Augmenting mmWave localization accuracy through sub-6 GHz on off-the-shelf devices

Millimeter-wave (mmWave) technology is an important element to increase the throughput and reduce latency of future wireless networks. At the same time, its high bandwidth and highly directional antennas allow for unprecedented accuracy in wireless sensing and localization applications. In this paper, we thoroughly analyze mmWave localization and find that it is either extremely accurate or has a very high error, since there is significant mmWave coverage via reflections and even through walls. As a consequence, sub-6 GHz technology can not only provide (coarse) localization where mmWave is not available, but is also critical to decide among multiple candidate antennas and APs for accurate mmWave localization. Based on these insights, we design a high-accuracy joint mmWave and sub-6 GHz location system. We enable CSI-based angle estimation and FTM-based ranging on off-the-shelf mmWave devices to implement our mechanism and carry out an extensive measurement campaign. Our system is the first to achieve 18 cm median location error with off-the-shelf devices under their normal mode of operation. We further release the location system (and in particular the CSI and FTM functionality) as well as the trace data from the measurement campaign to the research community.


INTRODUCTION
The rapid increase in traffic demand both in mobile as well as wireless local area networks has boosted interest in networking at mmWave frequencies, where the huge available bandwidth enables significantly higher data rates than the ones that can be achieved at sub-6 GHz frequencies. 5G mmWave networks were rolled out a few years ago in several countries with user data rates of up to 2.5 Gb/s [26]. For Wireless Local Area Networks (WLANs), the IEEE 802.11ad amendment [27] operates at 60 GHz with a bandwidth of 2. 16 GHz to deliver data rates of up to 4.6 Gbit/s, and its recently standardized successor 802.11ay [9] can reach up to 100 Gb/s through MIMO, higher order modulation schemes, and channel bonding. To achieve larger link distances, mmWave devices use directional antenna arrays to focus the emitted energy towards the intended receiver, since the range of a single omnidirectional mmWave antenna element is extremely limited. In addition, mmWave signals are blocked more easily by obstacles than sub-6 GHz signals, making it difficult to achieve ubiquitous coverage. For these reasons, wireless devices typically support multiple bands and mmWave connectivity is usually deployed together with sub-6 GHz networks to be able to fall back to the latter whenever the mmWave link is unavailable. Furthermore, to deal with the limited aperture (field-of-view) of mmWave antennas, some off-the-shelf devices integrate up to eight mmWave antenna arrays and switch between them for better angular coverage [15,25].
The large number of elements in directional mmWave phased antenna arrays enables very accurate estimation of the angle of the signal and the high temporal resolution from the multi-GHz bandwidth provides excellent ranging accuracy. These characteristics make mmWave technology an ideal candidate to design highly accurate wireless location systems [8,30,47]. A location system estimates the Angle of Arrival (AoA) and Time of Flight (ToF) of the path between an Access Point (AP) and a client to determine the position of the client. In case this path is in direct Line of Sight (LOS), the angle and range information from AoA and ToF will lead to an accurate estimate of the position of the client. While obstructed LOS paths that pass through obstacles are often too weak to be detected, they may still provide accurate localization in some cases. However, if the path to the client is Non Line of Sight (NLOS) via one or more reflections, both angle and range information correspond to the reflection rather than the actual client position. This can either occur when 1) only a reflected path exists, 2) the reflected path is much stronger than the LOS path (since the phased array antenna is steered towards the reflection), or 3) the device orientation is such that the LOS path is outside the aperture of the antenna and cannot be captured. Thus, a mmWave location system is either very accurate, or has a high error.
Unfortunately, the mmWave multi-path channel is typically sparse with only few available paths, and due to the limited range there is coverage from only one or very few APs. This makes it exceedingly difficult to distinguish between LOS and NLOS cases using mmWave information alone. However, operating a sub-6 GHz location system [18,48,49] along with the mmWave location system allows to distinguish reflections from (obstructed) LOS paths with the help of the lower frequency information. Sub-6 GHz antenna elements are omnidirectional and are thus less affected by device orientation, and the lower frequency leads to better coverage and more visible APs. In addition to improving mmWave localization, lower frequency location information can be used whenever there is no mmWave coverage, although it provides lower accuracy due to the lower bandwidth and lower number of antennas.
Only few prior works study the joint use of mmWave and sub-6 GHz bands. The most common use case is to reduce the mmWave beam-training overhead with the help of sub-6 GHz information [11,28,36,41] to infer the optimal steering direction of the mmWave antenna array. The only system that combines mmWave and sub-6 GHz information for localization purposes "fuses" mmWave ToFbased ranging with sub-6 GHz AoA [23] but does not in fact provide an independent location system at either band.
In this paper, we propose a Multi-band Location System (MultiLoc) that uses both mmWave and sub-6 GHz channel information to achieve high-accuracy device localization. Despite significant research interest in localization, to the best of our knowledge no such multi-band location system has been proposed. MultiLoc uses the sub-6 GHz location estimate to decide whether to use mmWave information at all, and if yes which mmWave AP to use for the localization, whenever the client is covered by one or more mmWave APs. If there is no mmWave coverage or all mmWave paths are estimated to be NLOS, the sub-6 GHz location estimate is used directly. Otherwise, the location estimate from a single mmWave AP is used. Our system does not merge location estimates from multiple APs as the mmWave estimates are either very accurate or quite inaccurate. Combining accurate estimates only marginally improves localization performance, but merging even a single inaccurate estimate significantly degrades it. In case the device integrates multiple mmWave antenna arrays with different orientations to improve coverage, MultiLoc uses the array that provides the shortest mmWave ToF estimate to a given AP, since LOS paths are characterized by a shorter length than NLOS paths.
In order to test our system at scale, we implement MultiLoc on Commercial Off-The-Shelf (COTS) mmWave devices [25]. To this end, we port the OpenWRT embedded Linux to these devices and modify the mmWave device drivers in order to extract Channel State Information (CSI) information and enable Fine Time Measurement (FTM) ranging. This is the first open platform that supports AP Points Antenna aperture Direct path Reflection Wall Figure 1: Estimated angles and path lengths when the client has a 45 • misalignment with the AP both mmWave CSI extraction and FTM, and we have made the code and tools freely available [1]. We deploy MultiLoc in indoor and outdoor environments and compare its performance against several baselines, including a multiband (MB), a mmWave, and a sub-6 GHz (Spotfi) system. We also evaluate MultiLoc as well as baseline system performance for different numbers of mmWave antenna arrays on the client. In a benign scenario with a dense deployment of APs and a client with several mmWave arrays facing in different directions, both MultiLoc and the mmWave baseline achieve a median error of 13 cm, whereas the MB baseline and the sub-6 GHz Spotfi have errors of 45 cm and 2.8 m, respectively. We find that only two independent arrays on the client are sufficient to guarantee an error below 20 cm with MultiLoc. Even in sparse and complex office deployments, and for outdoor and mixed indoor/outdoor scenarios, MultiLoc significantly outperforms the baseline schemes. The full MultiLoc implementation as well as the datasets of our measurement campaigns are available at [1].

