratory conditions, as illustrated in Fig. 7a.The experimental design principle is shown in Fig. 9.To provide readers with a clear understanding of the GNSS observation quality of the Redmi K60 Ultra, we also selected three other smartphones-Xiaomi Mi8, Google Pixel 6, and Huawei P40-along with the low-cost Septentrio Mosaic-X5 receiver for  3 The specific parameters for each experimental device The abbreviation "LP" stands for "Linearly Polarized, " while "RHCP" denotes "Right-Hand Circularly Polarized."  Therefore, the zero-baseline double-difference residuals are predominantly composed of noise, thus effectively evaluating the observation quality of smartphone GNSS chipsets (Li & Geng, 2019;Miao et al., 2023).
Figure 10 displays the time series of double-difference residuals for code pseudorange and carrier phase.The left side of each graph represents the noise of different signals at the first frequency, while the right side illustrates the noise at the second frequency.The time series indicates that the observation noise of code pseudorange for all GNSS constellations at the second frequency is less than that at the first frequency.Notably, the code observation noise at the L5/B2a/E5a frequency aligns closely with the Septentrio Mosaic-X5, underscoring the benefits of multi-frequency chipsets in consumer-grade smartphones.Regarding the observation noise of the carrier phase, the Redmi K60 Ultra smartphone exhibits consistent levels across various constellations and frequencies.We used Standard Deviation (STD) to measure the double-difference residual of zero-baseline code pseudorange and carrier phase.
Figure 11 summarizes the STD of double-difference residuals for code pseudorange and carrier phase across all constellations and frequencies.Table 4 provides   K60 Ultra on each frequency is controlled within 0.02 cycles.Unlike code pseudorange, the carrier phase observation accuracy of the GLONASS system is on par with other GNSS constellations.Compared to the Xiaomi Mi 8, equipped with the previous generation Broadcom BCM4775 chip, the Google Pixel 6 with the newer Broadcom BCM4776 chip exhibits lower observation noise of code pseudorange and carrier phase across different frequencies and constellations.The Septentrio Mosaic-X5 receiver demonstrates the best consistency and observation accuracy on all frequencies.Additionally, although the Huawei P40's specifications indicate its support for BDS B1C/B2a and GLONASS G1 signals, actual tests revealed that the observed values for these frequencies were null.

Experiment 2: comparison of time to first fix
In "3GPP LPP and OMA SUPL-based high-accuracy A-GNSS positioning service" section, we present a comprehensive introduction to standalone GNSS and A-GNSS positioning.In the Standalone GNSS positioning mode, the receiver must autonomously acquire the necessary ephemeris data by capturing and tracking satellite signals without external assistance to perform accurate positioning.This mode is susceptible to various factors, including receiver performance, antenna quality, satellite visibility, and the surrounding environment.Consequently, the TTFF can take tens of seconds or even minutes.TTFF refers to the duration from the startup of a GNSS receiver to the successful computation of the first valid position after capturing satellite signals.TTFF is a crucial performance metric describing a receiver's time transitioning from a cold start state to successful positioning (Blay et al., 2021).It holds particular significance for the applications requiring swift access to positioning information, such as vehicle navigation systems, pedestrian navigation, or emergency rescue.
Unlike standalone GNSS, A-GNSS represents the integration of mobile communication and satellite  navigation technologies, leveraging 3GPP LPP and OMA SUPL protocols to transmit the necessary assistance data for positioning.To highlight the significant advantage of the A-GNSS positioning mode in reducing TTFF, we conducted comparative experiments outdoors with good cellular signal quality, as depicted in Fig. 7b.To ensure the statistical integrity of TTFF, it was essential to maintain a cold start for each positioning process, necessitating the clearance of broadcast ephemeris, almanac, historical location and frequency logs after each positioning.In subsequent positioning attempts, the standalone GNSS mode must recapture and track satellite signals to download new ephemeris for positioning.In contrast, the A-GNSS mode acquires assistance data directly from the China Academy of Information and Communications.Technology's A-GNSS server for positioning.Table 5 presents the specific settings for standalone GNSS and A-GNSS positioning modes.
For both standalone GNSS and A-GNSS positioning modes, we conducted a series of 100 consecutive tests.The positioning timeout was set at 120 s for standalone GNSS and 30 s for A-GNSS, with a uniform 15-s interval between each test pair.The bar chart shown in Fig. 12 compares the TTFF statistical values for standalone GNSS and A-GNSS positioning.For Standalone GNSS, the minimum, average, and maximum TTFF were recorded as 18.55 s, 32.60 s, and 58.22 s, respectively.In contrast, with the A-GNSS positioning mode, the minimum, average, and maximum TTFF values were significantly reduced to 2.18 s, 3.65 s, and 7.26 s, respectively.These values correspond to the reductions in positioning time of 88.25%, 88.80%, and 87.53% compared to standalone GNSS.The results indicate that A-GNSS services markedly decrease TTFF, reducing power consumption during the smartphone positioning process and improving the promptness of locationbased services.

