- Research
- Open Access
- Published:

# Leveraging MIMO-OFDM radio signals for device-free occupancy inference: system design and experiments

*EURASIP Journal on Advances in Signal Processing*
**volume 2018**, Article number: 44 (2018)

## Abstract

In device-free radio frequency (RF) body occupancy inference systems, RF signals encode information (e.g., body location, posture, activity) about moving targets (not instrumented) that alter the radio propagation in the surroundings of the RF link(s). Such systems are now getting more attention as they enable flexible location-based services for new *smart* scenarios (e.g., smart spaces, safety and security, assisted living) just using off-the-shelf wireless devices. The goal of this paper is to set the fundamental signal processing methods and tools for performance evaluation of passive occupancy inference problems that leverage on the analysis of physical layer (PHY) channel state information (CSI) obtained from multiple antennas (spatial domain) and carriers (frequency domain) jointly. To this aim, we consider here a multiple-input multiple-output orthogonal frequency-division multiplexing (MIMO-OFDM) radio interface adopted in high-throughput WiFi networks such as IEEE 802.11n,ac. The proposed approach investigates at first relevant CSI features that are more sensitive to body presence; next, it proposes a space-frequency selection method based on principal component analysis (PCA). Considering an experimental case study with WiFi links, we show that the joint space- and frequency-domain processing of the radio signal quality indicators enable both detection and localization of two independent targets (i.e., human bodies) arbitrarily moving in the surroundings of the transmitter/receiver locations. Experiments are conducted using off-the-shelf WiFi devices configured to extract and process CSI over standard PHY preambles: performance analysis sets the best practices for system design and evaluation.

## Introduction

Device-free body occupancy inference and localization/tracking systems are generally designed to passively evaluate the position, size, and orientation of human bodies or objects (i.e., the targets) placed near a radio link without the need to instrument the monitored targets [1–3]. Radio frequency (RF) signals commonly adopted for wireless communications are perturbed by the presence of targets, their movements, and the changing surrounding scenario. This happens due to the propagation of the electromagnetic (EM) waves and their interactions with the target(s) and the environment through reflection, scattering, and diffraction phenomena. In general, occupancy inference is based on real-time processing of channel quality information (CQI) values that are commonly used at the receiver side for communication tasks, since it quantifies the radio signal quality in almost all wireless devices. The perturbations induced by the moving target(s) on the EM wave field can be measured from CQI data and then processed to recover a *vision* of the monitored area. Applications of this technology are found in industrial automation [4] and assisted living [5], while typical body recognition systems address body and occupancy detection [6–8], situation estimation [9], and device-free localization (DFL) applications [2].

Most of the previous works consider aggregated link layer (or upper layer) metrics to assess the CQI, such as the received signal strength (RSS) data or the link quality information (LQI) [1]. In fact, for its availability in almost all wireless devices, RSS has been adopted for many inference problems such as localization [10–12], activity recognition [13, 14], target size evaluation [15], and detection [16]. However, RSS metric performance degrades in complex environments because of multipath fading and fast temporal dynamics. The use of physical layer (PHY) raw signal features, although not yet fully standardized [10], is believed to provide significant performance improvements.

The aim of this paper is to address fundamental passive occupancy detection and localization problems that leverage on low-level (i.e., PHY-based) channel state information (CSI), as well as to set the fundamental framework, methods, and tools for low-level CSI processing and data analytics. We focus here on spatial-frequency diversity in multichannel communication with multiple antennas extracting robust features that are sensitive to target presence and position. In addition, we propose a tool based on subspace decomposition method to select the radio signal components that are more sensitive to target presence, for the twofold aim of increasing the location estimation accuracy, without penalizing the processing complexity. To this end, we consider a multiple-input multiple-output (MIMO) orthogonal frequency division multiplexing (OFDM) radio interface design adopted in off-the-shelf WiFi networks, i.e., IEEE 802.11n and IEEE 802.11ac, and focus on standard PHY-based CSI report fields. Such fields carry explicit channel quality information, commonly measured for standard compliant transmitter (TX) receiver (RX) low-level link adaptation, as well as for PHY-based equalization. Focusing on the general problem of passive body occupancy inference, different CSI features are considered that leverage body-induced alterations of estimated power measurements as well as antenna/frequency correlation profiles. These features are then compared to show their effectiveness in capturing body movements.

The presence of the targets may modify the link conditions as well as selected channel features, depending on their positions and change to non-line-of-sight (NLOS) situations [17]. The proposed framework leverages the existing WiFi standard and unmodified WiFi devices, while features of the channel are extracted from the PHY layer. In contrast to other works in the field (see, i.e., [18, 19]), we are considering features that are directly extracted from CSI standard feedback reports (in the form of channel state information over adjacent OFDM sub-carriers and antennas) and that are commonly computed by off-the-shelf, and unmodified, WiFi transceiver devices. The paper thus exploits the characteristics of a (MIMO-OFDM) wireless communication in terms of multiple antennas and different sub-carriers in which different channel features (namely statistical or physical attributes) can be observed to detect and then localize targets in the monitored area. We show that tracking the alterations of the channel response over MIMO TX-RX antenna pairs (or links) can improve the detection performance by exploiting multiple links such as the ones depicted in Fig. 1. In this figure, a WiFi access point with *M*_{t}=3 antennas exchanges signals with a WiFi station equipped with *M*_{r}=3 antennas, and the different MIMO links *ℓ*_{1},..., *ℓ*_{9} may be exploited for spatial diversity processing. In addition, the use of multi-carrier OFDM modulation enables multi-dimensional processing of CSI over a frequency grid that depends on the OFDM sub-carrier arrangements and allows a fine-grained processing for target detection and localization.

### Related works

Recently, processing of PHY-based CSI data instead of aggregated medium access control (MAC) layer strength indicators, such as RSS values, has attracted a lot of interest, since CSI is able to achieve improved accuracy, finer sensing granularity [20, 21], and robustness in complex environments [22]. Therefore, processing of CSI holds the potential for building more robust recognition systems [23, 24]. In fact, CSI has been utilized in different device-free sensing approaches such as human localization [25], activity recognition [26], and target detection [27]. In the latter reference, the authors propose a CSI-based DFL system leveraging temporal stability and frequency diversity of CSI in WLAN for anomaly detection and localization, by using a demonstrator for indoor scenarios with commercial IEEE 802.11n network interface cards (NICs). Device-free fall detection using WiFi is proposed in [9] by employing CSI as an indicator of the target activities. The proposed approach learns specific CSI signal amplitude patterns using machine learning algorithms to detect fall events. In [5, 28], CSI are extracted for the purpose of localization and device-free activity recognition using ad hoc software radio platforms (i.e., the USRP platform from Ettus). Occupancy estimation is investigated in [7] using WiFi power measurements by characterizing the impact of the number of people on the induced scattering effects.

### Original contributions

Previous works in the field focused on simple CSI signatures, including amplitude/phase information [29] as well as power profiles. In this paper, we elaborate on the use of more complex CSI statistical feature that can be extracted from a MIMO-OFDM radio interface. Such features are designed to capture the body-induced alterations of the channel state as tracking the fading correlation over co-located WiFi antennas and frequencies (OFDM sub-carriers). In more detail, the main contributions of the paper are:

1) A novel approach is proposed for passive occupancy detection, based on the evaluation of the space-frequency fading correlation that is induced by body motions. Correlation profiles are extracted from a MIMO-OFDM PHY-based interface and complies with WiFi high-throughput standards. The approach extends the reference [30] that is focused on multi-channel communication systems, and it is tailored to detect targets in the monitoring area in a reliable and accurate mode. The proposed method is compared with other approaches [5, 7];

2) Tracking of the space-frequency correlation is shown also to be beneficial in multiple target DFL applications. In particular, to support localization and tracking of targets, a subspace decomposition (SD) method is proposed to isolate the MIMO links as well as the OFDM sub-carriers that are mostly influenced by target movements from those induced by other effects and are thus more informative for the considered inference problems. By discarding non-informative CSI measurements, the method, referred to as SD-DFL, is not only able to reduce the data set dimension but also to improve the DFL performance in terms of accuracy as making the most of the space-frequency diversity processing;

3) An extensive experimental validation is conducted using WiFi IEEE 802.11n-compliant MIMO devices equipped with three antennas and operating at 5 GHz. The devices are configured to extract and process CSI over standard PHY preamble symbols that comply with the MIMO-OFDM HT (high-throughput) mode. These symbols are purposely monitored to obtain the CSI over *m*=30 contiguous sub-carriers. Experiments validate the proposed approaches for joint occupancy detection and localization in an indoor scenario.

The paper is organized as follows: PHY layer modeling of the MIMO-OFDM interface for the purpose of device-free occupancy inference is introduced in Section 2. The specific WiFi signal structure implementing the MIMO-OFDM interface and the standard-compliant CSI report fields is described in Section 3. Occupancy detection problems, namely target detection and localization, are described in Sections 4 and 5, while Section 6 shows the experimental scenario and points out the results. The concluding remarks are drawn in Section 7.