MOTIVATION
We examine the behavior of mmWave localization and its dependence on device orientation in more detail in an indoor scenario. We place a client at different measurement points directly in front of the AP within LOS, as shown in Fig. 1. The five measurement points are equally spaced (with step size 1.2 m) on a line originating at the AP, with the closest being at 4.2 m. Parallel to that line at a distance of 3.4 m there is a wall. On the AP, we measure both ToF and AoA to the client to estimate its position relative to the AP (we provide further details of the ToF and AoA estimation algorithms in Section 3). According to the manufacturer, the aperture of the AP and client antennas is ±30 • , but we observe partial connectivity also beyond that angular range.
If the client has a rotation of 0 • with respect to the AP, i.e., it points directly at the AP, the location estimates are very accurate with errors between 8 cm and 13 cm for the measurement points (not shown in the figure). For comparison, the baseline 802.11ac location system operating at 5 GHz obtains a median error of 0.3 m. Fig. 1 shows the same scenario when the client is rotated by 45 • counterclockwise. The length and angle of each line represent the distance and the angle estimated for mmWave. For reflected paths, the client location estimated by the AP is given by following the solid line through the wall for the corresponding distance (i.e., mirroring the dotted lines at the wall). The location errors are 0.12, 0.13, 5.7, 4.4 and 6.4 m. The first two points still provide accurate localization despite the LOS path being outside of the antenna aperture, since the AP does not emit a signal at an angle steep enough to reach the client via a reflection, due to its own limited aperture. For the last three points, however, the chosen path is a reflection off the wall towards which the client antenna is pointing, which significantly decreases the accuracy of the system. In a more extreme case with a rotation of 90 degrees and the client directly facing the wall, none of the antenna patterns of the array have any significant gain directly towards the AP, and for all five positions we observe reflected paths and location errors above 4 m.
These examples highlight how unreliable mmWave localization can be when AP and client are not aligned. This problem is exacerbated for larger AP-client distances and more complex indoor environments. In contrast, the sub-6 GHz system is significantly less accurate but at the same time less dependent on client orientation. This motivates the design of our multi-band location system which uses sub-6 GHz information to distinguish LOS and NLOS mmWave paths. Finally, since the mmWave location system is either very accurate or has a high error, it is not beneficial to fuse the data from both bands.

