LMF in 5G Networks

• Location Management Function (LMF) is a core network entity in 5G that collects uplink positioning measurements and processes them through ToA/TDoA filtering and PSO-based estimation.
• It implements a robust end-to-end pipeline that starts with UL SRS acquisition and CIR processing, followed by tailored filtering and nonlinear optimization for UE localization.
• LMF addresses deployment challenges such as synchronization impairments and multipath effects by using per-RU referencing and integrating AI/ML methods for beyond-5G positioning enhancements.

Searching arXiv for the specified paper and closely related work on OAI 5G positioning and LMF. The Location Management Function (LMF) is the Core Network (CN) function that orchestrates 5G New Radio (NR) Location Services (LCS), as specified in 3GPP TS 29.572. In the OpenAirInterface (OAI) 5G NR positioning testbeds reported in "Experimental Insights from OpenAirInterface 5G positioning Testbeds: Challenges and solutions" (Ahadi et al., 27 Aug 2025), the LMF is implemented as the standards-based entity that collects positioning measurements from the NG-RAN, processes Uplink Time Difference of Arrival (UL-TDoA) observables, and produces user equipment (UE) position estimates for client applications and CN consumers. The reported implementation places the LMF at the center of an end-to-end, 3GPP-compliant positioning pipeline that also incorporates tailored Time of Arrival (ToA) and TDoA filtering, Particle Swarm Optimization (PSO)-based estimation, and, in a beyond-5G framework, Channel Impulse Response (CIR)-driven artificial intelligence and machine learning (AI/ML) positioning (Ahadi et al., 27 Aug 2025).

1. Architectural role and system placement

In the reported OAI deployment, the LMF operates within the OAI CN deployment in Dockerized form and participates in a 5G SA architecture composed of OAI gNB, OAI CN, and a standards-based LMF. Its function is to orchestrate NR positioning procedures and expose positioning results to LCS consumers, including LCS clients via the service-based Nlmf_Location interface (Ahadi et al., 27 Aug 2025).

The measurement interface between the NG-RAN and the LMF is NRPPa, specified in 3GPP TS 38.455. In the OAI implementation, UL-SRS ToAs estimated in the RAN PHY are delivered to the LMF over NRPPa procedures. The radio access deployment follows O-RAN split 7.2 with CU/DU and commercial O-RUs, while synchronization and transport are handled by PTP with a GNSS-disciplined grandmaster, specifically a Qulsar Qg2. Although O-RAN E2 is referenced for future integration, the testbeds use MQTT as a pragmatic transport to offload CIR to an external AI/ML host for beyond-3GPP evaluation (Ahadi et al., 27 Aug 2025).

The operational interaction is explicitly defined. The UE transmits UL SRS; distributed RU antennas feed baseband to the DU/CU; the gNB PHY estimates CFR→CIR→ToA per antenna; the gNB reports ToAs and anchor coordinates to the LMF via NRPPa; the LMF filters ToA and TDoA, accounts for synchronization, runs PSO-based position estimation, and serves results to LCS consumers. This arrangement makes the LMF both a standards-compliant collection point and the principal estimation stage for network-based positioning. A plausible implication is that the LMF is not merely a signaling terminus but the primary locus of algorithmic adaptation to deployment-specific impairments.

2. End-to-end measurement pipeline inside the LMF

The reported pipeline starts from UL Sounding Reference Signal (SRS) acquisition configured for positioning, with OFDM bandwidth up to 100 MHz in OAI and sampling period $T_s = 1/122.88e6$ s. From the channel frequency response, the per-antenna CIR $h_{m,t}$ is obtained via IDFT, and ToA $\tau_{m,t}$ is defined as the delay of the dominant peak:

$\tau_{m,t} = T_s \cdot \arg\max_n |h_{m,t}[n]|.$

The gNB aggregates ToA vectors $\tau_t \in \mathbb{R}^M$ together with antenna coordinates $X \in \mathbb{R}^{M \times 3}$, and the LMF retrieves these over NRPPa while associating them with RU/gNB identifiers and timestamps (Ahadi et al., 27 Aug 2025).

