LTE Sensing: Principles and Applications

Updated 6 July 2026

LTE sensing is a technique that uses standard LTE signals, reference symbols, and media access protocols to infer environmental changes and detect events.
It leverages channel state information, synchronization signals, and protocol observables to achieve detection accuracies over 90% in applications like vehicle classification and localization.
By repurposing existing cellular communication infrastructure, LTE sensing offers scalable, cost-effective solutions for applications ranging from urban telemetry to spectrum sharing.

Long-Term Evolution (LTE) sensing denotes the use of LTE signals, reference structures, receiver measurements, and protocol procedures as sensing primitives. In the literature considered here, it spans communication-based sensing in which a standard LTE user equipment taps channel estimation outputs to infer environmental change; synchronization and offset recovery based on Primary Synchronization Signal and Secondary Synchronization Signal; spectrum sensing for cognitive LTE and LTE-A; CSI-based localization and traffic monitoring; LTE Cell-Specific Reference Signals for ambient backscatter demodulation; and LTE-M telemetry for city-scale sensing deployments (Sardar et al., 2019, Morelli et al., 2015, Karunakaran et al., 2014, Zhang et al., 2019, Ruttik et al., 2022, Cabral et al., 2023).

1. Scope and conceptual structure

A recurring division is between sensing through LTE and sensing of LTE. In the first category, LTE downlink pilots and the channel state information already computed by a user equipment are treated as environmental probes. This is the logic of LTE-CommSense, of LTE-CRS-based ambient backscatter reception, of CSI-fingerprint localization, and of dual-receiver Doppler traffic sensing. In the second category, LTE itself is the sensed object: PSS/SSS detection and integer frequency offset recovery are sensing functions for initial cell search; cyclostationary detection targets LTE SC-FDMA as an incumbent signal in cognitive radio; Type 1 and Type 2 sensing in LTE-A target spectrum sharing; and RACH multiplicity detection infers how many devices selected a given preamble (Sardar et al., 2019, Ruttik et al., 2022, Zhang et al., 2019, Fenollosa, 16 Jul 2025, Morelli et al., 2015, Jerjawi et al., 2016, Karunakaran et al., 2014, Magrin et al., 2018).

Modality	Primary observable	Representative task
Communication-based sensing	CSI, CIR, tap power	Vehicle detection, object discrimination, traffic monitoring
Synchronization and access sensing	PSS/SSS metrics, PRACH correlation bins	Cell search, IFO recovery, collision multiplicity detection
Cognitive and coexistence sensing	Energy, CAF, RSS, BLER, CQI, throughput, latency	Spectrum sharing, incumbent detection, network reliability

This suggests that LTE sensing is not a single algorithmic family but a set of measurement regimes anchored in the LTE PHY and MAC. The common feature is reuse of structures already required by communication—reference symbols, synchronization signals, random-access signatures, or modem telemetry—rather than a dedicated radar waveform.

2. Signal structures and sensing observables

In passive LTE environment sensing, the key observables are the reference symbols embedded in the LTE resource grid. LTE downlink uses OFDM, and cell-specific reference symbols are inserted at known locations in the time-frequency grid. Let the known reference symbols be

$P = (p_1, p_2, \ldots, p_N),$

with received pilots modeled as

$y_i = H * p_i + n_i,\quad i = 1{:}N,$

or in vector form

$Y = [y_1, y_2, \ldots, y_N] = H * P + N.$

The LTE-CommSense formulation uses the channel estimate

$H_{LS} = YP^H (PP^H)^{-1},$

and adopts MMSE channel estimation for sensing because earlier LTE-CommSense work had shown that MMSE performs better for sensing (Sardar et al., 2019).

Synchronization-oriented LTE sensing is tied to the downlink synchronization channel. In LTE FDD downlink, PSS and SSS are transmitted on a 73-subcarrier band around DC, with 62 subcarriers used by PSS. The PSS encodes the sector ID, the SSS encodes the cell-ID group, and the sensing task is joint PSS detection, sector index identification, and integer frequency offset recovery. The reduced-rank maximum-likelihood framework introduced for this task treats the channel frequency response over the PSS subcarriers as a nuisance parameter and searches jointly over PSS position, root index, and integer frequency offset (Morelli et al., 2015).