## Channel state information feature modeling for MIMO-OFDM

In this section, we consider, at first, the problem of modeling the CSI for MIMO-OFDM radio interfaces. Then, we propose the use of some relevant channel features for occupancy inference. Data processing on CSI reports for MIMO-OFDM devices gives the opportunity to exploit *both* frequency- *and* space-domain manipulation of time series. In fact, OFDM devices exploit *m* contiguous pilot sub-carriers (depending on the specific pilot arrangement required by the IEEE 802.11n standard) from which CSI can be estimated at the receiver side. In addition, MIMO-enabled devices can extract CSI measurements from multiple transmit-receive antenna pairs (*M*_{t} and *M*_{r} antennas, respectively) leveraging spatial diversity.

### MIMO-OFDM channel model for occupancy inference

In what follows, we focus on the problem of obtaining information about body (or target) occupancy from the broadband, multi-carrier-modulated, and radiation of an unmodified wireless devices (e.g., WiFi radio sources) adopted for high-throughput communication. Considering the WiFi PHY, we assume that the effects of the target presence on the channel response are observed at discrete time instants \(t\in \mathcal {T}=\{1,2,...,T\}\) of consecutive OFDM received symbols (or frames) and are embedded into a characteristic footprint of channel variations over *T* symbols. The time-varying channel response *h*_{t}(*τ*) at symbol time \(t\in \mathcal {T}\) captures the absence *h*_{t}(**τ****∣***x*^{d}=*∅*) or presence \(h_{t}\left (\mathbf {t\!\mid }\mathbf {x^{\mathit {d}}}\in \mathcal {X}\right)\) of a target *d* located at position *x*^{d}=[*x*^{d},*y*^{d}]^{T} in the link sensing area \(\mathcal {X}\) as

The amplitude *α*_{n}(*t*∣*x*^{d})=*α*_{n}+△*α*_{n}(*t*∣*x*^{d}) perturbations over sub-carriers as induced by body movements are expressed in decibel scale and modelled as Gaussian (or lognormal in linear domain). In addition, the phase shift *ϕ*_{n} (*t* ∣ **x**^{d}) = *ϕ*_{n} + *Δ**ϕ*_{n}(*t* ∣ *x*^{d}) and the delay *τ*_{n}(*t* ∣ *x*^{d}) = *τ*_{n} + *Δ**τ*_{n} (*t*∣*x*^{d}) of the *n*-th ray, with \(n\in \mathcal {N}=\{1,2,...,N\}\), highlight the additional human-induced perturbations with respect to the human-free (i.e., the empty scenario) state *x*^{d}=*∅*. The OFDM radio interface has the capability to exploit the pre-existing (standard-defined) pilot sub-carrier arrangement, used for conventional channel estimation [31], to extract a number of independent noisy measurements of the frequency-domain channel response shown in (1). The channel response is thus monitored over *m* narrow-band sub-carriers in the frequency domain \(f_{i}\in \mathcal {F}=\{f_{1},f_{2},\ldots,f_{m}\}\) where \(\mathcal {F}\) indicates the pilot sub-carrier arrangement set for the symbol time *t*. Training/reference OFDM symbols for channel estimation are usually multiplexed with information symbols and embedded in each data frame according to the adopted WiFi standard (see Section 3 for details).

Let us further consider a MIMO network and, for each node, *M*_{t} transmitting and *M*_{r} receiving antennas: in the frequency domain, the baseband discrete-time representation [32] of the MIMO-OFDM received pilot symbol vector \(\mathbf {Y}_{t,q_{u}}\) of length *m* over the antenna *q*_{u} with *u*=1,...,*M*_{r} is defined as

where for each link *ℓ*_{j} corresponding to the transmitter-receiver (*p*_{v},*q*_{u}) pair in Fig. 1, the vector \(\mathbf {H}_{t}^{\ell _{j}}=\left [H_{t}^{\ell _{j},f_{1}},...,H_{t}^{\ell _{j},f_{m}}\right ]\) contains the CSI over the *m* pilot sub-carriers while **N**_{t} is the additive noise vector at the *u*-th receiver antenna and the vector \(\mathbf {T}_{t,p_{v}}\) collects the transmitted pilot symbol, i.e., possibly pre-coded [32] to allow for multiplexing of multiple spatial streams that are transmitted by the *v*-th antenna.

### CSI features and extraction

We assume that the channel estimator stage of the WiFi device extracts an estimate of the CSI vectors \(\mathrm {\left \{ \mathbf {H}_{\mathit {t}}^{\ell _{\mathit {j}}}\right \}_{\ell _{\mathit {j}}\epsilon \mathcal {L}}}\) at each symbol and for all *L*=*M*_{t}×*M*_{r} MIMO links \(\mathcal {L}=\left \{ \ell _{1},\ell _{2},...,\ell _{L}\right \} \). For the purpose of device-free occupancy inference, we define the baseband channel vector responses \(\mathbf {H}_{t}^{\ell _{j}}\left (\mathbf {x^{\mathit {d}}}\right)\) and \(\mathbf {H}_{t}^{f_{i}}\left (\mathbf {x^{\mathit {d}}}\right)\) as

and

that collect the CSI measurements \(\mathbf {H}_{\mathit {t}}^{\ell _{\mathit {j}}}\) over the active sub-carriers groups (for the *j*-th MIMO link *ℓ*_{j}) and similarly, the MIMO links \(\mathbf {H}_{t}^{f_{i}}\left (\mathbf {x^{\mathit {d}}}\right)\) for the given *i*-th sub-carrier \(f_{i}\in \mathcal {F}\), respectively. Note that in what follows, channel strength features (in dB scale) are modelled as Gaussian (or lognormal in linear domain).

Till now, we have implicitly assumed a single target scenario. In what follows, we consider body occupancy inference problems featuring (*N*_{d}≥1) targets that can freely move within the monitored area \(\mathcal {X}\). Each *d*-th target, with *d*=1,...,*N*_{d}, thus moves by covering the discrete locations \(\mathbf {x^{\mathit {d}}}\in \left \{ \mathbf {K}_{c}\right \}_{c=0}^{N_{K}}=\mathcal {K}\), with *N*_{K} being the number of monitored locations (assuming that the targets do not occupy the same position at the same time). In the next sections, we will also assume that the wireless communications used for human sensing is established between a TX and a RX WiFi device (or two RX devices when noted) and that the presence of the targets does not impair the communication itself.

#### Channel strength and perturbation features

We define the terms \(\phantom {\dot {i}\!}s_{f_{i},\ell _{j},t}=|H_{t}^{\ell _{j},f_{i}}|_{\text {dB}}^{2}\) that represent the quality/strength of the CSI observed over the pilot symbol (or frame) *t*, for a given MIMO-OFDM sub-carrier \(f_{i}\in \mathcal {F}\) and link \(\ell _{j}\in \mathcal {L}\). In the following, these values are interpreted as PHY-based RSS or channel strength data measured in decibel scale. According to Eqs. 3 and 4, at the frame time *t*, the vector

collects all frequency-domain measurements of the channel response, and, similarly, the vector

collects the space-domain measurements over all active MIMO links, for the given *i*-th pilot sub-carrier.

For instance, Fig. 2 shows received signal average \({\mu }_{f_{i},\ell _{j}}\) and standard deviation \({\sigma }_{f_{i},\ell _{j}}\) in space and frequency domains in empty and occupied environment with single and double targets. Figure 2a shows the received signal average over time for the link index 5 (i.e., *ℓ*_{5}) versus the sub-carriers and clearly represents that received signal attenuates more in the occupied environment and, therefore, may be exploited to discriminate between single and double targets. Figure 2b shows the standard deviation versus the sub-carriers \(\mathcal {F}\) that is used as a proper feature to capture target-induced information. For these figures, both single (*N*_{d}=1) and double (*N*_{d}=2) target scenarios are shown where the targets are obstructing the TX-RX line-of-sight (LOS) path. The corresponding test cases are described in Fig. 2e, where *N*_{K}=7 positions along the LOS path are monitored. In the single target case, the target *d*=1 can change its position moving from **K**_{1} up to **K**_{7}, while in the double target scenario, the target *d*=2 is always located in position **K**_{1} while the other target can freely move and occupy the remaining positions from **K**_{2} up to **K**_{7}. Likewise, Fig. 2c, d shows the average of the CSI measurements \(\mathbf {\mu }_{f_{2},\ell _{j}}\) and the standard deviation \({\sigma }_{f_{2},\ell _{j}}\) for the specific frequency index 2 (i.e., *f*_{2}) versus the links \(\mathcal {L}\). The targets obstructing the TX-RX LOS path produce significant perturbations of the channel response over both OFDM sub-carriers and MIMO links. Furthermore, single and double target effects are easily separable both in the space and frequency domain. As shown in Section 4, these qualitative considerations will be exploited to solve the target detection and localization problems. As an additional example, Fig. 3 shows the target-induced recieved signal attenuation \(s_{f_{15},\ell _{5},t}\) versus the frame time *t* obtained from link *ℓ*_{5} and sub-carrier *f*_{15} at two MIMO receivers. Figure 3b shows the fluctuations of the channel attenuation corresponding to the target obstructing the blue link (i.e., target is located at position **K**_{14}) compared with the unobstructed red link. Figure 3d shows the signal attenuation for the target at position **K**_{28} in the monitored area. As expected, the target presence affects both attenuation and random fluctuations of the CSI measurements.