Within the LMF, TDoA formation is performed per RU. For $K$ RUs, each with $M_k$ antennas, the LMF defines a per-RU reference antenna and forms $$\Delta \tau_{k,m} = \tau_{k,m} - \tau_{k,\mathrm{ref}}$$. This choice is motivated by the observation that cross-RU timing drift on the PTP chain degrades common-reference differencing, whereas differential timing remains more consistent within each RU. The paper reports that a common reference was evaluated but delivered worse accuracy under cross-RU offsets, and that per-RU referencing significantly improved CE90, including the GEO-5G result of approximately $2.02$ m versus $h_{m,t}$0 m (Ahadi et al., 27 Aug 2025).

The pipeline then applies three categories of processing. First, ToA filtering removes implausible peak delays based on the empirical distribution of CIR max-peak indices centered around $h_{m,t}$1, retaining a ToA if $h_{m,t}$2. Second, TDoA filtering enforces physical bounds derived from geometry, discarding invalid differentials via

$h_{m,t}$3

Third, a moving-average filter is applied to the PSO outputs to stabilize trajectories, with window size trading latency against smoothness (Ahadi et al., 27 Aug 2025).

The final estimation stage constructs a TDoA residual cost over all RU/antenna pairs and minimizes it with PSO, outputting 2D UE coordinates $h_{m,t}$4 while UE height is fixed in these deployments. In this architecture, the LMF therefore subsumes data association, measurement validation, synchronization-aware differencing, nonlinear optimization, and output conditioning.

3. Measurement model, synchronization, and estimation method

The UL-TDoA model used in the LMF is given by the generalized ToA relation

$h_{m,t}$5

where $h_{m,t}$6 is the UE transmit time including UE clock offset, $h_{m,t}$7 or $h_{m,t}$8 is UE position, $h_{m,t}$9 is receiver position, $\tau_{m,t}$0 is the speed of light, $\tau_{m,t}$1 is receiver clock bias relative to system time, and $\tau_{m,t}$2 is measurement noise such as multipath-induced bias or thermal noise. TDoA between receivers $\tau_{m,t}$3 and $\tau_{m,t}$4 is modeled as

$\tau_{m,t}$5

so the common UE term $\tau_{m,t}$6 cancels while differential clock bias remains if synchronization is imperfect (Ahadi et al., 27 Aug 2025).

The testbeds use O-RAN option LLS-C3 with PTP distribution from a GNSS-disciplined grandmaster across Cisco switches. Even under this arrangement, cross-RU timing errors up to $\tau_{m,t}$7 ns were observed in the GEO-5G terrace deployment because of PTP switch impairments and RU separations. Since $\tau_{m,t}$8, a $\tau_{m,t}$9 ns timing error maps to $\tau_{m,t} = T_s \cdot \arg\max_n |h_{m,t}[n]|.$0 m position error, so $\tau_{m,t} = T_s \cdot \arg\max_n |h_{m,t}[n]|.$1 ns can induce approximately $\tau_{m,t} = T_s \cdot \arg\max_n |h_{m,t}[n]|.$2 m if uncompensated. The LMF mitigates this by using per-RU differencing, for which antennas on the same RU share tight synchronization and the corresponding differential clock bias is smaller and more stable than for cross-RU pairs (Ahadi et al., 27 Aug 2025).