Cyclostationary sensing of LTE uplink SC-FDMA uses second-order periodicity induced by DFT precoding, subcarrier mapping, and cyclic prefix insertion. For sampled data $r(u)$ , the cyclic autocorrelation estimator is

$\hat{c}_r(\tilde{\beta},\tilde{\tau}) = \frac{1}{U_s} \sum_{u=0}^{U_s-1} r(u)\, r^*(u - \tilde{\tau})\, e^{-j2\pi \tilde{\beta} u}.$

The detector in the SC-FDMA study exploits non-zero CAF at $(\tilde{\beta},\tilde{\tau})=(0,\rho M)$ , reflecting CP-induced correlation, and at $(\tilde{\beta},\tilde{\tau})=(\rho^{-1},0)$ , reflecting symbol-rate cyclostationarity (Jerjawi et al., 2016).

Beyond CSI and CAF, the LTE sensing literature also uses protocol-level and deployment-level observables. These include PRACH correlation bins for RACH multiplicity estimation, energy detection statistics for cognitive femto-cells, and network telemetry such as RSS, latency, BLER, and CQI for coexistence studies and LTE-M urban sensing (Magrin et al., 2018, Hamid et al., 2015, Reed et al., 2016, Cabral et al., 2023).

3. Architectures and processing pipelines

The canonical LTE-CommSense architecture is a receiver-only system built from existing commercial LTE base stations as transmitters, a standard LTE UE receiver implementation, and the channel state information that the UE already computes for demodulation. The implementation described in the vehicle-detection study uses a USRP N200 SDR, an RFX2400 RF daughterboard, a VERT2450 antenna, and OpenLTE. The receiver workflow includes RF reception and downconversion, time/frequency synchronization, OFDM demodulation, FFT, CellRS detection and extraction, channel estimation, and equalization. LTE-CommSense inserts a hook into the channel estimation/equalization block, stores CSI before equalization, and then applies PCA and simple decision rules or nearest-neighbour classification in the reduced space (Sardar et al., 2019).

The multiple-object LTE-CommSense study makes the event-detection architecture explicit as six blocks: LTE downlink capture, channel info capture, offline training database generation, SVM-based LTE-CommSense detector, decision and actuation interface, and system performance analysis. Each 15 s recording yields up to 1500 different channel estimates, and the detector is trained to discriminate environmental states such as no reflector, single reflector, and two reflectors. The study also states that LTE-CommSense detects events instead of objects, which becomes central to its performance interpretation (Sardar et al., 2019).

In ambient backscatter over LTE, the receiver uses CRS to estimate the channel and then demodulates the backscattered signal from the obtained channel impulse response estimates. The CRS-domain least-squares estimate is

$\hat{H}[n;m] = \frac{Y_{\text{CRS}[n;m]}}{X_{\text{CRS}[n;m]}},$

followed by an IFFT to obtain $\hat{h}[l;m]$ . The receiver tracks a selected CIR tap, uses the tap power

$y_i = H * p_i + n_i,\quad i = 1{:}N,$ 0

applies a high-pass filter to remove slowly varying channel effects, and uses Barker-code synchronization plus Manchester-coded OOK demodulation. The implementation uses a USRP B210 SDR and Matlab LTE toolbox (Ruttik et al., 2022).

Traffic sensing with dual receivers extends CSI processing to differential Doppler extraction. The system is implemented with a LimeSDR USB and srsUE from srsRAN 4G, with two receive chains observing the same commercial LTE base station. The key operation is the conjugate product

$y_i = H * p_i + n_i,\quad i = 1{:}N,$ 1

which turns common hardware phase impairment into a real scalar factor and leaves the phase term associated with differential Doppler. The phase derivative yields a differential Doppler estimate, which is converted into differential speed and then into target speed through the measurement geometry (Fenollosa, 16 Jul 2025).

4. Applications and empirical results

Vehicle detection and classification are the most developed passive LTE sensing applications in the surveyed work. In LTE-CommSense, five outdoor road environments were used for sedan-versus-no-vehicle detection and for four-class classification among background, Honda Activa, Hyundai i20, and Ford EcoSport Titanium. The first three eigenvalues account for 99.9 % of total energy, the first eigenvalue alone contributes about 99.79 % of the cumulative energy, a simple scalar threshold on the mean of a small number of principal components achieves $y_i = H * p_i + n_i,\quad i = 1{:}N,$ 2 detection accuracy, and the reported average classification accuracy is 92.6 %, with best cases exceeding 96 % (Sardar et al., 2019).