Experiments 3 to 5: positioning results in different experimental scenarios
To comprehensively evaluate the positioning performance of the Redmi K60 Ultra smartphone, we assessed  The positioning solution involves executing off-line SPP after detecting and excluding NLOS signals through 3D mapping.This method necessitates the availability of precise 3D building models for the area surrounding the user equipment

3DMA PPP
The positioning solution involves executing off-line PPP after detecting and excluding NLOS signals through 3D mapping.This method necessitates the availability of precise 3D building models for the area surrounding the user equipment its capabilities using various methods, including OTDOA, A-GNSS PPP, Off line SPP, Off-line PPP, 3DMA SPP, and 3DMA PPP.Table 6 provides a detailed explanation of these positioning methods.OTDOA is a cellular network-based positioning method that provides coarse location information (ranging from tens to hundreds of meters).The OTDOA positioning solution updates its location at intervals of several minutes to ensure low power consumption of user equipment throughout usage.A-GNSS PPP, the latest real-time high-precision positioning technology adopted by the Redmi K60 Ultra smartphone, achieves on-line PPP positioning in the chipset by obtaining broadcast ephemerides and PPP-B2b corrections through the A-GNSS server shown in Fig. 2. Similarly, with power consumption in mind for real-time applications, the A-GNSS PPP positioning adjusts according to the actual motion state of the user.If a pedestrian or vehicle is detected as stationary, A-GNSS PPP will cease computation after converging to a certain threshold to avoid unrestricted power consumption.This periodic location updating strategy aids in balancing positioning accuracy and battery life while maintaining system availability.
Off-line SPP and PPP represent the post-processed positioning methods, calculated using high-precision GNSS data processing software-FUSING (Gu et al., 2018).All GNSS positioning results in this study were obtained using GPS and BDS constellations, specifically GPS L1/L5 and BDS B1I/B1C/B2a frequencies, to ensure consistency in the comparative analysis.In off-line positioning approaches, we correct errors using final IGS products such as precise orbits, clock offsets, code biases, and ionospheric data.Off-line SPP/PPP positioning solutions serve as control experiments for real-time A-GNSS PPP, thus allowing for position updates every second without considering power consumption constraints.The 3DMA SPP/PPP positioning methods are developed to explore the positioning potential of smartphones in challenging urban areas.The 3DMA SPP/PPP algorithms only add the detection and exclusion of NLOS signals on top of the off-line SPP/PPP algorithms, with all other parameters remaining consistent.
Figure 13 provides a series of 2D positioning error sequences and satellite overhead views from Experiments 3-5 under different test environments.Initially, in the open-sky environment of Experiment 3, we conducted nearly an hour of static testing.The OTDOA and A-GNSS PPP algorithms were executed online during the experiment, delivering real-time positioning outcomes.Conversely, off-line SPP and off-line PPP collected raw observation data to be analyzed during post-processing.The horizontal positioning error sequence of Experiment 3, as shown in Fig. 13a, reveals that the network-based OTDOA algorithm exhibits the most inferior positioning accuracy, with errors ranging from 20 to 150 m.The inability of OTDOA to achieve meter-level precision is primarily due to the limited time synchronization accuracy of the prevailing 4G/5G mobile communication networks.By contrast, GNSS-based positioning algorithms can achieve meter-level or even sub-meter-level accuracy.The A-GNSS PPP and Offline PPP algorithms demonstrate superior positioning performance with an RMS error below 1.5 m, outperforming the SPP algorithm that is commonly integrated into smartphones.The satellite overhead view, shown in Fig. 13b, intuitively displays the benefits of incorporating PPP algorithms on smartphones.The green track and the blue track align closely with the reference position.Furthermore, as previously described for each algorithm, OTDOA and A-GNSS PPP need to consider power consumption in real-time applications.Therefore, they update the position according to the actual motion state of the user equipment.This periodic update strategy helps balance positioning accuracy and battery life while maintaining system availability.