Position estimation is formulated as minimization of the PSO objective

$\tau_{m,t} = T_s \cdot \arg\max_n |h_{m,t}[n]|.$3

where $\tau_{m,t} = T_s \cdot \arg\max_n |h_{m,t}[n]|.$4 are optional weights. The implementation encodes each particle as a candidate 2D UE position constrained inside the convex hull or known test area bounds and updates particles according to

$\tau_{m,t} = T_s \cdot \arg\max_n |h_{m,t}[n]|.$5

$\tau_{m,t} = T_s \cdot \arg\max_n |h_{m,t}[n]|.$6

The reported parameters are inertia $\tau_{m,t} = T_s \cdot \arg\max_n |h_{m,t}[n]|.$7, cognitive $\tau_{m,t} = T_s \cdot \arg\max_n |h_{m,t}[n]|.$8, and social $\tau_{m,t} = T_s \cdot \arg\max_n |h_{m,t}[n]|.$9, with $\tau_t \in \mathbb{R}^M$0. Iteration terminates when the global best residual falls below a threshold or when maximum iterations are reached. Per-iteration computational cost scales with $\tau_t \in \mathbb{R}^M$1, and with tens of particles and few RUs/antennas, the latency fits near-real-time LMF constraints (Ahadi et al., 27 Aug 2025).

A common misconception is that standards-compliant positioning accuracy is determined primarily by the estimator. The reported results indicate instead that synchronization structure and differencing strategy can dominate performance; in these testbeds, replacing a common reference with per-RU referencing substantially improved CE90 under cross-RU drift. This suggests that, in practice, LMF design is inseparable from clock topology.

4. Filtering strategies and deployment-dependent error mechanisms

The paper identifies synchronization impairments, multipath propagation, and deployment geometry as the dominant sources of error, and the LMF filtering chain is designed around these mechanisms. The ToA outlier rejection stage retains only samples whose dominant CIR peak index lies within $\tau_t \in \mathbb{R}^M$2, computed over a dataset. This removes samples impacted by timing jitter or misdetection, cuts extreme ToA variations before differencing, improves TDoA stability, and reduces downstream outliers (Ahadi et al., 27 Aug 2025).

The TDoA geometry filter enforces the per-pair physical bound

$\tau_t \in \mathbb{R}^M$3

thereby suppressing NLoS-inflated delays and noisy estimates. At the Stellantis indoor site, this filter reduced CE90 from $\tau_t \in \mathbb{R}^M$4 m to $\tau_t \in \mathbb{R}^M$5 m and MAE from $\tau_t \in \mathbb{R}^M$6 m to $\tau_t \in \mathbb{R}^M$7 m. Temporal smoothing is then applied over LMF outputs; larger windows stabilize trajectories but increase latency, whereas smaller windows preserve responsiveness but expose more noise (Ahadi et al., 27 Aug 2025).

The deployment-specific interpretation is explicit. In the outdoor GEO-5G scenario, wider spacing and clearer LoS make multipath peaks more separable in the CIR, so synchronization drift dominates the error budget and per-RU referencing is especially beneficial. In the Stellantis indoor lab, dense multipath produces closely spaced peaks, making ToA peak picking prone to NLoS bias; here, filtering dramatically improves accuracy. In the Airbus factory hall, severe NLoS and SNR degradation due to $\tau_t \in \mathbb{R}^M$8 m cables and metallic structures make UL-TDoA fragile. The paper notes that oversampling and interpolation of CFR, supported by the OAI PHY, improve CIR peak detectability in dense multipath and aid ToA reliability without super-resolution complexity, although this capability is not emphasized as a heavy LMF function (Ahadi et al., 27 Aug 2025).

The geometry conclusions are equally direct. Multiple, non-collinear anchors shape better-conditioned hyperbolic intersections. The GEO-5G measurements show that $\tau_t \in \mathbb{R}^M$9 non-collinear antennas outperform $X \in \mathbb{R}^{M \times 3}$0 collinear antennas, with MAE $X \in \mathbb{R}^{M \times 3}$1 m versus $X \in \mathbb{R}^{M \times 3}$2 m and CE90 $X \in \mathbb{R}^{M \times 3}$3 m versus $X \in \mathbb{R}^{M \times 3}$4 m. The triangle-inequality TDoA filter itself exploits this geometry by removing physically impossible measurements before optimization. A plausible implication is that the LMF can benefit from geometry-aware weighting or adaptive anchor selection, a direction explicitly noted as future work.