Multiple-object discrimination uses the same LTE-CommSense principle but evaluates the system as an event detector. The study reports object detection accuracy, FAR, FRR, and two redefined resolution measures. LTE-CommSense provides better performance in detecting presence or absence of objects at near range, and the reported resolutions increase with reflector distance: 0.3827 m at 0.5 m, 1.5 m at 2.0 m, 2.5 m at 4.0 m, 3.0 m at 7.0 m, and 3.2 m or 3.0 m at 10.0 m depending on whether Neyman–Pearson or Cramér–Rao resolution is used (Sardar et al., 2019).

Fingerprint-based localization uses commercial LTE CSI as a location-specific signature. A software-defined UE collects real time channel state information from a commercial eNodeB, a slot-based localization network maps CSI snapshots to position estimates, and a second network fuses multiple estimates in time. The reported Mean Distance Error is 0.47 meters for indoor and 19.9 meters for outdoor scenarios (Zhang et al., 2019).

Ambient backscatter over LTE treats the tag as a controlled perturbation of the CIR. In indoor corridor experiments, the measured LTE CRS power varied across 17 positions, the effective backscatter SNR after processing was 0 to 6 dB, and the raw BER ranged from 0.15 down to 0.04 at locations where frame detection and decoding succeeded (Ruttik et al., 2022).

LTE sensing also extends to access and control. In RACH multiplicity detection, neural-network-based sensing improves preamble detection by 2–3 dB in AWGN and by about 4 dB in ETU70 relative to the best threshold-based detector, while collision multiplicity estimation achieves about 90–97 % exact multiplicity with practically no probability of errors larger than 1 (Magrin et al., 2018). In cognitive LTE femto-cells, periodic energy detection and occupancy modeling yield a single periodic sensing interval that maximizes downlink throughput, and at the peak of the macro-cell traffic the sensing-based framework increases femto-cell throughput by around 15 % compared to the senseless case (Hamid et al., 2015).

At infrastructure scale, LTE-M supports long-term urban sensing but exposes a different class of sensing problems. A stationary 118-node LTE-connected, solar-powered sensor network operating for about one year in Chicago produced 8,684,756 readings, had a network-wide median RSS of about $y_i = H * p_i + n_i,\quad i = 1{:}N,$ 3 dBm, a median latency of 5 s, 11 sites with inadequate RSS to support sensing nodes, and approximately 33,180 hours of data loss due to power saving mode between autumn and spring (Cabral et al., 2023).

5. Performance measures, limitations, and recurring misconceptions

The performance vocabulary of LTE sensing is heterogeneous because the tasks differ. Communication-based sensing studies use detection accuracy, FAR, FRR, redefined resolution, and classification accuracy. Localization uses Mean Distance Error. Ambient backscatter uses BER and post-processing SNR. Physical-layer synchronization uses $y_i = H * p_i + n_i,\quad i = 1{:}N,$ 4, $y_i = H * p_i + n_i,\quad i = 1{:}N,$ 5, $y_i = H * p_i + n_i,\quad i = 1{:}N,$ 6, and global probability of failure. Cyclostationary detection uses $y_i = H * p_i + n_i,\quad i = 1{:}N,$ 7 and $y_i = H * p_i + n_i,\quad i = 1{:}N,$ 8. Coexistence studies use BLER, CQI, throughput, and SIR. Large-scale LTE-M sensing emphasizes RSS, latency, and hours of downtime (Sardar et al., 2019, Zhang et al., 2019, Ruttik et al., 2022, Morelli et al., 2015, Jerjawi et al., 2016, Reed et al., 2016, Cabral et al., 2023).

A common misconception is that LTE sensing is simply passive radar under another name. The surveyed LTE-CommSense work explicitly rejects that equivalence for some operating modes. Because the system detects events instead of objects, it redefines resolution through Neyman–Pearson and Cramér–Rao principles. The same study also shows why classical bi-static range resolution is not directly available: SIB-16 gives UTC with 10 ms precision, whereas the timing precision required for conventional radar-style ranging is orders of magnitude finer (Sardar et al., 2019).