Stochastic modeling is adopted here to relate the perturbations of the power measurements to the target(s) located at positions \(\mathcal {\mathbf {x}^{\mathit {d}}\in K}\). In what follows, the whole set of target positions, **X** is defined as \(\mathbf {X}=\left \{ \mathbf {x}^{d}\right \}_{d=1,...,N_{d}}\). A lognormal power model [33] is here adopted to relate the RSS mean and variance with the target location. Specifically, \(\forall \ell _{j}\in \mathcal {L}\), the RSS \(s_{f_{i},\ell _{j},t}\) is modelled as a Gaussian random variable with statistics that depend on the absence or presence of at least one target inside the sensing area \(\mathcal {X}\), as [34]

In the empty scenario case \(\mathbf {x}^{d}\notin \mathcal {X}\), i.e., for all targets outside the sensing area, the RSS has mean \(\mu _{f_{i},\ell _{j}}(\emptyset)=\mu _{f_{i},\ell _{j}}^{(p)}(\emptyset)+\mu _{f_{i},\ell _{j}}^{(m)}(\emptyset)\) that accounts for path loss \(\mu _{f_{i},\ell _{j}}^{(p)}(\emptyset)\) and static multipath effects \(\mu _{f_{i},\ell _{j}}^{(m)}(\emptyset)\), while \(w_{f_{i},\ell _{j}}(\emptyset)\propto \mathcal {N}\left (0,\sigma _{f_{i},\ell _{j}}^{2}(\emptyset)\right)\) models the random fluctuations over time due to the measurement errors or caused by small variations in the environment. When at least one of the targets is located in \(\mathcal {X}\) then \(\mu _{f_{i},\ell _{j}}(\mathbf {X})=\mu _{f_{i},\ell _{j}}^{(p)}(\emptyset)-\Delta \mu _{f_{i},\ell _{j}}^{(d)}(\mathbf {X})+\mu _{f_{i},\ell _{j}}^{(m)}(\mathbf {X})\), where \(\Delta \mu _{f_{i},\ell _{j}}^{(d)}(\mathbf {X})\) is the additional attenuation caused by the target(s) and \(\mu _{f_{i},\ell _{j}}^{(m)}(\mathbf {X})\) describes the body-induced multipath effects.

According to (7), when the targets are moving inside the sensitivity area, the received signal is subject to an increased fluctuation due to the random term \(w_{f_{i},\ell _{j}}(\mathbf {X})\propto \mathcal {N}\left (0,\sigma _{f_{i},\ell _{j}}^{2}(\mathbf {X})\right)\) (see Fig. 3). The target-induced attenuation \(\mu _{f_{i},\ell _{j}}(\mathbf {X})\) and the standard deviation *σ*_{ℓ}(**X**) are given by

where \(\Delta \mu _{f_{i},\ell _{j}}(\mathbf {X})=\Delta \mu _{f_{i},\ell _{j}}^{(d)}(\mathbf {X})+\mu _{f_{i},\ell _{j}}^{(m)}(\emptyset)-\mu _{f_{i},\ell _{j}}^{(m)}(\mathbf {X})\) highlights the changes induced by the target presence with respect to the empty scenario, while \(\Delta \sigma _{f_{i},\ell _{j}}(\mathbf {X})\geq 0\) denotes the corresponding increase of the RSS fading. Note that RSS observations are continuously sampled over a finite time interval (e.g., 10 ms for system validation of Section 6) that depends on the device duty cycle. During the validation tests, the targets can freely move, turn, or change posture and position while the localization results are updated every sample interval (i.e., every 10 ms, as previously mentioned, for the experimental setup shown in Section 6).

#### Space- and frequency-domain profiles

Given the targets located at **X**, the probability terms Pr(**s**_{t}|**X**) for \(\phantom {\dot {i}\!}\mathbf {s}_{t}=\mathbf {s}_{f_{i},t}\) and \(\phantom {\dot {i}\!}\mathbf {s}_{t}=\mathbf {s}_{\ell _{j},t}\), representing both space- and frequency-domain CSI measurements, respectively, can be effectively modeled as a multivariate Gaussian distribution. Using the model in (7), (8) and (9), it is

The mean vector and covariance matrix pairs {** μ**(

**X**),

**C**(

**X**)} can be defined over the frequency domain, namely \(\left \{\boldsymbol {\mu }_{\ell _{j}}(\mathbf {X})\mathbf {\textrm {,}\,C}_{\ell _{j}}(\mathbf {X})\right \} \) or the space domain \(\left \{ \boldsymbol {\mu }_{f_{i}}(\mathbf {X})\textrm {,}\,\mathbf {C}_{f_{i}}(\mathbf {X})\right \} \). In particular, the mean vector

of size *m*×1 and the covariance matrix

of size *m*×*m* denote the target-induced *frequency-domain* multipath profile. Similarly, the mean vector

of size *L*×1 and the covariance matrix

of size *L*×*L* describe the corresponding *space-domain* multipath profile.

#### Space- and frequency-domain correlation features

Considering the MIMO-OFDM interface, an additional statistical attribute considered here for body occupancy inference is the CSI correlation measured across selected links (space) and/or across selected sub-carriers (frequency) pairs. Effects of body movements on space- and frequency-domain correlation of channel fading are still unexplored in the literature (see Section 1.1). In the following sections, we prove that, compared to the unobstructed environment, the presence of the target affects both space- and frequency-domain channel correlation, while such alterations can be exploited as a reliable feature for body detection and localization. Considering the MIMO channel response over the sub-carrier *f*_{i}, correlation between links *ℓ*_{a} and *ℓ*_{b} is defined as

Likewise, frequency-domain correlation for a given link *ℓ*_{j} and between the frequency pair *f*_{a} and *f*_{b} is described by

Sample averaging considers here *T*=10 consecutive PHY layer frames from which new CSI reports are extracted. As clarified in Section 3, this corresponds to a time window of 100 ms.

## WiFi MIMO-OFDM radio interface and case study description

In this section, we introduce the experimental scenario and describe the details about the WiFi network configuration adopted for algorithm validation. The experimental activities have been conducted inside an indoor lab environment of about 4 m×6 m shown in Fig. 4a. The area is subject to co-channel WiFi interference originated from other WiFi devices. In addition, people can walk and move outside the room (in a corridor) causing unwanted perturbations of the RF field inside the monitored area. *N*_{K}=28 landmarks, depicted in Fig. 4b, are used for model (7) calibration as well as for the evaluation of the projection matrices that are needed in the sub-space decomposition method (Section 5.2). Although all targets can freely move in the detection area independently without crossing each other, in Fig. 4c, three trajectories are considered for the double target scenario: trajectory #1 is represented by positions 14 down to 8, trajectory #2 by positions 15 to 21, and trajectory #3 by positions 28 down to 22.

We employed a network of MIMO-OFDM WiFi devices configured in monitor mode and working in the 5.32-GHz band (i.e., WiFi band 2, channel 64, sub-carrier spacing 312.5 kHz, and nominal bandwidth equal to 20 MHz). The monitor mode has been selected here for CSI data collection since it allows any deployed transceiver to observe the WiFi traffic on the considered channel without explicit IP handshaking procedures. One TX device is programmed to inject (or transmit) custom IEEE 802.11n PHY protocol data units (PPDU) structured as standard high-throughput (HT) greenfield WiFi format [35], including preamble, MAC addresses, header, and payload; injected frames are sent at regular time intervals of 10 ms.

As depicted in Fig. 4, in our tests, only two receiver devices (i.e., RX1 and RX2) are used. In general, many WiFi devices can be placed in monitor mode and configured to capture WiFi frames at the PHY layer. A modified chipset firmware and driver [36] have been used to obtain the CSI samples of received IEEE 802.11n data frames. The adopted chipset is the Intel Wireless Link 5300 (i.e., the IWL5300 PCIe Mini Card) working as a MIMO-OFDM baseband modem in HT mode as well as exploiting spatial multiplexing through transmit beamforming. The modified driver allows to extract the standard CSI reports for unicast/broadcast packets but limits the possibility of opportunistically collecting CSI matrices by eavesdropping [37]. As shown in the scenario depicted in Fig. 4a, all WiFi devices are installed on low-power single-board computers (SBC) supporting battery-powered operations.

The considered WiFi chipset reports the CSI for a subset of the OFDM sub-carriers, as defined by the grouping option *N*_{g} in the IEEE 802.11n standard [35]. Focusing on the 20-MHz bandwidth mode, with 64 available sub-carriers, that include data, pilot, and null sub-carriers, the IWL5300 board reports CSI data for *m*=30 sub-carriers, with grouping number *N*_{g}=2. According to the MIMO-OFDM baseband model depicted in Fig. 4d, the effective bandwidth considered for monitoring of channel frequency selectivity is equal to 18.75 MHz.