5. Experimental realizations and quantitative performance

The reported testbeds share a common platform: OAI gNB with CU/DU, O-RAN split 7.2, commercial O-RUs from Firecell or VVDN, OAI CN including the LMF, 5G SA operation, and synchronization via a GNSS-disciplined PTP grandmaster using option LLS-C3. Positioning uses uplink SRS to estimate CFR→CIR→ToA per antenna, with ToAs sent over NRPPa to the LMF. The UE is a commercial mobile phone used in both static tripod and handheld scenarios. Ground truth is provided by laser-based surveyed static points identified as EURECOM A–P, and by centimeter-level RTK GPS for handheld trajectories (Ahadi et al., 27 Aug 2025).

Testbed	Deployment	Selected results
GEO-5G	Outdoor, 2 O-RAN RUs, rooftop antennas over $X \in \mathbb{R}^{M \times 3}$5 m $X \in \mathbb{R}^{M \times 3}$6 m	8 non-collinear antennas with per-RU reference: MAE 1.20 m, CE90 1.96–2.02 m
Stellantis	Indoor lab, 2 gNBs, 4 RUs, 8 antennas over $X \in \mathbb{R}^{M \times 3}$7 m $X \in \mathbb{R}^{M \times 3}$8 m	Unfiltered TDoA: MAE 4.81 m, CE90 8.74 m; filtered TDoA: MAE 1.22 m, CE90 1.99 m
Airbus	Factory hall, 2 gNBs, 4 RUs, 16 antennas over $X \in \mathbb{R}^{M \times 3}$9 m $K$0 m	UL-TDoA: MAE 5.78 m, CE90 8.94 m; fingerprinting with 16 antennas: MAE 0.54 m, CE90 0.74 m

Several detailed comparisons are particularly relevant to the LMF. In GEO-5G, per-RU reference outperformed common reference, with CE90 $K$1 m versus $K$2 m under cross-RU drift. For a handheld mobile trajectory, CE90 was $K$3 m with MAE $K$4 m against RTK ground truth. In Stellantis, filtered TDoA transformed performance from MAE $K$5 m and CE90 $K$6 m to MAE $K$7 m and CE90 $K$8 m. In Airbus, UL-TDoA alone remained poor, but CIR fingerprinting improved accuracy as antenna count increased: with $K$9 antennas, MAE $M_k$0 m and CE90 $M_k$1 m; with $M_k$2 antennas, MAE $M_k$3 m and CE90 $M_k$4 m; with $M_k$5 antennas, MAE $M_k$6 m and CE90 $M_k$7 m (Ahadi et al., 27 Aug 2025).

The reported summary is that the integrated LMF pipeline of filters plus PSO achieves approximately $M_k$8–$M_k$9 m accuracy in $$\Delta \tau_{k,m} = \tau_{k,m} - \tau_{k,\mathrm{ref}}$$0 of cases under favorable synchronization and geometry, while severe NLoS conditions motivate data-driven methods that reach sub-meter CE90. This is not a claim that the LMF alone guarantees such performance; rather, it reflects the combined behavior of architectural compliance, synchronization quality, measurement filtering, and estimator choice.