MULTI-BAND LOCALIZATION
We now explain the details of the localization techniques. We first give some background on ToF and path parameter estimation. We then explain the details of the MultiLoc AoA estimator for both, mmWave and sub-6 GHz. Finally, we discuss how to combine the measurements from several APs and for both frequency bands.

Background on FTM ranging
IEEE P802.11-REVmc [7] describes the FTM procedure that can be used by two FTM capable devices to estimate their distance without clock synchronization. One device, the Initiator, starts the FTM session by sending an FTM request frame. The other device, the Responder, acknowledges the request and confirms that the FTM session has started. After the FTM request has been acknowledged, both sides start exchanging packets. The Responder sends a first packet and records the timestamp 1 when it is sent. Once this packet reaches the other side, the Initiator records the time and then sends back an ACK with two timestamps, the timestamp 2 when the packet was received and 3 when the ACK is sent. Once this ACK reaches the Responder, it again records the current time 4 and extracts 2 and 3 from the the ACK. The Round Trip Time (RTT) is then estimated as follows, where is the number of measurements: For both mmWave and sub-6 GHz, the distance is then given bŷ = · /2, where is the speed of light.

Background on path parameter estimation
Consider a wireless multipath channel where each path is defined by the parameters of the azimuth and the elevation angles at the transmitter and the receiver, denoted by , , and , respectively, the attenuation , the path delay and the Doppler shift . We call = [ , , , , , , ] the vector of path parameters. Then, the multipath channel is expressed as: where is the number of paths and is -dimensional white Gaussian noise.
For active localization purposes, we need to extract the path parameters of the direct path from the multipath channel. However, estimating them is not trivial because all the multipath components interact with each other once they arrive at the receiver. Hence, an accurate estimation of the direct path requires separating all the multipath components. To this end, we follow the approach of mD-track [48] which is a powerful path parameter decomposition algorithm originally designed for passive localization with a Uniform Linear Array (ULA) at sub-6 GHz. The elevation angle cannot be extracted due to the geometry of the array. The vector of path parameters of mD-track is defined as = [ , , , , ]. In this subsection, we provide an overview of this algorithm and in the next subsection we discuss our modifications of the mD-track algorithm for mmWave channels.
The mD-track algorithm estimates the path parameters iteratively by reconstructing the strongest path and its parameters and then subtracting it from the received signal, so that successively weaker paths can be estimated. Once it obtains an initial estimate for all the paths, it applies several rounds of refinement.
Initial estimation. mD-track iteratively determines the contribution of the strongest path, estimates its parameters, reconstructs it, and then subtracts it from the received channel. The result of the subtraction is the channel residual, which is then used to estimate the second strongest path's contribution, and so on. mD-track iterates multiple times until the parameters of all the significant paths are estimated. To this end, mD-track formulates a multi-dimensional estimator denoted as ( , , , , ) which aims at maximizing the power of the received channel according to a set of possible path parameters. Therefore, the path parameters that maximize the -function are the ones from the strongest signal as follows: ,ˆ,ˆ,ˆ= arg max | ( , , , , )| , and the attenuation is estimated as follows: where is the total number of antennas and is the signal duration. Hence, the estimated vector of path parameters isˆand the reconstructed channel is (ˆ).
For the -th path, the channel residual is expressed as follows: and the residual for = 1 is the original channel r 0 = . After estimating the path parameters of the strongest path, mDtrack reconstructs it and removes it from the received channel. The initial estimation phase ends once all the paths are reconstructed.
Iterative path parameter refinement. The initial estimates may contain errors since the subtraction step may leak information from stronger paths to weaker paths and vice versa. To improve the estimate, mD-track applies several rounds of refinement by summing the residual to the reconstructed path so that we can iterate over this path and re-estimate its parameters another time. By adding the reconstructed path to the residual we get the raw The raw signal now contains less interference since other paths were already estimated in a prior iteration. However, the residual might still contain useful information that was not extracted correctly before, since the paths were interfering with each other in the initial estimate. mD-track then re-estimates the path parameters for the raw path as in the initial estimation rounds to obtain more accurate parameters. mD-track also re-estimates the residual for every path so that the residual contains less interference as well. mD-track continues iterating until the difference between the path parameters obtained in the last two rounds of iterations is lower than a configurable threshold.
3.2.1 Azimuth estimation at sub-6 GHz. We directly use the mDtrack algorithm to estimate the azimuth at the transmitter and receiver, the attenuation and the path delay for every path with the sub-6 GHz system. For simplicity, we do not extract velocity via the Doppler effect since our scenarios do not involve mobility. For localization, we then extract the direct path as the one with the lowest delay, i.e., that arrives first in time. For details we refer the interested reader to [48].