In the positioning results of Experiment 4, as shown in Fig. 13c, d, A-GNSS PPP also demonstrate superior performance in kinematic positioning in open-sky environments.The RMS statistics of the 2D positioning error for A-GNSS PPP are less than 1.5 m, showing comparable accuracy to the post-processed results of off-line PPP.The satellite overhead view indicates that the A-GNSS PPP positioning trajectory almost coincides with the reference trajectory of the vehicle running on the playground track.Furthermore, we conducted kinematic experiments in a realistic environment to reflect the positioning performance of the Redmi K60 Ultra in general urban areas.The positioning error sequence of Experiment 5, shown in Fig. 13e, reveals that the positioning accuracy of A-GNSS PPP in realistic environments can reach approximately 2.5 m.In contrast, the traditional off-line SPP method has an RMS error of about 4 m, with the maximum error exceeding 8 m, significantly degrading the user experience.
Experiment 6: exploring the potential of 3DMA GNSS positioning in the challenging urban area Modern urban architecture is predominantly constructed from reinforced concrete and sheathed in expansive glass facades.These building clusters block the line of sight to the sky, drastically reducing the number of visible satellites and causing severe NLOS multipath.Without proper treatment of NLOS signals in GNSS processing, the substantial ranging errors they introduce can significantly affect positioning accuracy.To investigate the potential for using 3D building models to enhance GNSS positioning performance, we experimented in the challenging urban area depicted in Fig. 7f.The test location is surrounded by numerous tall buildings with glass facades, which can severely obstruct the GNSS signals received by smartphones.Accurate 3D models of these buildings have been determined and generated into an offline database using a high-precision handheld scanner.
Figure 14  Furthermore, we analyzed the C/N 0 of the LOS and NLOS signals detected in Fig. 14 and produced a histogram of C/N 0 as shown in Fig. 15.The C/N 0 is a direct variable used to measure signal strength, with higher values typically indicating better signal quality.Overall, the signal strength of LOS signals is consistently higher than that of NLOS signals.However, this is not absolute, as there is no significant boundary between the signal strengths of NLOS and LOS satellites.The signal strength of some NLOS satellites even exceeds that of most LOS satellites, such as G12, R01, C28, and J02.This indicates that setting empirical cut-off C/N 0 or elevation cannot effectively distinguish between NLOS and LOS signals.To illustrate this point more clearly, we provide the normalized probability distribution of LOS and NLOS signals in the entire test period, as shown in Fig. 16.It is evident that there is a substantial overlap in signal strength between LOS and NLOS signals, meaning that we cannot find a perfect demarcation to differentiate them.
From the above analysis, we can intuitively appreciate the benefits of the 3D building models in suppressing NLOS multipath effects.By matching the 3D building model with satellite rays, we can easily detect and exclude these NLOS satellites.Figure 17 shows the positioning results of the Redmi K60 Ultra smartphone using different positioning methods in the challenging urban area.The positioning results realistically demonstrate the substantial advantage of the 3DMA GNSS algorithm  In comparison, the 3DMA SPP and 3DMA PPP algorithms have significantly improved positioning performance in challenging urban areas.The positioning error sequence reveals that the 3DMA algorithm achieves an initial accuracy of about 5 m, further refined to approximately 2.5 m as the PPP converges.This improvement is also visually evident from the satellite overhead view, where the 3DMA PPP algorithm's results are closest to the reference.This insight paves the way for integrating A-GNSS service with 3DMA GNSS algorithms.Once the 3GPP establishes standardized formats for 3D building models, the A-GNSS server can store extensive 3D city models in the database.In addition to transmitting satellite ephemeris, almanac, and OSR/SSR corrections, the provision of 3D building models around the user equipment can further enhance GNSS positioning performance in harsh urban areas.