6. Beyond-5G extension, dataset release, and future directions

The beyond-5G framework augments the LMF-centered positioning stack with CIR-driven AI/ML positioning. Full CIR matrices from RUs are offloaded from the gNB to an AI/ML host using MQTT in an O-RAN-inspired arrangement, with E2 planned for future integration. Preprocessing consists of per-RU peak-based temporal alignment so that the earliest dominant peak aligns, normalization by a global maximum magnitude from training data, concatenation across RUs, and truncation to $$\Delta \tau_{k,m} = \tau_{k,m} - \tau_{k,\mathrm{ref}}$$1 FFT indices. NLoS masking uses a binary mask $$\Delta \tau_{k,m} = \tau_{k,m} - \tau_{k,\mathrm{ref}}$$2 built per antenna using a peak-power threshold $$\Delta \tau_{k,m} = \tau_{k,m} - \tau_{k,\mathrm{ref}}$$3, with $$\Delta \tau_{k,m} = \tau_{k,m} - \tau_{k,\mathrm{ref}}$$4 reported to reliably separate LoS from NLoS in the dataset. The model is a CNN encoder mapping filtered CIR input to $$\Delta \tau_{k,m} = \tau_{k,m} - \tau_{k,\mathrm{ref}}$$5 through the sequence Conv2D→Conv2D→Flatten→FC(512)→FC(128)→FC(2), with ReLU activations on hidden layers (Ahadi et al., 27 Aug 2025).

In severe NLoS, this method outperforms UL-TDoA by a large margin, exemplified by the Airbus CE90 comparison of $$\Delta \tau_{k,m} = \tau_{k,m} - \tau_{k,\mathrm{ref}}$$6 m versus $$\Delta \tau_{k,m} = \tau_{k,m} - \tau_{k,\mathrm{ref}}$$7 m. The paper states that the LMF can act as an orchestrator, collecting CIR through the RAN or through CU–DU and E2/xApps in standard deployments, selecting measurement modes such as TDoA versus ML, and fusing outputs. Since standard LMF services can return positions regardless of the internal estimation method, the work suggests an expanded conception of the LMF as an estimation-agnostic service endpoint rather than a component restricted to classical geometric solvers (Ahadi et al., 27 Aug 2025).

The released datasets include CIR, timestamps, anchor coordinates, and position labels derived from laser-surveyed points or RTK trajectories, with a public link at https://gitlab.eurecom.fr/ahadi/5g-srs-datasets for the mobile scenario dataset and additional datasets referenced in the paper. These datasets support evaluation of ToA/TDoA filtering, PSO estimation, CNN fingerprinting, transfer learning, and geometry analyses (Ahadi et al., 27 Aug 2025).

The limitations and future work outlined for the LMF are specific. Cross-RU timing stability via PTP remains difficult in large, distributed deployments, and drifts of $$\Delta \tau_{k,m} = \tau_{k,m} - \tau_{k,\mathrm{ref}}$$8–$$\Delta \tau_{k,m} = \tau_{k,m} - \tau_{k,\mathrm{ref}}$$9 ns severely impact TDoA. Future work includes tighter synchronization, drift tracking, and explicit bias estimation within the LMF. TDoA remains fragile under heavy multipath, whereas ML fingerprinting is robust but data-hungry; integrating AoA/AoD, multi-RTT, and hybrid estimators is proposed as a means to improve resilience. CIR delivery is not defined in NRPPa, so standard interface coverage remains incomplete, with O-RAN E2 integration through xApps and rApps planned for measurement streaming and inference. At $2.02$0 MHz, nominal range resolution is approximately $2.02$1 m per sample; oversampling helps peak detection but not the fundamental resolution, motivating wider bandwidths or multi-band fusion. Formal GDOP-like metrics were not reported, though anchor layout clearly affects accuracy, and future LMFs may incorporate geometry-based weighting and adaptive anchor selection. Real-time constraints also remain active: PSO tuning and smoothing trade latency for accuracy, and further optimization or hardware acceleration may reduce inference time (Ahadi et al., 27 Aug 2025).

Taken together, these results define the LMF in the reported OAI testbeds as a standards-compliant CN function that collects UL positioning measurements via NRPPa, compensates for synchronization and multipath through explicit filtering, estimates position with a PSO solver, and can plausibly evolve into a hybrid orchestrator that selects and fuses geometric and data-driven positioning modes.