All IWL5300 boards are equipped with *M*_{t}=*M*_{r}=3 antennas used both at the transmitter and receiver side. The transmitter multiplexes three spatial streams, while the modulation and coding scheme (MCS) adopted for the injected frames corresponds to the QPSK modulation with coding rate 1/2 [38] (i.e., MCS 17). Focusing on CSI estimation, a single probe transmitted from all the antennas is used at the receiver side to provide an estimate of the frequency-domain CSI terms [39] for each pilot sub-carrier, \(\hat {\mathbf {H}}_{t}^{f_{i}}=\mathrm {\mathbf {W}}\mathbf {H}_{t}^{f_{i}}\), multiplied by the corresponding spatial pre-coding matrix **W**. To obtain the CSI vectors \(\mathbf {H}_{t}^{f_{i}}\) to be used for occupancy inference, we post-multiply the obtained estimates \(\hat {\mathbf {H}}_{t}^{f_{i}}\) as \(\mathbf {H}_{t}^{f_{i}}=\mathrm {\mathbf {W^{\mathrm {-1}}}}\hat {\mathbf {H}}_{t}^{f_{i}}\), while known pre-coding matrix **W** is extracted from the beamforming information and depends on the specific Intel chipset used [37].

In the next sections, the problem we tackle is twofold. First, we address the target occupancy detection (Section 4), then the problem of *multi-target* positioning inside the same detection area is investigated. For both cases, different PHY-based channel features (defined in Section 2) are evaluated to compare body-induced alterations, over the space and/or frequency domain, respectively.

## Passive body motion detection: tracking of body-induced fading correlation

We consider here *N*_{d}=2 targets, labelled as *d*=1,...,*N*_{d} that are located at positions **X**_{t}=**X** at a given time *t*; the targets can freely move inside the detection area \(\mathcal {X}\) (Fig. 4a) surrounding the WiFi links. According to the model in (7), the occupancy detection problem, i.e, absence or presence of the subjects inside the detection area, is solved by tracking the MIMO-OFDM space-frequency correlations of the CSI, defined in Eqs. (15) and (16), among links (i.e., antennas) and sub-carriers. In particular, the occupied environment affects both space correlation \(\mathbf {r_{\mathrm {\mathit {f_{i}}}}}=\left \{ r_{\ell _{a},\ell _{b}}^{f_{i}}:\forall (\ell _{a},\ell _{b})\right \}\), for the sub-carrier *f*_{i}, considering all link pairs, and frequency correlation \(\mathbf {r_{\mathrm {\mathit {\ell _{j}}}}}=\left \{ r_{f_{a},f_{b}}^{\ell _{j}}:\forall (f_{a},f_{b})\right \}\), for the link *ℓ*_{j}, considering all pilot sub-carriers pairs.

In the example of Fig. 5a, the frequency-domain correlation \(r_{f_{a,}f_{b}}^{\ell _{j}}\) between *f*_{a}=*f*_{2} and *f*_{b}=*f*_{25} is evaluated over all available links. In Fig. 5b, the corresponding space-domain correlation \(r_{\ell _{a,}\ell _{b}}^{f_{i}}\) is now shown for the selected link pair *ℓ*_{a}=*ℓ*_{1} and *ℓ*_{b}=*ℓ*_{9} with respect to all sub-carriers. The red lines correspond to the occupied environment with single target (*N*_{d}=1), while the blue ones refer to the environment now occupied by two targets (*N*_{d}=2). For all cases, the presence of the moving subjects leaves a characteristic footprint on the correlation when compared with the fading correlation curves (green lines) observed in the empty environment. In fact, when the target(s) enter(s) in the monitored area, the observed space/frequency correlation of the channel reduces, as also observed in [40], with respect to the empty environment. This is the result of the perturbed radio propagation and the new multi-path components originated from the interaction with the targets. Using both features, in Section 6, we will analyze and compare the detector performance.

## Device-free localization: space- and frequency-domain decomposition methods

A DFL technique is designed to leverage the MIMO-OFDM interface for tracking of multiple targets in the occupied environment. We assume that the detection of the subjects entering in the area follows the approach described in the previous section. The DFL tool allows to recover the positions **X**_{t} of the subjects and track their locations **X** over time *t*. Positioning is based on the run-time collection of the CSI from multiple MIMO links and sub-carriers as defined by the measurement vector in the space \(\phantom {\dot {i}\!}\mathbf {s}_{t}=\mathbf {s}_{f_{i},t}\) or frequency \(\phantom {\dot {i}\!}\mathbf {s}_{t}=\mathbf {s}_{\ell _{j},t}\) domain as already explained in Section 2.

In the following section, two localization approaches are compared to effectively track body-induced space-frequency channel profiles using PHY layer MIMO-OFDM WiFi links. According to the first approach, both space- and frequency-domain channel profiles are applied to the positioning problem, then we propose a novel method that exploits the subspace decomposition algorithm to optimally choose the more informative sub-carriers/links for location estimation. Comparative analysis is finally carried out by an experimental campaign.

### DFL approaches with space- and frequency-domain CSI profiles

In this section, space- and frequency-domain channel profiles are exploited for location estimation. A maximum likelihood (ML) approach [34] is here revisited as tailored for low-level CSI features. For *N*_{d} targets occupying the detection area \(\mathcal {X}\), maximization of the log-likelihood

gives the estimated target locations \(\mathbf {\widehat {X}}_{t}\); (ML criterion) by using space-domain channel profiles, the estimate is given by

To obtain the likelihood \(\text {Pr}\left (\mathbf {s}_{t}=\mathbf {s}_{f_{i},t}|\mathbf {X}_{t}\right)\), also in (10), both reference configuration \(\left \{ \mathbf {\mathbf {\mathbf {\boldsymbol {\mu }}}}_{f_{i}}(\mathbf {\emptyset }),\,\mathbf {C}_{f_{i}}(\emptyset)\right \} \), corresponding to the empty scenario, and the space profile \(\left \{ \mathbf {\mathbf {\boldsymbol {\mu }}}_{f_{i}}(\mathbf {X}),\,\mathbf {C}_{f_{i}}(\mathbf {X})\right \} \) should be evaluated during the calibration stage for each sub-carrier \(f_{i}\in \mathcal {F}\) and over a selected *N*_{d} set of landmarks inside the detection area. Using frequency-domain profiles, it is

In this case, the likelihood \(\text {Pr}\left (\mathbf {s}_{t}=\mathbf {s}_{\ell _{j},t}|\mathbf {X}_{t}\right)\) is evaluated according to both reference \(\left \{ \mathbf {\mathbf {\boldsymbol {\mu }_{\ell _{\mathit {j}}}}}(\emptyset),\,\mathbf {C}_{\ell _{j}}(\emptyset)\right \} \) and frequency-domain configuration \(\left \{ \mathbf {\mathbf {\boldsymbol {\mu }}}_{\ell _{j}}(\mathbf {X}),\,\mathbf {C}_{\ell _{j}}(\mathbf {X})\right \} \) for every *N*_{d} set landmarks \(\mathbf {x}\in \mathcal {X}\) and MIMO links \(\ell _{j}\in \mathcal {L}\), obtained during the same calibration stage.

Space and frequency profiles are here exploited for real-time multi-target localization scenario. The Bayesian approach for device-free localization [12] makes a decision based on the *a posterior* probability Pr(**X**_{t}∣**S**_{t}), where **S**_{t}=[**s**_{1},...,**s**_{t}]^{T} collects all CSI measurements up to time *t*. Using the space-domain profiles, the a posterior probability (in log-domain) is computed as

being \(\mathbf {S}_{f_{i},t-1}=\left [\mathbf {s}_{f_{i},1},...,\mathbf {s}_{f_{i},t-1}\right ]\). With frequency-domain profiles it is

with \(\mathbf {S}_{\ell _{j},t-1}=\left [\mathbf {s}_{\ell _{j},1},...,\mathbf {s}_{\ell _{j},t-1}\right ]\). In both cases, the a priori probability Pr(**X**_{t}∣**S**_{t−1}) is updated iteratively as

where Pr(**X**_{t}∣**X**_{t−1}) serves as the motion model for the prediction of the *N*_{d} target movements (i.e., the random walk model of reference [41]). For positioning, the maximum *a posterior* (MAP) estimation can be thus adopted

Applying the above Bayesian techniques to the CSI features extracted from a MIMO-OFDM radio interface may result in a significant increase of algorithm complexity, i.e., especially when applied to multiple targets [42]. Indeed, not all sub-carriers and MIMO links capture the target presence in the same way as some frequencies and links might be affected by background noise or co-located/co-channel interference components. Therefore, an accurate space-frequency analysis is an essential pre-processing task designed to select the link/frequency set that is more sensitive to the presence of the target.

In what follows, we show that selecting an optimal set of links/frequencies also reduces the complexity and increases the performance. In the next section, we propose a more deep analysis of space-frequency selectivity, as well as an ad hoc approach that allows to jointly analyze the space-frequency channel profiles during the training phase and select informative frequency and links for the real-time localization.

### Subspace decomposition-based DFL approach

We propose here the use of a subspace decomposition method for DFL applications, referred to as SD-DFL, with the aim of selecting the optimal combination of links and the sub-carriers that can better capture the body-induced signal changes. The method is tailored for the MIMO-OFDM interface and can be also effectively used to extract the links/sub-carriers that discriminate environmental changes not related to the target presence (e.g., caused by people moving outside the main area) or RF co-channel interfering devices.

Subspace decomposition methods have been widely used in spectral estimation, sensor array processing, and radio localization [43] to improve estimation performance in noise-limited environments. It is closely related to principal component analysis (PCA) [44] to map a high-dimensional feature space to a lower-dimensional space along the dimensions with highest variance.