mmWave angle estimator
We consider a wireless system where the transmitter and receiver have a single RF-chain connected to a Uniform Rectangular Array (URA) with x antenna elements. The signal sent by the transmitter propagates through the multipath channel along different paths and arrives at the receiver. In the following we refer to Fig. 2 where the transmitter (the client) is located at and the center of URA of the -th AP is at , with the URA lying on the = 0 plane. We characterize the paths from the source as they appear at the centre of the URA using the following parameters: • Complex attenuation of the signal over the path.
• Azimuth angle between the path and the plane = 0.
• Elevation angle between the path and the plane = 0. In order to extract the three parameters, we first need to characterize how the phase rotation in the elements of the URA changes over and . We denote by and the angles that characterize the antennas in the Z and Y axis, see Fig. 2. We formulate the phase rotation introduced by the signal on every antenna element with respect to the reference antenna element as: where and are the antenna spacing and goes from 0 to − 1, goes from 0 to − 1, and ( , ) = (0, 0) is selected as the reference antenna. Thus, the vector that contains the phases for the antennas across the Z direction is defined as: (7) where is the wavelength of the RF signal. Similarly, for the antennas across the Y direction we have: Both angles and depend on the the direction of the path, which is characterized by the elevation and azimuth angles. From Fig. 2 we can see that corresponds to elevation , so that ( ) is equal to ( ). Angle , instead, depends on both the elevation and azimuth according to the relation ( ) = ( ) ( ). With the parameters above, we express the channel by summing all the contributions given by the paths as follows: where is a white Gaussian noise matrix of size and (·) is the Transpose operator.
3.3.1 AoA estimation at mmWave. The channel described above contains the path parameters for all the paths, but for localization we are interested in the direct path between the client and the AP. To this end, we follow the mD-track approach and we extend it to adapt it to a URA and the mmWave channel characteristics.
In our case, the -function is the matching projection to the channel residual based on the path parameters, which for the -th path is defined as follows: where (·) * and (·) are the conjugate and Hermitian operator, respectively. Once the iterative refinement finishes, we extract the path parameters of the direct path. Since the path parameters for a mmWave single-carrier PHY do not contain any temporal information as in an OFDM system, we select the direct path as the one with highest power: we express the power of every path as = || || 2 . We denote the direct path as . The estimated azimuth is extracted from the , as follows: = asin(sin( , )/cos( , )) , and the estimated elevation isˆ= , .

Location estimation
We now describe how MultiLoc determines the final location. First, each AP computes the location of the client using its own known position x asp We denote byp , andp ,ℎ the estimated location using the sub-6 GHz and mmWave information, respectively. Note that the elevation angle cannot be estimated by the sub-6 GHz system, and it thus usesˆ= 0 for the estimation ofp , . All the location information is gathered at a central controller that computes the client position. Before showing how MultiLoc merges the mmWave and sub-6 GHz location estimates, we first explain how we localize at mmWave and sub-6 GHz bands individually.
3.4.1 Standalone mmWave location system. At typical AP densities, it is unlikely that several mmWave APs provide good coverage at a given location, due to the large path attenuation when traversing obstacles. Many client devices also include more than one antenna array on each device, which helps to overcome the limited angular aperture of a single array and makes the system much more robust to rotation. The first challenge is thus to pick the best array out of the available ones. For a client with arrays, we obtain position estimates. We then computep ,ℎ , which is the position estimated by AP for client array .
For each of these estimates, we compare the distance and pick the combination of array and AP which minimizes the estimated distance. Since mmWave behaves quasi-optically, the shortest distance is most likely to point to the LOS path and to the best AP if there is more than one within range. The position estimate at mmWave isp ℎ =p ′ ,ℎ , ′ , where ′ and ′ are the AP and array that result in the lowest distance estimate.