Analysis and discussion of experimental results
To provide a more intuitive and straightforward representation of the distribution of positioning results, we utilized box plots to summarize the outcomes from Experiments 3 to 6.One advantage of box plots is their ability to reflect the characteristics of the original data distribution and facilitate an intuitive comparison of multiple datasets.Moreover, box plots are relatively robust statistical charts, insensitive to outliers, which aids in a more accurate understanding of the overall error distribution.Figure 18a provides the box plots of the 2D positioning errors obtained using various positioning methods from Experiments 3 to 6. Figure 18b delineates the five key features of the box plot, including the upper whisker, upper quartile, median, lower quartile, and lower whisker.Data that lie beyond the upper/lower whiskers are typically considered outliers.However, within the context of this study, all positioning results are genuine and valid, necessitating the inclusion of these outliers in the statistical analysis of positioning errors.Table 7 summarizes the positioning errors using different methods from Experiments 3 to 6.We primarily employ three metrics to evaluate the performance of the different methods: the root mean square (RMS), median (Med), and maximum (Max).
The box plots reveal that the experimental environment significantly impacts the positioning performance of the Redmi K60 Ultra smartphone.In the open-sky conditions of Experiments 3 and 4, all positioning methods demonstrated commendable performance.Notably, the A-GNSS PPP method achieved RMS errors less than 1.5 m in both static and kinematic tests, representing an improvement of 33.99% and 43.77% over the off-line SPP method.This highlights the substantial potential of the PPP-B2b correction service in enhancing the real-time positioning performance of smartphones.The positioning results in the realistic environment of Experiment 5 indicated that both the A-GNSS PPP and off-line PPP algorithms can achieve an RMS error of less than 2.5 m.
A realistic environment inevitably causes more signal interference compared to open sky cases, therefore all positioning algorithms have increased statistical indicators.In the challenging urban area of Experiment 6, where GNSS observation quality deteriorated sharply, we explored the positioning potential of the 3DMA GNSS algorithm.It is apparent from the box plots that all methods experienced more significant positioning errors and a higher number of outliers.The maximum positioning errors for the A-GNSS PPP, Off-line SPP, and Offline PPP methods reach 28.03 m, 35.62 m, and 25.64 m, respectively, with RMS errors of 3.70 m, 10.20 m, and 3.51 m.After the detection and exclusion of NLOS satellites using the 3D building models, the RMS errors for the 3DMA SPP and 3DMA PPP methods are reduced by 33.04% and 31.43%,respectively, with the maximum errors reduced by 55.70% and 76.64%.By employing precise 3D models for mapping match, the substantial range errors introduced by NLOS reception were effectively excluded from the positioning process, significantly mitigating the risk of positioning deterioration in GNSSchallenging environments.
The network-based OTDOA positioning algorithm's accuracy is significantly lower than the GNSS-based positioning method.In the open-sky environment of Experiment 3, the highest accuracy for OTDOA is around 20 m, with the maximum positioning error reaching 122.64 m.In the kinematic tests of Experiments 4 and 5, the positioning error of OTDOA is further increased, with RMS errors of 55.68 m and 77.36 m, median errors of 39.33 m and 62.03 m, and maximum errors of 123.51 m and 165.27 m, respectively.In the challenging urban area of Experiment 6, the OTDOA positioning results are more concentrated, with RMS, median, and maximum errors of 47.61 m, 43.38 m, and 91.01 m, respectively.As explained in the "Methodology" section, a synchronization precision of 1 ns for base stations is fundamental to ensuring that network-based OTDOA positioning can achieve meter-level accuracy.Since the OTDOA algorithm is susceptible to the timing synchronization accuracy between cellular base stations, the positioning results from Experiments 3 to 6 also indirectly reflect the necessity of improving the timing synchronization accuracy of communication networks.