The subspace decomposition (SD) method is designed to capture body-induced signal changes inside the detection area and in turn isolate these alterations from those induced by other environmental effects taking place outside the detection area. During calibration, we use both CSI measurements corresponding to an empty detection area and occupied (by a single target) on a subset of landmarks. These are used to compute the subspaces (over the space and frequency domains). We thus use single target measurements mainly to simplify the calibration stage. Using such training, PCA method is then evaluated for a double target scenario.

In passive localization systems, the radio signal fluctuations may be induced by the targets as moving in the monitored area \(\mathcal {X}\), or by other environmental changes [4]. Therefore, the goal of the proposed subspace decomposition is to separate the signal perturbations due to the subject(s) from the ones induced by background noise or other effects (e.g., body movements outside the detection area or interfering devices). Background noise here refers to the alterations of the CSI data that are induced by (possibly time-varying) environmental changes in the surrounding of the detection area that are not attributable to body movements (i.e., open/closed door, people moving outside the detection area). We thus define the *body-induced signal subspace* and the *background noise subspace*, respectively. Projection matrices for both spaces are obtained during the calibration phase, using space- and frequency-domain training CSI measurements, \(\overline {\mathbf {s}}_{f_{i},t}(\mathbf {x_{\mathrm {A}}})\) and \(\mathbf {\overline {s}}_{\ell _{j},t}(\mathbf {x_{\mathrm {A}}})\), that correspond to a single target located in selected landmarks *x*_{A}. The projection matrices for both the subspaces are therefore extracted from the *single target* measurements obtained during the training phase. The proposed subspace decomposition approach is detailed in the following sections by looking separately to the space- and frequency-domain CSI profiles. In particular, we show that the body-induced and background subspaces can be used during online multi-target (i.e., *N*_{d}=2) localization to separate the alterations of the CSI as induced by body movements inside the detection area \(\mathcal {X}\) from those due to the environment (or other subjects moving outside \(\mathcal {X}\)), respectively.

#### Space domain

We first obtain the covariance matrix \(\mathbf {C}_{f_{i}}\) representative of an *occupied* environment by *marginalizing* out the space-domain covariances \(\mathbf {C}_{f_{i}}\left (\mathbf {x_{\mathrm {A}}}\right)\) in (14) over the selected landmarks \(\mathbf {x_{\mathrm {A}}}\in \mathcal {X}\) inside the detection area. It is

The obtained marginal covariance (24) is used here to extract the body-induced subspace. Notice that the terms \(\mathbf {C}_{f_{i}}(\mathbf {x_{\mathrm {A}}})\) can been obtained during the calibration phase from the training measurements \(\overline {\mathbf {s}}_{f_{i},t}(\mathbf {x_{\mathrm {A}}})\) corresponding to a single target occupying the selected landmarks *x*_{A}. Then, we apply the singular value decomposition (SVD) method on the space-domain covariance \(\mathbf {C}{}_{f_{i}}\) for a given sub-carrier *f*_{i}

where \(\Lambda _{\mathrm {\mathit {f_{i}}}}=\text {diag}\left \{\lambda _{\ell _{1},f_{i}},...,\lambda _{\ell _{L},f_{i}}\right \}\) is the ordered diagonal matrix composed by the eigenvalues \({\lambda _{\ell _{1},f_{i}}\geq \lambda _{\ell _{2},f_{i}}\geq...\geq \lambda _{\ell _{L},f_{i}}}\), that implies the order of the new link sequence *ℓ*_{1},*ℓ*_{2},...,*ℓ*_{L}, while \(\mathbf {U}_{f_{i}}=\left [\mathbf {u}_{\ell _{1},f_{i}},...,\mathbf {u}_{\ell _{L},f_{i}}\right ]\) contains the corresponding eigenvectors. Selection of the first \(P_{f_{i}}\) principal components of matrix \(\mathbf {C}_{f_{i}}\) is then applied to capture the most significant signal changes due to the target position. Here, we choose \(P_{f_{i}}=\text {max}\left \{j:\text {}\lambda _{\ell _{j,}f_{i},}>h_{f}\right \}\) where the threshold *h*_{f} is computed over the training measurements as defined in Section 6. Based on such components, we finally construct the body-induced subspace as: \(\mathbf {\widehat {\mathbf {U}}}_{f_{i},P_{f_{i}}}=\left [\mathbf {u}_{f_{i},1},\mathbf {u}_{f_{i},2},...,\mathbf {u}_{f_{i},P_{f_{i}}}\right ]\).

Using the subspace matrix \(\mathbf {\widehat {\mathbf {U}}}_{f_{i},P_{f_{i}}}\), the input CSI measurements \(\mathbf {s}_{f_{i},t}=\mathbf {s}_{f_{i},t}(\mathbf {X}_{t})\) for the unknown target positions **X**_{t} can be decomposed as

where \(\hat {\mathbf {s}}_{f_{i},t}\) is the body-induced component, namely the projection of the profiles onto the body-induced subspace

while \(\tilde {\mathbf {s}}_{f_{i},t}\) is the background noise component, namely the projection of the CSI space-domain profiles onto the background noise subspace

In particular, \(\Pi _{f_{i},D}=\left (\mathbf {\widehat {U}}_{f_{i},P_{f_{i}}}\mathbf {\widehat {U}}_{f_{i},P_{f_{i}}}^{T}\right)\) is the projection matrix for the body-induced subspace while \(\Pi _{f_{i},S}=\left (\mathbf {I}-\mathbf {\widehat {U}}_{f_{i},P_{f_{i}}}\mathbf {\widehat {U}}_{f_{i},P_{f_{i}}}^{T}\right)\) is the projection matrix for the background noise subspace. To select the subspace size, in Section 6, we will show that choosing the same number of components for each MIMO link can still provide near-optimal performance while strongly reducing complexity. We thus select a unique subspace dimension for all sub-carrier groups, that is \(\overline {P}_{f}=\text {max}\{P_{f_{i}},\text {}f_{i}\in \mathcal {F}\}\). The example of Fig. 6a shows that the first \(\overline {P}_{f}=7\) eigenvalues (out of 9 available MIMO links) with the threshold values set ∀*f*_{i} to *h*_{f}=15 capture most of the body-induced changes in the monitored area.

During online localization, CSI profile \(\mathbf {s}_{f_{i},t}\) values are replaced with its corresponding filtered version \(\hat {\mathbf {s}}_{f_{i},t}\) in (27) to obtain the position estimate. By replacing \(\mathbf {s}_{f_{i},t}\) with projection \(\hat {\mathbf {s}}_{f_{i},t}\), ML estimation (18) now reduces to

Likewise, as shown in (23), the MAP approach can be also defined as

now with \(\hat {\mathbf {S}}_{t}=\left [\hat {\mathbf {s}}_{1},...,\hat {\mathbf {s}}_{t}\right ]^{T}\).

#### Frequency domain

Following the same approach used for space-domain case, we first obtain a covariance matrix \(\mathbf {C}_{\ell _{j}}\) by marginalizing out the frequency-domain covariances \(\mathbf {C}_{\ell _{j}}(\mathbf {x_{\mathrm {A}}})\) in (12) obtained from training data \(\mathbf {\overline {s}}_{\ell _{j},t}(\mathbf {x_{\mathrm {A}}})\) over the same landmarks \(\mathbf {x_{\mathrm {A}}}\in \mathcal {X}\),

The SVD on the marginal covariance \(\mathbf {C_{\ell _{\mathit {j}}}}\) is then obtained as \(\mathbf {C_{\ell _{\mathit {j}}}}=\mathbf {U_{\ell _{\mathit {j}}}}\Lambda _{\ell _{j}}\mathbf {U_{\ell _{\mathit {j}}}}^{T}\) with \(\Lambda _{\ell _{j}}=\text {diag}\left \{\lambda _{\ell _{j},f_{1}},...,\lambda _{\ell _{j},f_{m}}\right \}\) being the ordered diagonal matrix composed by the eigenvalues \({\lambda _{\ell _{j},f_{1}}\geq \lambda _{\ell _{j},f_{2}}\geq...\geq \lambda _{\ell _{j},f_{m}}}\) of the matrix \(\mathbf {C_{\ell _{\mathit {j}}}}\). The matrix \(\mathbf {U_{\ell _{\mathit {j}}}}=\left [\mathbf {u}_{\ell _{j},f_{1}},...,\mathbf {u}_{\ell _{j},f_{m}}\right ]\) collects the eigenvectors \({\mathbf {u}_{\ell _{j},f_{i}}}\) over the whole sub-carrier set \(\mathcal {F}\) being *f*_{1},*f*_{2},...,*f*_{m} the new sub-carrier sequence. It is worth noticing that, by re-arranging the eigenvalues in descending order, the corresponding first principal component \({\mathbf {u}_{\ell _{j},f_{1}}}\) points to the sub-carrier that is most sensitive to the body presence inside the detection area. Moreover, the following principal components \({\mathbf {u}_{\ell _{j},f_{2}},\mathbf {u}_{\ell _{j},f_{3}},...}\) may reveal other sub-carriers of interest for tracking.