Standalone sub-6 GHz localization.
The sub-6 GHz band has better coverage than mmWave and is more likely to penetrate through obstacles. Therefore, the sub-6 GHz localization system has to deal with more position estimates since more APs are able to localize the client than with mmWave. Obstructed paths may provide useful position information but the location estimates from the farthest APs to the client are more likely to be unreliable. We thus compensate the unreliable estimates by weighting the location estimate from every AP based on the estimated distance. We give the weight values of 1 and 0 to the APs which have the minimum and maximum estimated distance, respectively. For the remaining APs, we compute their weights through a linear interpolation between the estimated distances and the minimum and maximum distances (e.g., for three APs and ToF estimates of 10, 12 and 20 m, the corresponding weights are 1, 0.8 and 0). The position at sub-6 GHz is then computed using the weighted centroid approach: where is the weight given by the -th AP and is the number of available APs.

MultiLoc localization.
For best performance under different conditions, MultiLoc combines the excellent localization precision of mmWave with the availability of sub-6 GHz. MultiLoc uses mmWave localization only if it is deemed reliable, and if not MultiLoc replaces it by sub-6 GHz positioning information. To do so, MultiLoc applies three steps. (1) MultiLoc takes the best array from the client for localization. However, the best array at the client may be still unreliable (in case it is pointing to an obstacle instead of the AP), and thus (2) MultiLoc applies a sub-6 GHz and mmWave discrimination. Finally, (3) MultiLoc selects the best AP. We explain in details the MultiLoc steps below.
(1) Best array selection. As explained before, the client may have several mmWave antenna arrays pointing in different directions. We are interested in determining the array that points in the direction of the AP, to avoid the large bias in the localization that arises when MultiLoc takes the angle and ToF of a reflection. To do so, we assume that the array with the lowest estimated distance is the correct array since the direct LOS path is the shortest path from the client to the AP.
(2) Sub-6 GHz/mmWave discrimination. This is the most critical step of MultiLoc. Selecting the mmWave information from a reflection leads to high localization errors, but at the same time, whenever choosing the sub-6 GHz location even though the mmWave one is correct, MultiLoc looses accuracy. To this end, MultiLoc measures two metrics, (i) the difference between sub-6 GHz and mmWave ToF estimates, expressed as Δ =ĥ −ˆand (ii) the Euclidean distance between the sub-6GHz and mmWave location estimates, denoted as Δ . If the ToF difference Δ is larger than 1.5 m (to provide some margin in case of inaccurate sub-6 GHz ToF estimates), the mmWave ToF is longer than the sub-6GHz one which implies that the mmWave path is likely to be NLOS. Thus, MultiLoc should use sub-6GHz positioning. We also observe cases where the sub-6 GHz azimuth is coarsely pointing to the client and the mmWave azimuth to a reflector while there is no significant difference in the ToF estimates. Here, the strongest mmWave path is NLOS but the direct path is strong enough so that the mmWave ToF is a combination of the ToF of these two paths. To overcome this issue, we use the Euclidean distance of the location estimates, Δ . In particular, a large Δ means that the two bands highly disagree concerning the position of the client, and the most likely reason is that the mmWave AoA is pointing to a reflector. We therefore set a threshold ℎ for Δ above which, MultiLoc also uses sub-6 GHz localization.We experimentally determine ℎ = 4.5 as the value that minimizes the Root Mean Square Error (RMSE) of MultiLoc localization in several example scenarios, since RMSE is sensitive to outliers and thus helps to avoid high errors caused by faulty mmWave positioning. In summary, if Δ > 1.5 m or Δ > ℎ , MultiLoc uses sub-6 GHz and otherwise mmWave. We denote aŝ p the position estimate after applying discrimination for the -th AP.
(3) Best AP selection. Having chosen between sub-6 GHz and mmWave for each individual AP estimate, MultiLoc has to determine the best AP for localization from all the AP candidates. Note that there may be APs with NLOS in the set of candidates, and taking one of those APs to localize will create large errors. Therefore, MultiLoc has to take the AP with the best channel conditions. We observe that the lowest values of the estimated distance are highly correlated with the most accurate localization estimates. However, we also observe an accuracy degradation for azimuth estimates closer to extreme angles (±90 • ), in particular a degradation by a factor 1.5 for cases where the estimated azimuth is either larger than +45 • or lower than −45 • . Thus, we formulate an objective function in terms of the sub-6GHz estimated distance and azimuth to measure the reliability of the location estimates giving more weight to the distance. Then, we select the best AP (denoted as * ) as the one that minimizes the following objective function: * = arg min where | · | refers to the absolute value.
The parameter controls the trade-off between distance and azimuth and is set to 0.85 if |ˆ| ≥ 45 • and to 1 otherwise. We base this selection on sub-6 GHz because it is agnostic to the client rotation since the mmWave ToF and azimuth of the AP may contain outliers due to an unsuitable rotation of the client. Thus, the final position estimate of MultiLoc is given byp * . Sensitivity analysis. We did an in-depth sensitivity analysis for the parameters used in the sub-6 GHz/mmWave discrimination and best AP selection procedures. For all parameters, minor changes (on the order of 10%) do not significantly impact localization performance. Larger changes for these parameters may, in several cases, cause MultiLoc to select sub-6 GHz when mmWave is more accurate or vice versa, and thus degrade performance. Fortunately, we found these parameter settings to be very robust across different environments and deployment types, and we verify that they work well in the very diverse set of scenarios we investigate.