Conclusion and future work
As the world's first smartphone to utilize the PPP-B2b service as an alternative to the conventional SPP functionality, the Redmi K60 Ultra is equipped with Mediatek Dimensity 9200 + chipset that supports multi-frequency measurements.The PPP-B2b service, offered through the A-GNSS location platform developed by the China Academy of Information and Communications Technology, fully complies with the 3GPP-LPP and OMA-SUPL framework.This study meticulously designed six different experimental scenarios to investigate the capabilities of the Redmi K60 Ultra, including analyses of multifrequency and multi-GNSS observation noise, comparisons of Time to First Fix, and evaluations of GNSS-based and network-based positioning performance in various environments.
The analysis of zero-baseline double-difference residuals reveals that the Redmi K60 Ultra enhances the observation accuracy for the BDS, GPS, Galileo, and QZSS systems, except for the GLONASS system.The carrier phase observation noise demonstrates commendable consistency across all constellations and frequencies, with standard deviation below 0.02 cycles.In contrast, the observation noise on the second frequency (L5/E5a/ B2a) is about one-third that on the first frequency (L1/ E1/B1I/B1C).This suggests that the observation accuracy on the second frequency approaches that of low-cost GNSS receivers.Analysis of 100 consecutive cold starts indicates that the Redmi K60 Ultra achieves an average TTFF of 3.65 s in A-GNSS positioning mode.In contrast, the standalone GNSS positioning mode necessitates approximately 32 s to attain successful positioning.Integrating A-GNSS service into the Redmi K60 Ultra enhances the cold start speed by over 85%, significantly diminishing power consumption during smartphone navigation.
Empirical evaluations in various experimental scenarios show that real-time A-GNSS PPP can achieve RMS positioning errors of less than 1.5 m in open-sky conditions and less than 2.5 m in realistic environments.The positioning performance of A-GNSS PPP is far superior to the conventional SPP mode, close to post-processed PPP's precision.Nonetheless, constrained by the time synchronization accuracy of mobile base stations, cellular network-based OTDOA positioning error ranges from 10 to 160 m, which currently can only serve as a rough location estimate.Finally, we explore the positioning performance of 3D-mapping-assisted GNSS in challenging urban areas and its potential integration with A-GNSS service.The results demonstrate that the 3DMA PPP algorithm significantly enhances both the initialization speed and the positioning accuracy compared to traditional PPP.The maximum error is reduced from 25 to 6 m, and the positioning accuracy is improved by over 30%, achieving 2.4 m.
The release of the Redmi K60 Ultra marks a significant milestone, signaling a potential shift in the mass market towards adopting high-precision PPP technology over conventional SPP technology.The A-GNSS location platform, developed by the China Academy of Information and Communications Technology, currently supports basic SPP and high-precision PPP services.Future enhancements to this platform are planned to refine relevant standards and expand multi-source assistance data, including 3D city models, regional atmospheric corrections, integrity information, and Low Earth Orbit (LEO) navigation augmentation to cover seamless positioning services.

Fig. 1
Fig. 1 The relationship between the OMA SUPL and 3GPP positioning protocols represented by a Venn diagram

Fig. 4
Fig. 4 Schematic representation of NLOS reception due to building occlusion providing a coarse location for A-GNSS positioning mode to enhance satellite signal acquisition.The most prevalent RAT-dependent positioning techniques in smartphones are Enhanced Cell Identity (E-CID) and OTDOA.OTDOA triangulates the position by measuring the timing of positioning signals from three or more cellular base stations, typically achieving superior positioning accuracy compared to E-CID(Lin et al., 2017;Xu et al., 2016).One of the primary challenges encountered by OTDOA is the necessity for precise measurement of the signals from neighboring cells for effective positioning.To address this challenge, a specialized positioning subframe, termed the Positioning Reference Signal (PRS), was introduced in 3GPP Release 9 and has been utilized since then (del Peral-Rosado et al., 2012).Figure 6 illustrates network-based OTDOA positioning in a multi-cell scenario.OTDOA relies on measuring the time differences of the PRS transmitted from multiple cells to compute the location.The fundamental principle of OTDOA involves the terminal measuring the time differences of the downlink signals from multiple base stations.The time difference in the arrival of PRS measured from the reference cell and neighbor cells is referred to as the Reference Signal Time Difference (RSTD).The position of the UE can be calculated by utilizing the RSTD measurements, the known locations of the BS transmitting antennas, and the transmission times for each cell.