Selection of the first \(P_{\ell _{j}}\) principal components of the matrix \(\mathbf {C}{}_{\ell _{j}}\) is applied to capture the most significant signal changes due to the target position: \(P_{\ell _{j}}=\text {max}\{i:\lambda _{\ell _{j},f_{i}}>h_{\ell }\}\). Following the same procedure used for the subspace decomposition approach, we again construct the target-induced subspace as \(\mathbf {\widehat {\mathbf {U}}}_{\ell _{j},P_{\ell _{j}}}=\left [\mathbf {u}_{\ell _{j},1},\mathbf {u}_{\ell _{j},2},...,\mathbf {u}_{\ell _{j},P_{\ell _{j}}}\right ]\), now for frequency-domain features, and such that the input CSI profiles can be decomposed as \(\mathbf {s}_{\ell _{j},t}=\hat {\mathbf {s}}_{\ell _{j},t}+\tilde {\mathbf {s}}_{\ell _{j},t}\). Applying the same definitions employed for the space-domain profiles, \(\hat {\mathbf {s}}_{\ell _{j},t}=\Pi _{\ell _{j},D}\;\mathbf {s}_{\ell _{j},t}\) is the target-induced (dominant) signal component while \(\tilde {\mathbf {s}}_{\ell _{j},t}=\Pi _{\ell _{j},S}\;\mathbf {s}_{\ell _{j},t}\) is the background noise (stochastic) signal component while \(\Pi _{\ell _{j},D}=\mathbf {\widehat {\mathbf {U}}}_{\ell _{j},P_{\ell _{j}}}\mathbf {\widehat {\mathbf {U}}}_{\ell _{j},P_{\ell _{j}}}^{T}\)and \(\Pi _{\ell _{j},S}=\mathbf {I-}\mathbf {\widehat {\mathbf {U}}}_{\ell _{j},P_{\ell _{j}}}\mathbf {\widehat {\mathbf {U}}}_{\ell _{j},P_{\ell _{j}}}^{T}\) are the corresponding frequency-domain projection matrices for both components, respectively. To simplify the computation, we again use the same number of components, now for each MIMO link, therefore \(\overline {P}_{\ell }=\text {max}\{P_{\ell _{j}},\text {}\ell _{j}\in \mathcal {L}\}\). Online localization is finally obtained using the projected CSI profile components \(\hat {\mathbf {s}}_{\ell _{j},t}\) as

Figure 6b shows that the first \(\overline {P}_{\ell }=12\) eigenvalues (out of 30 OFDM sub-carriers) with eigenvalue thresholds set ∀*ℓ*_{j} to *h*_{ℓ}=5 capture most of the body-induced changes in the monitored area. Therefore, for the real time localization, we only use the 12 sub-carriers selected at calibration phase to estimate the target position.

Figure 6c shows the principal components corresponding to two different targets *d*=1 and *d*=2 (as shown in Table 1) for a given link (i.e., *ℓ*_{1}). In both cases, it is reasonable to choose the first 12 components that capture most of the changes corresponding to the target presence.

### Occupancy detection

A problem tightly related to localization is occupancy detection. In this case, we do not want to estimate the position of the targets but only their presence by detecting if the environment is empty or occupied. To solve this problem, we propose to exploit the spatial correlation mean \(\overline r_{\mathrm {\mathit {f_{i}}}}\), for each sub-carrier, that it is computed over all link pairs of the link-by-link correlation \(\mathbf {r_{\mathrm {\mathit {f_{i}}}}}\phantom {\dot {i}\!}\). Discrimination between empty and occupied environment is simply done by applying thresholding on the observed correlation mean for all sub-carriers. Using spatial correlations, the empty environment, namely \(\hat {N}_{d}=0\), is thus detected when

where *τ*_{ℓ,0} is a threshold and is the indicator function defined as if *x*>*y* and otherwise. The threshold value is here optimized by using the measurements acquired at the training stage.

Likewise, the frequency correlation mean \(\overline r_{\mathrm {\mathit {\ell _{j}}}}\), obtained from \(\mathbf {r_{\mathrm {\mathit {\ell _{j}}}}}\phantom {\dot {i}\!}\), is also considered for detection; in this case, the empty environment is detected when

where *τ*_{f,0} is a threshold and is the indicator function. The channel correlation mean is computed over all sub-carrier pairs obtained from the set while the optimal threshold *τ*_{f,0} is computed, as shown before, by using the measurements acquired at the training stage.

## Experimental validation: detection and localization

In order to evaluate the performance of the proposed approach, we ran several experimental measurements according to the setup illustrated in Section 3. In the proposed scenario, two targets (*N*_{d}=2) are considered while we define a number of test trajectories for both subjects designed to uniformly cover the detection area (see also Fig. 4c). While target *d*=2 (male, 1.80 m height and 92 kg) is standing in a given position (e.g., position 14), target *d*=1 (female, 1.6 m height and 57 kg) moves through trajectory #1 from position 13 down to 8. Then, target *d*=2 moves to the next position (i.e., 13) following the same trajectory #1, and target *d*=1 moves again on the same trajectory from position 12 to 8, and so on to complete all positions along trajectory #1. Finally, both targets repeat the same procedure following the three trajectories defined in Fig. 4c.

Table 2 shows the setting parameters used for the occupancy detection and localization purposes. During calibration, we have considered 28 landmarks corresponding to the occupied body positions and then collected training measurements for each position. In more detail, we have collected data sequences of 600 samples for each MIMO link (out of 9) and sub-carrier (out of 30). Two WiFi RX devices, equipped with three antennas each, have been used to collect CSI measurements by exploiting WiFi injected packets (Section 3) originated from a WiFi access point, equipped with three antennas, too. The proposed algorithms have been verified and tested by considering two targets (namely, target *d*=1 and *d*=2) moving along the trajectories described above. Targets have different body structure and size according to the following Table 1. Real-time localization is based on the proposed SD-DFL technique and uses CSI data projected onto the body-induced subspaces (space and frequency-domain subspaces). Finally, to highlight the effectiveness of the proposed subspace decomposition method, the accuracy of SD-DFL has been compared with conventional Bayesian localization methods [2, 5, 34].

### Occupancy detection

The setup illustrated in Section 3 and Fig. 4a is used here to validate the proposed body detection scheme where *N*_{d}=1,2 targets move in the monitored area \(\mathcal {X}\). Focusing on occupancy detection, Fig. 7a draws the spatial correlation mean \(\overline r_{\mathrm {\mathit {f_{i}}}}\), for each sub-carrier, that it is computed over all link pairs of the link-by-link correlation \(\mathbf {r_{\mathrm {\mathit {f_{i}}}}}\phantom {\dot {i}\!}\). The empty environment is detected according to Eq. 33. In the plot, the results for the empty and the occupied environment (by a single and double target) are shown while the threshold value is here set to *τ*_{ℓ,0}=0.25. Likewise, the frequency correlation mean \(\overline r_{\mathrm {\mathit {\ell _{j}}}}\phantom {\dot {i}\!}\), obtained from \(\mathbf {r_{\mathrm {\mathit {\ell _{j}}}}}\phantom {\dot {i}\!}\), is also considered for performance evaluation; in this case, as shown in Fig. 7b, the empty environment is detected according to Eq. 34 where the optimal threshold value considered here is *τ*_{f,0}=0.28.

Figures 7a, b confirm also the considerations of Section 5.2 regarding the use of single target measurements for subspace computation; occupancy detection and data reduction/filtering are therefore obtained just comparing the properties of the empty environment with respect to the ones of the occupied environment when only one target is present.

Figure 8 shows the receiver operating characteristic (ROC) curve for the proposed *multi-frequency* detector that considers a varying threshold for links (*τ*_{ℓ,0}) in the space domain. Figure 8 shows also the results of the ROC curve for the *multi-link* detector considering a varying threshold *τ*_{f,0} for all sub-carriers in the frequency domain. The trivial (i.e., random) detector is also included for comparison. Only the measurements related to the double target scenario have been employed to carry out the performance evaluation of the real-time occupancy detector. Moreover, measurements have been collected by using the RX2 node only (i.e., using only the path TX-RX2), while the targets were freely moving in the monitored area.

It is apparent from the ROC plots that the multi-frequency detector (in the space domain) provides better sensitivity than the multi-link one (in the frequency domain) for a given false-positive rate. The previous results have been obtained with a single path. However, an increased number of paths would provide better spatial accuracy for target detection, but this analysis is outside the scope of this paper.

Unlike Fig. 8, that refers to the measurements collected in the double target scenario by a single receiver (i.e., RX2) only, the detector performances summarized in Tables 3 and 4 have been obtained using two paths (i.e., the paths TX-RX1 and TX-RX2) and both single and double target measurements for the occupied environment. Table 3 summarizes the results using a single threshold for links and a single threshold for sub-carriers, while in Table 4, the thresholds have been optimized for each link and sub-carrier, separately. Adopting the single threshold approach (i.e., using *τ*_{ℓ,0} and *τ*_{f,0}), Table 3 shows that performances are quite similar even if there is a small advantage in using space-domain features instead of frequency-domain ones. On the contrary, Table 4 shows that, exploiting optimized thresholds for each sub-carrier \(\tau _{\ell,0}^{f_{i}}\) and for each link \(\tau _{f,0}^{\ell _{j}}\), the space-domain features should be used since they show better results. Clearly, better performances can be also obtained by SISO (single-input single-output) nodes but at the expense of a larger number of RF RX/TX devices (and corresponding paths). For instance, in [4], 12 SISO single carrier (SC) IEEE 802.15.4-compliant nodes have been employed. Usage of MIMO-OFDM devices thus paves the way to an increased accuracy with respect to SISO-SC ones by exploiting both space and frequency domain measurements.