IMPLEMENTATION
Before discussing the details of wireless localization and the design of our multi-band algorithm, we present the COTS hardware on which we implement our system and explain how we modify the device driver to access CSI and FTM.

mmWave system
For the experimental evaluation we use COTS devices, specifically the MikroTik wAP 60G and MikroTik wAP 60Gx3 shown in Fig. 3. Since its proprietary operating system provides very limited access, we ported OpenWRT to this platform. This gives us the ability to customize the open source wil6210 Linux driver and enable CSI extraction functionality as well as FTM measurements. Our custom fork of OpenWRT and the mmWave driver are available at [1].
4.1.1 Hardware. The MikroTik wAP 60G devices come with a URA of 6 by 6 antenna elements and 60 • aperture. The MikroTik wAP 60Gx3 uses three of such arrays arranged at different angles to provide a combined aperture of 180 • . Unfortunately, as of now it is not possible to select which antenna to use and the CSI and FTM data are always gathered from the antenna in the middle, and we thus use these devices interchangeably. The same antenna has been partially reverse engineered [54] in order to have further control over it by using a custom FPGA implementation for the control path. Instead, our approach does not require additional hardware modifications which makes it inexpensive and easily accessible. The first challenge we faced was to map each logical antenna element to its physical position on the antenna array, which is important to estimate the AoA. To this end, we establish a link between a pair of MikroTik devices while capturing CSI measurements and we successively cover each antenna element with tin foil. When covered, an antenna element becomes noisy, and we can find the logical element by observing the changes in CSI magnitude of the antenna elements. The mapping is shown in Fig. 3. Since Qualcomm uses 32 bits to define the Beam Patterns (BP) of their devices, only 32 antennas can be addressed, and for this reason the 4 antennas in the corners are unused. Old versions of the MikroTik wAP 60G use the Sparrow B0 chipset, whereas recent versions come with a Sparrow D0 chipset.
The antenna spacing is 0.58 times the wavelength at 60.48 GHz [54]. This antenna spacing creates spatial ambiguity since it is more than half the wavelength. Here, several AoAs may produce the same phase delays at the antennas. To remove the ambiguity and select the correct AoA, we first identify the possible AoAs and we then choose the correct one based on the AoA estimate at sub-6 GHz. We choose as mmWave AoA the one that minimizes the angular difference with respect to the sub-6 GHz AoA. Note that at sub-6 GHz there are no ambiguities because the antenna spacing is exactly half of the wavelength.
4.1.2 Software. MikroTik devices use a proprietary operating system called RouterOS based on a heavily modified 3.3.5 Linux Kernel with a unique binary called nova that bundles all functionality. This OS is very limited, and only very basic operations are enabled. In order to perform research with these devices, we created our own custom OpenWRT fork with 60 GHz support. Our original development was done with first generation devices which have a Sparrow B0 chipset for which an official Qualcomm firmware exists. However, the current MikroTik wAP 60G and 60Gx3 APs come with a Sparrow D0 (QCA9500) chipset, for which no official Qualcomm firmware is available. After some trial and error we found that it is possible to extract the required firmware from the package wireless-6.40.9-arm.npk available on the MikroTik website, which contains the wil6210-d0.fw firmware. Newer packages are encrypted and are not compatible with the Linux driver. Furthermore, not all the firmwares have CSI and FTM functionality enabled.
All the communication from the operating system to the chipset and vice versa is done through Wireless Module Interface (WMI) calls. Most of those calls are defined in a file called wmi.h, distributed with the official sources of the wil6210 Linux driver developed by QCA. This file hints at CSI and FTM commands, but provides no information on how to invoke them. By analyzing the different WMI structures, we were able to add new calls for executing commands in the wil6210 driver and return results to user space, as shown in Fig. 4. More specifically, we implemented the necessary vendor subcommands, the missing events, the NLA (Network Level Authentication) policies for FTM, and implemented the required FTM functions and the parameters to those functions. All these modifications are included in our modified wil6210 driver [1]. Additionally, we ported the CSI extraction functionality available for the old chipset on the Talon AD7200 devices [30] to our OpenWRT image. FTM functionality was previously not available, and to the best of our knowledge this is the first time that FTM has been enabled in mmWave COTS devices. A CSI measurement only requires a simple WMI command with few parameters, whereas for FTM we need to start a specific FTM session with a specific set of parameters, which we determined through automated parameter testing.
Since the FTM functionality is experimental and was never publicly released by the vendor, stable long-term measurements are unfortunately not possible with the current firmware. We thus have to disconnect and then reconnect the client to the AP for each new FTM measurement. As a consequence, FTM measurements take 1.5 s on average. However, the FTM transaction itself (including the handshake and packet transmissions) only takes around 10 ms. We expect that with new firmware releases or some firmware hacking, reliable FTM will be possible in real time with these devices.  Table  PTU-D47 60 GHz absorbent material Figure 5: Calibration setup. Figure 6: Phase histogram