Fig. 6
Fig. 6 Network-based OTDOA Positioning in the multi-cell scene

Fig. 7
Fig. 7 Experimental scenarios under different test conditions.a Experiment 1-observation noise analysis under zero baseline condition b Experiment 2-TTFF comparison in areas with good cellular signal quality c Experiment 3-static positioning test under open sky d Experiment 4-kinematic positioning test under open sky e Experiment 5-kinematic positioning test in realistic environment f Experiment 6-3DMA GNSS positioning exploration in challenging urban area , zero baseline Observation noise analysis of code pseudorange and carrier phase for multi-frequency and multi-GNSS Experiment 2 Outdoor, good cellular signal quality TTFF comparison of standalone GNSS and A-GNSS positioning modes Experiment 3 Open-sky environment, static Evaluation of static positioning performance under an ideal observation condition Experiment 4 Open-sky environment, kinematic Evaluation of kinematic positioning performance under an ideal observation condition Experiment 5 Realistic environment, kinematic Evaluation of kinematic positioning performance under a general observation condition Experiment 6 Challenging urban areas, static Feasibility exploration of the 3DMA GNSS algorithm and its integration with A-GNSS service

Fig. 9
Fig. 9 Schematic diagram of zero baseline experiment specific values of STD statistics for code pseudorange and carrier phase noise for different experimental equipment.The code pseudorange and carrier phase are measured in meters and cycles.Code pseudorange and carrier phases not supported by the experimental devices are represented by short horizontal lines.Statistical analysis clearly shows that the GLONASS system shows the highest observation noise among all satellite constellations, possibly due to specific problems in processing Frequency Division Multiple Access (FDMA) modulated signals.Conversely, the observation noise on Code Division Multiple Access (CDMA) modulated signals falls within the expected range.The code noise STD of the Redmi K60 Ultra for each constellation and frequency is relatively uniform.The carrier phase noise of the Redmi

Fig. 10
Fig. 10 Observation noise sequence of code pseudorange and carrier phase extracted from zero-baseline double-difference residuals.a Code noise sequence b Carrier phase noise sequence

Fig. 11
Fig. 11 STD statistics of code pseudorange and carrier phase noise.a Code noise STD b Carrier phase noise STD

Fig. 13
Fig. 13 Positioning results of the Redmi K60 Ultra smartphone under different environments.a Static positioning errors in the open-sky environment of Experiment 3 b Satellite overhead view of Experiment 3 c Kinematic positioning errors in the open-sky environment of Experiment 4 d Satellite overhead view of Experiment 4 e Kinematic positioning errors in the realistic environment of Experiment 5 f Satellite overhead view of Experiment 5 presents the sky mask generated for an observation epoch centered on the user equipment.Red dots in the sky mask indicate NLOS satellites, green dots indicate LOS satellites and gray areas indicate building blocks.It is evident from the sky mask that dense urban structures severely block satellite signals, particularly within an almost 90-degree elevation range to the south.Despite the Redmi K60 Ultra smartphone's capability to track multi-constellation and multi-frequency, its builtin linearly polarized microstrip antenna is sensitive to signals from all directions.Consequently, as shown in the figure, the Redmi K60 Ultra tracks 21 LOS signals while receiving 22 NLOS signals.NLOS reception poses a significant challenge for GNSS data processing, as conventional outlier detection methods cannot completely mitigate all multipath effects.

Fig. 14 A
Fig. 14 A sky mask generated at a specific observation epoch centered at the user equipment, where red dots represent NLOS signals, green dots represent LOS signals, and the grey shaded areas indicate building blockage

Fig. 15 C
Fig. 15 C/N 0 comparison of LOS and NLOS signals at a specific observation epoch

Fig. 17
Fig. 17 Positioning results of different methods under a challenging urban area in Experiment 6. a 2D positioning error sequence b Satellite overhead view of positioning results

Fig. 18
Fig. 18 2D positioning errors derived from various positioning methods in Experiments 3 to 6. a Box plot representations of the 2D positioning errors b Key features of the box plot Users can achieve real-time PPP processing across multiple systems and frequencies by implementing the corrections for satellite orbits, clock offsets, and code biases.

Table 2
The experimental scenarios and objectives for the six different experiments

Table 4
Specific values of STD statistics for code pseudorange and carrier phase noise on different experimental devicesThe symbol "-" indicates that the current observation is not available

Table 5
Specific settings for standalone GNSS and A-GNSS positioning modes

Table 6
Specific description of different positioning methods

Table 7
Positioning error statistics of various positioning methods in Experiments 3 to 6 MethodResult of experiment 3 (m) Result of experiment 4 (m) Result of experiment 5 (m) Result of experiment 6 (m)