The principal technical limitations recur across studies. LTE-CommSense reports that small targets such as a scooter are harder to distinguish from background, similar large vehicles are harder to distinguish from each other, multipath and background variability can complicate CSI signatures, and the basic vehicle classifier deliberately uses a simple nearest-neighbour model and does not exploit explicit Doppler (Sardar et al., 2019). Dual-receiver traffic sensing validates LTE-based passive sensing but identifies challenges at low speeds, directional ambiguity, and multipath fading in urban settings (Fenollosa, 16 Jul 2025). RACH multiplicity sensing depends on synthetic labels during development and faces a real-network labeling problem because exact multiplicity is not directly observable once collisions occur (Magrin et al., 2018). LTE-M urban sensing reveals micro-scale dead zones invisible to coarse coverage maps and strong dependence on local urban morphology, with technical burdens falling disproportionately on disadvantaged neighborhoods (Cabral et al., 2023).

This suggests that LTE sensing is strongest when the sensing target perturbs an already well-estimated LTE channel in a structured way and when the measurement geometry is controlled. It is weaker when phase stability, ground truth, line-of-sight, or energy availability are difficult to guarantee.

In LTE-A spectrum sharing, sensing is elevated to a protocol function. Carrier aggregation and cross-carrier scheduling allow each operator to keep PDCCH on an exclusive carrier while using a shared carrier for data. The sensing framework is divided into Type 1 sensing, which detects the interfering signal in the absence of the desired signal, and Type 2 sensing, which detects the interfering signal in the presence of the desired signal. For Type 2 sensing, the hypotheses are

$y_i = H * p_i + n_i,\quad i = 1{:}N,$ 9

and the study shows that reasonable sensing performance can be achieved with the use of channel state information, making such sensing practically viable (Karunakaran et al., 2014).

LTE synchronization is itself a sensing chain. Joint PSS detection, sector index identification, and integer frequency offset recovery can be formulated in a reduced-rank maximum-likelihood framework that treats the channel frequency response over the PSS subcarriers as a nuisance parameter. Under severe multipath and residual timing error, the AMMSE detector substantially outperforms differential and conventional detectors; at SNR = 10 dB and $Y = [y_1, y_2, \ldots, y_N] = H * P + N.$ 0 samples, the reported probability of failure is about $Y = [y_1, y_2, \ldots, y_N] = H * P + N.$ 1 for AMMSE versus about $Y = [y_1, y_2, \ldots, y_N] = H * P + N.$ 2 for DD, PCRR, and PRR (Morelli et al., 2015).

LTE sensing is also entangled with coexistence and spectrum-sharing infrastructure. Field experiments on TD-LTE and SPN-43 radar in the 3550–3650 MHz band show that LTE communication using low antenna heights was not adversely affected by the pulsed interfering signal operating on adjacent frequencies irrespective of the distance of interfering transmitter, and that performance was degraded only for very close distances (1–2 km) of overlapping frequencies (Reed et al., 2016). The Virginia Tech spectrum-sharing research testbed generalizes this coexistence regime by combining SDRs, CMW500 LTE test equipment, channel emulators, configurable RF switching, and recorded NOAA radar waveform samples, with both channel-emulated and over-the-air modes (Marojevic et al., 2017).

The future directions named explicitly in these studies are consistent. LTE-CommSense plans to explore absolute magnitude, squared magnitude, and logarithmic magnitude as alternative CSI features; more sophisticated classifiers such as SVM, random forests, and neural networks; and incorporation of Doppler signatures (Sardar et al., 2019). Dual-receiver traffic sensing identifies angle-of-arrival integration, machine learning, and real-time embedded system development as critical next steps (Fenollosa, 16 Jul 2025). Several studies note direct extension to 5G NR and future 6G systems, particularly through multi-antenna CSI, higher bandwidths, and the broader Integrated Sensing and Communications agenda (Sardar et al., 2019, Fenollosa, 16 Jul 2025). For long-term LTE-M sensing deployments, adaptive duty cycling and more accurate planning tools that include trees, seasonal shading, and street-level coverage are the immediate system-design priorities (Cabral et al., 2023).