Sub-6 GHz system
For the sub-6 GHz localization implementation based on IEEE 802.11ac, we use two COTS devices as was done in other prior work [34], one to extract CSI and another for FTM. Fig. 3 shows the devices we use. The CSI device is an ASUS AC2900 RT-AC86U with a Broadcom BCM4366E chipset. We use the Nexmon CSI extractor tool from [12] to obtain CSI for 4x4 MIMO and 80 MHz IEEE 802.11ac frames. In this configuration, the extracted CSI matrix has a size of 4x4x256 complex values, where 256 corresponds to the number of subcarriers of the 80 MHz channel. As FTM device we use an ASUS AC1300 RT-ACRH13 router which supports FTM requests out of the box and a laptop with an Intel Dual Band Wireless-AC 8260 wireless interface as initiator, as in [14]. We apply some modifications to the Linux driver of the card to start the FTM session and extract the FTM measurements.

System calibration
Unfortunately, a range of preliminary measurements reveal that some calibration is needed to handle hardware imperfection that affect the CSI and ToF values, which would considerably reduce the accuracy of the AoA and ToF estimates.

60 GHz CSI.
A CSI measurement contains a phase and amplitude value for each of the 32 antenna elements. Note that for all devices, antenna elements 31 and 32 only report noise, which leaves a total of 30 antenna elements to work with. The value reported by the driver is an integer between 0 and 1024 which corresponds to a phase between 0 and 2 . For every CSI measurement, we convert the 30 CSI values into a matrix form of 6x6 with a layout as shown in Fig. 3, to convert the logical to the corresponding physical antenna elements in the rectangular array. Further analysis of the CSI data reveals that the AP has to account for the phase added by the oscillator to every antenna in the array and some systematic phase shifts that are WiFi frame dependent.
• Phase offsets. Since the devices have one radio-frequency (RF) chain, there is one common oscillator to tune to the central frequency. However, the internal circuitry and layout of the device introduce phase offsets at each antenna element, which need to be removed for accurate AoA estimation. To this end, we mount an AP/client pair in a shielded environment at 0 • azimuth and elevation angles, as seen in Fig. 5. This ensures that the direct path itself does not introduce any phase delays and the shielding removes any multipath effects that may distort the phase. We then measure the reference CSI that corresponds to the phases offsets. To remove them from actual CSI measurements, we perform the element-wise Hadamard division between measured CSI data and the reference CSI. These offsets are constant over power-cycles and for different devices with the same antenna type, and thus this calibration has to be done only once. We verify the calibration using a rotation table that rotates the device in steps of 5 • both in the azimuth within ±60 • and elevation angles within ±30 • . The estimated angles closely follow the ground truth, with very low angle errors below 2 • . This measurement also shows that under ideal conditions, accurate angle estimation is possible far beyond the official antenna aperture of ±30 • .
• Systematic phase shifts. We also observe systematic phase shifts that affect all antenna elements and that appear randomly over the WiFi packets. These phase jumps remain the same as can be seen from the two Gaussian distributions in Fig. 6, one of which corresponds to the correct phase centered at 0 and another one centered between −3 /8 and − /2. We can thus compensate the phase shifts as they follow a clear pattern, rather than discard them. To do so, we apply a Gaussian mixture model to the phase values over a set of WiFi packets to model the two Gaussian distributions, one for the correct CSI phases and the other for the phase-rotated CSI. We then shift the mean of the less populated Gaussian distribution to center it on the correct phase value.