### Localization

The setup illustrated in Section 6.1 for the occupancy detection tests is also used here to validate the proposed localization approaches. *N*_{d}=2 targets are moving in the monitored area \(\mathcal {X}\), while the bodies are first located using the methods proposed in Sections 5.1 and 5.2. In the first test, whose layout is depicted in Fig. 9a, the target *d*=2 is fixed in a given position while the target *d*=1 moves along the highlighted trajectory #1 that follows the LOS path between the WiFi transmitter and the receiver. The localization accuracy for the target *d*=1, in terms of root mean square error (RMSE), is drawn in Fig. 9b, c, using space- and frequency-domain CSI profiles, respectively. The results obtained with the proposed SD-DFL technique are also compared against the plain Bayesian DFL tracking approach [2, 34]. To obtain the subspaces used by the SD-DFL method, we used the database of CSI measurements collected during the training phase and featuring a single test target moving in the area to cover a pre-defined set of landmarks. Such measurements are used to find the proper subspace dimension \(\overline {P}_{\ell }\) and \(\overline {P}_{f}\) over both space and frequency domains as shown in Fig. 6. Selected subspace dimensions are then validated for the considered scenario, now featuring two real targets. For online tracking of both targets, we evaluate the alterations of the space- and frequency-domain CSI profiles every second.

Considering the frequency-domain feature method, the projection matrix for all active MIMO links \(\mathbf {\widehat {\mathbf {U}}}_{\ell _{j},\overline {P}_{\ell }}=\left [\mathbf {u}_{\ell _{j},1},\mathbf {u}_{\ell _{j},2},...,\mathbf {u}_{\ell _{j},\overline {P}_{\ell }}\right ]\) is extracted using 12 sub-carrier groups corresponding to the largest eigenvalues such that \(\lambda _{\ell _{5,}f_{i}}\geq h_{\ell }\), with *h*_{ℓ}=5; the related results are shown in Fig. 6a. For real-time location estimation, the projection matrix thus reduces the size of the data to be processed, discarding also non-informative sub-carrier measurements. The RMSE of the location estimation is compared with the DFL approach in [34] versus MIMO links in Fig. 9c. As shown in the aforementioned figure, the localization accuracy improves by more than 30 cm for almost all MIMO links using SD-DFL with respect to DFL.

Considering now the space-domain features, similarly to what done for the frequency domain case, the optimal number of components is found as \(\overline {P}_{f}\,=\,\text {max}\{P_{f_{i}},f_{i}\in \mathcal {\mathcal {F}}\}\,=\,7\) and the corresponding results are shown in Fig. 6b. Sub-carrier group *f*_{15} provides the maximum number of (space-domain) informative components; therefore, the projection matrix for sub-carriers \(\mathbf {\widehat {\mathbf {U}}}_{f_{i},\overline {k}_{f}}=\left [\mathbf {u}_{f_{i},1},\mathbf {u}_{f_{i},2},...,\mathbf {u}_{f_{i},\overline {k}_{f}}\right ]\) is extracted by picking the seven largest eigenvalues such that \(\lambda _{\ell _{j,}f_{15}}\geq h_{f}\), with *h*_{f}=15. The localization RMSE is depicted in Fig. 9b, while improvements with respect to Bayesian DFL technique are clearly visible; for example, considering the sub-carrier index *i*=15, the accuracy improves of more than 24 cm.

Figure 10 focuses on a more general scenario where both targets are now freely moving inside the detection area. Similarly to what is shown before, we compare the performance of DFL and SD-DFL methods when applied to space- and frequency-domain CSI profiles, respectively. Figure 10a highlights the scenario where targets *d*=1, and 2 are moving on trajectory #2. Figure 10b represents the RMSE of the location estimation applying DFL and SD-DFL approaches using space profile, and the results are drawn versus sub-carriers for both targets. The localization accuracy for the target #1 is lower with respect to the target #2; in fact, target #2 (height 1.8 m and weight 92 kg) is taller than target #1 (height 1.6 m and weight 57 kg) causing extra attenuation and perturbation from its larger body reflections and thus affecting the received signal fluctuations corresponding to the target #1 in a given position. Figure 10c represents the RMSE using frequency profile, and the result is drawn versus the MIMO links. For example, for the given link *ℓ*_{3}, location estimation of target #1 improves of about 25 cm using the SD-DFL method. In both single and double target cases, it is apparent that the use of space-domain CSI profiles (over MIMO links) improves the localization accuracy better than the frequency-domain ones.

In Fig. 11, we now compare the performance of the proposed SD-DFL approach with DFL methods that use either a single carrier (i.e., *f*_{15}) [28, 42], that is equivalent to the received signal strength (RSS) method [2, 34], as well as multiple sub-carriers [5, 30]. Performance are analyzed for different MIMO links, according to the same double target scenario previously described, where targets obstruct the path between TX-RX2. The obtained RMSE (m) of location estimation confirms that, compared with the conventional Bayesian DFL method [2, 28, 34], the use of the SD-DFL approach provides an effective means to select the sub-carriers that are more sensitive to human body presence. In fact, although frequency-domain processing provides benefits, the additional use of the SD analysis in both space and frequency domains not only reduces the number of MIMO links and sub-carriers to be considered for localization but also improves the accuracy as providing a de-noising effect. We also notice that, when multiple targets are considered (see reference [42]), discrimination of two targets, that are very close to each other, is not possible as their combined influence is similar to the one induced by a single target. On the contrary, when the subjects are separated in space, their mutual influence is low, and SD-DFL can better isolate the alterations of CSI as caused by the two distinct bodies.

To conclude as previously mentioned, we want to stress the fact that the usage of MIMO-OFDM devices for DFL applications paves the way to an increased localization accuracy with respect to SISO SC ones. Networks of MIMO-OFDM nodes are expected to estimate the target position with an increased accuracy, especially in harsh and complex scenarios with heavy multipath effects by exploiting both frequency- and, especially, space-domain measurements.

## Conclusions

This paper proposed signal processing methods and tools to enable passive body occupancy detection and localization based on the analysis of the channel state information (CSI) collected from MIMO-OFDM radio interfaces (i.e., WiFi devices). In the proposed study, PHY layer CSI data is processed over both space (using MIMO links) and frequency (using consecutive OFDM pilot sub-carriers) domains to isolate relevant perturbations induced by target movements. In particular, alterations of the space- and frequency-domain fading correlation are tracked to estimate the target presence and position(s). A case study with a WiFi IEEE 802.11n network is presented to evaluate the performance of the proposed approaches in an indoor scenario. Selection of the most informative OFDM sub-carriers and MIMO links based on an ad hoc subspace decomposition policy (SD-DFL) is proposed to improve the localization accuracy. With respect to the previous approaches, we showed that the exploitation of either space- or frequency-domain diversity can provide significant accuracy improvements. Such benefits are particularly interesting when practical limitations are imposed on the number of installed WiFi physical devices. Future work will address how accuracy scales when using large MIMO-OFDM distributed configurations.

## References

- 1
M Youssef, et al, in

*Proc of the ACM international conference on mobile computing and networking*. Challenges: device free passive localization for wireless environments (Montreal, 2007), pp. 222–229. - 2
S Moustafa, A Saeed, AE Kosba, A El-Keyi, M Youssef, Nuzzer: a large-scale device-free passive localization system for wireless environments. IEEE Trans.Mob. Comput.

**12**(7), 1321–34 (2013). - 3
J Wilson, et al, Radio tomographic imaging with wireless networks. IEEE Trans.Mob. Comp.

**9**(5), 621–632 (2010). - 4
S Kianoush, S Savazzi, F Vicentini, V Rampa, M Giussani, Device-free RF human body fall detection and localization in industrial workplaces. IEEE Internet Things J.

**4**(2), 351–62 (2017). - 5
S Savazzi, S Sigg, M Nicoli, V Rampa, S Kianoush, U Spagnolini, Device-free radio vision for assisted living: leveraging wireless channel quality information for human sensing. IEEE Signal Process.Mag.

**33**(2), 45–58 (2016). - 6
Z Zhou, Z Yang, C Wu, L Shangguan, Y Liu, Omnidirectional coverage for device-free passive human detection. IEEE Trans.Parallel Distrib. Syst.

**25**(7), 1819–29 (2014). - 7
S Depatla, A Muralidharan, Y Mostofi, Occupancy estimation using only WiFi power measurements. IEEE J.Sel. Areas Commun.

**33**(7), 1381–1393 (2015). - 8
S Bartoletti, A Conti, MZ Win, Device-free counting via wideband signals. IEEE J.Sel. Areas Commun.

**35**(5), 1163–74 (2017). - 9
Y Wang, K Wu, LM Ni, Wifall: device-free fall detection by wireless networks. IEEE Trans.Mob. Comput.

**6**(2), 581–94 (2017). - 10
J Xiong, K Jamieson, in

*Proc. of the 10th USENIX Symposium on Networked Systems Design and Implementation, ACM SIGCOM*. ArrayTrack: a fine-grained indoor location system (Lombard, 2013), pp. 71–84. - 11
M Zhou, F Qiu, Z Tian, H Wu, Q Zhang, W He, An information-based approach to precision analysis of indoor WLAN localization using location fingerprint. Entropy.

**17**(2), 8031–8055 (2015). - 12
S Kianoush, V Rampa, S Savazzi, M Nicoli, in

*Proc. of the IEEE Intl. Conf. on CommunicationsWorkshops (ICC’2016)*. Pre-deployment performance assessment of device-free radio localization systems (Kuala Lumpur, 2016), pp. 1–6. - 13
Y Gu, L Quan, F Ren, in

*Proc of the IEEE Asia Pacific Conference on Wireless and Mobile*. Wifi-assisted human activity recognition (Bali, 2014), pp. 60–65. - 14
S Sigg, S Shi, F Busching, Y Ji, L Wolf, in

*Proc of the 11th International Conference on Advances in Mobile Computing & Multimedia (MoMM)*. Leveraging RF-channel fluctuation for activity recognition: active and passive systems, continuous, and RSSI-based signal features (ACMVienna, 2013), pp. 43–52. - 15
Scholz M, et al, in

*Proc. of the 2nd Workshop on Physical Analytics WPA15*. Device-free radio-based low overhead identification of subject classes (Florence, 2015), pp. 1–6. - 16
C Xu, B Firner, RS Moore, Y Zhang, W Trappe, R Howard, F Zhang, N An, in

*Proc of the International Conference on Information Processing in Sensor Networks (IPSN)*. Scpl: indoor device-free multi-subject counting and localization using radio signal strength (Philadelphia, 2013), pp. 79–90. - 17
J Borras, P Hatrack, NB Mandayam, in

*Proc. of IEEE Vehicular Technology Conference, vol. 2*. Decision theoretic framework for NLOS identification (Ottawa, 1998), pp. 1583–1587. - 18
P Falcone, F Colone, P Lombardo, Potentialities and challenges of WiFi-based passive radar. IEEE Aerosp.Electron. Syst. Mag.

**27**(11), 15–26 (2012). - 19
S Bartoletti, A Giorgetti, MZ Win, A Conti, Blind selection of representative observations for sensor radar networks. IEEE Trans.Veh. Technol.

**64**(4), 1388–1400 (2015). - 20
W Wang, AX Liu, Shahzad M, K Ling, S Lu, Device-free human acivity recognition using commercial WiFi devices. IEEE J.Sel. Areas Commun.

**35**(5) (2017). - 21
K Wu, J Xiao, Y Yi, D Chen, X Luo, LM Ni, CSI-based indoor localization. IEEE Trans.Parallel Distrib. Syst.

**24**(7), 1300–1309 (2013). - 22
I Sabek, M Youssef, MonoStream: a minimal-hardware high accuracy device-free WLAN localization system, arXiv preprint arXiv:1308.0768, 1–11 (2013).

- 23
X Wang, L Gao, S Mao, S Pandey, CSI-based fingerprinting for indoor localization: a deep learning approach. IEEE Trans.Veh. Technol.

**66**(1), 763–776 (2017). - 24
Z Yang, Z Zhou, Y Liu, From RSSI to CSI: indoor localization via channel response. ACM Comput. Surv (CSUR).

**46**(2), 25 (2013). - 25
J Xiao, K Wu, Y Yi, L Wang, LM Ni, in

*Proc. of the 33rd IEEE Intl. Conf. on Distributed Computing Systems (ICDCS)*. Pilot: passive device-free indoor localization using channel state information (Philadelphia, 2013), pp. 236–245. - 26
J Wang, X Zhang, Q Gao, H Yue, H Wang, Device-free wireless localization and activity recognition: a deep learning approach. IEEE Trans.Veh. Technol.

**66**(7), 6258–6267 (2017). - 27
K Qian, C Wu, Z Yang, Y Liu, Z Zhou, in

*Proc of the 20th IEEE International Conference on Parallel and Distributed Systems (ICPADS)*. PADS: passive detection of moving targets with dynamic speed using PHY layer information (Hsinchu, 2014), pp. 1–8. - 28
S Kianoush, S Savazzi, Vicentini F, V Rampa, M Giussani, in

*Proc of the 13th IEEE Intl. Conf. on Industrial Informatics (INDIN’15)*. Leveraging RF signals for human sensing: fall detection and localization in human-machine shared workspaces (Cambridge, 2015), pp. 1456–1462. - 29
Z Wu, Q Xu, J Li, C Fu, Q Xuan, Y Xiang, Passive indoor localization based on CSI and Naive Bayes Classification. IEEE Trans.Syst. Man Cybern. Syst.

**pp**(99), 1–12 (2017). - 30
S Kianoush, S Savazzi, V Rampa, in

*Proc of the IEEE Intl. Conf. on Communications (ICC’17), WT03, 5th IEEE ICC Workshop on Advances in Network Localization and Navigation (ANLN)*. Tracking of frequency selectivity for device-free detection of multiple targets (Paris, 2017), pp. 1253–1259. - 31
M Cicerone, O Simeone, U Spagnolini, Channel estimation for MIMO-OFDM systems by modal analysis/filtering. IEEE Trans. Commun.

**54**(11), 2062–2074 (2006). - 32
ARS Bahai, BR Saltzberg,

*Multi-carrier digital communications: theory and applications of OFDM*(Springer Science & Business Media, 2004). - 33
AJ Coulson, et al, A statistical basis for lognormal shadowing effects in multipath fading channels. IEEE Trans. Commun.

**46**(4), 494–502 (1998). - 34
S Savazzi, et al, A Bayesian approach to device-free localization: modeling and experimental assessment. IEEE J.Sel. Topics Signal Proc.

**8**(1), 16–29 (2014). - 35
HA Omar, K Abboud, N Cheng, KR Malekshan, AT Gamage, W Zhuang, A survey on high efficiency wireless local area networks: next generation WiFi. IEEE Commun.Surv. Tutor.

**18**(4), 2315–2344 (2016). - 36
Linux 802.11n CSI tool. https://dhalperi.github.io/linux-80211n-csitool/. Accessed 28 June 2018.

- 37
D Halperin, W Hu, A Sheth, D Wetherall, in

*Proc.of ACMSIGCOMM2010 Conference*. Predictable 802.11 packet delivery from wireless channel measurements (New Delhi, 2010), pp. 159–170. - 38
IEEE Std 802.11n-2009,

*Part 11: wireless LAN medium access control (MAC) and physical layer (PHY) specifications*(IEEE, New York, 1999). https://pdos.csail.mit.edu/archive/decouto/papers/802.11a.pdf. - 39
R Crepaldi, J Lee, R Etkin, S-J Lee, R Kravets, in

*Proc. of IEEE INFOCOM*. CSI-SF: estimating wireless channel state using CSI sampling & fusion (Orlando, 2012), pp. 154–162. https://doi.org/10.1109/INFCOM.2012.6195523. - 40
W Xu, SA Zekavat, A high-performance measure for non-line-of-sight identification in mimo-ofdm-based sensor networks. IEEE Syst.J.

**8**(1), 125–30 (2014). - 41
KH Chiang, N Shenoy, A random-walk mobility model for location-management studies in wireless networks. IEEE Trans. Veh. Technol.

**53**(2), 413–24 (2004). - 42
M Nicoli, V Rampa, S Savazzi, S Schiaroli, in

*Proc. of European Signal Processing Conference (EUSIPCO)*. Device-free localization of multiple targets (Budapest, 2016), pp. 738–742. - 43
Y Zhao, N Patwari, Robust estimators for variance-based device-free localization and tracking. IEEE Trans.Mob. Comput.

**14**(10), 2116–2129 (2015). - 44
S Shi, S Sigg, Y Ji, in

*Proc.of the 83rd IEEE International Conference on Vehicular Technology*. Probabilistic fingerprinting based passive device-free localization from channel state information (Nanjing, 2016), pp. 1–5.

### Funding

The work has been partially supported by the CYBER-SORT project framework program funded by Regione Lombardia and Consiglio Nazionale delle Ricerche (CNR).

## Author information

### Affiliations

### Contributions

All authors contributed equally. All authors read and approved the final manuscript.

### Corresponding author

Correspondence to Sanaz Kianoush.

## Ethics declarations

### Competing interests

The authors declare that they have no competing interests.

### Publisher’s Note

Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

## Rights and permissions

**Open Access** This article is distributed under the terms of the Creative Commons Attribution 4.0 International License(http://creativecommons.org/licenses/by/4.0/), which permits unrestricted use, distribution, and reproduction in any medium, provided you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license, and indicate if changes were made.

## About this article

### Cite this article

Kianoush, S., Savazzi, S. & Rampa, V. Leveraging MIMO-OFDM radio signals for device-free occupancy inference: system design and experiments.
*EURASIP J. Adv. Signal Process. * **2018, **44 (2018) doi:10.1186/s13634-018-0571-7

#### Received

#### Accepted

#### Published

#### DOI

### Keywords

- Device free occupancy inference
- Occupancy detection
- Radio localization
- MIMO networks