60 GHz ToF.
We further observe an offset for FTM measurements as was also reported in [14] for sub-6 GHz. To calibrate the FTM, we use the same setup as for the CSI and set up the routers at 2.5 of distance. We then take 100 measurements and use the difference to the true distance to correct the offset. The FTM offset is the same for all the mmWave devices and is constant over time.

Sub-6 GHz CSI.
The sub-6 GHz oscillator introduces a phase uncertainty at the four RF chains, which we have to remove to obtain accurate AoA at the AP side. We connect the four AP transmit ports to the corresponding four receive ports of the client using identical cables [48] to ensure that the transmitted signals arrive at the same time. The CSI values thus contain the constant phase offsets that we use for the phase correction. Unfortunately, this calibration has to be done per device and for each power cycle.

Sub-6 GHz
ToF. Finally, the sub-6 GHz FTM measurements have an offset which we determine and correct by taking outdoor measurements at known distances. The sub-6 GHz FTM calibration is also device-dependent, but is constant over time.

EXPERIMENTAL EVALUATION
We run an extensive measurement campaign to test the localization accuracy of MultiLoc in several scenarios and compare it with different baseline location systems. We also analyze the performance of the key components of MultiLoc ToF, azimuth and elevation angles as a function of the rotation of the client. At each measurement point we collect CSI and FTM for both sub-6 GHz and 60 GHz using the devices shown in Fig. 3. The mmWave antennas are highly directional and the device orientation significantly impacts localization performance. To emulate antennas with different orientations, as client we use two MikroTik wAP 60G devices mounted back-to-back on a rotation table model PTU-D47. This table allows for rotations of up to 200 • , and thus covering 360 • requires two devices. We then measure 4 different rotations at 45 • steps and let each client connect to each AP in turn, for a total of 8 client orientations. This allows us to emulate clients with different numbers of mmWave sub-arrays. Having 8 arrays on the client ensures that it can reliably cover the whole azimuth. Note that systems with 8 arrays are already commercially available [44]. 1 Currently, only the highly directional MikroTik devices are FTMcapable, but for a client with a more omnidirectional antenna array such as the TP-Link Talon AD7200 router, only one array would be needed. We take 300 CSI measurements and 10 FTM measurements per rotation and AP. For sub-6 GHz we use 2 different routers, one to capture the CSI and a second one to capture the ToF.

Scenarios
We deploy MultiLoc in four different scenarios in order to comprehensively evaluate its performance indoors as well as outdoors, and for LOS and NLOS settings.
Indoor scenario: This scenario has a size of 15x20 m and contains six rooms, one corridor, and up to five APs as shown in Fig. 7(a). We collect measurements in 110 different positions. For a deployment of five mmWave APs that we label with the number of the rooms, at most one AP is in LOS for each measurement position, even though some rooms are covered by more than one AP: for instance, the bottom-left corner of room 2 is covered by AP 2 and 7 (shown with red and green patterns, respectively). In this scenario, we have ubiquitous mmWave coverage even in rooms without AP. Our goal is to validate the robustness of MultiLoc against unreliable localization estimates that come from NLOS APs. The second scenario shown in Fig. 7(b) uses the same indoor environment but with a more sparse deployment of only two APs that ensure at least sub-6 GHz coverage everywhere (sub-6 GHz coverage is not shown in the figures). In general, we observe a surprising degree of NLOS mmWave coverage even through walls. We also evaluate realistic cases where mmWave coverage is not available and MultiLoc needs to meet localization requirements using sub-6 GHz information.
Office scenario: We then test MultiLoc in a more crowded indoor office environment shown in Fig. 7(c), where people are working at their desks or move around. This environment contains a central open area with smaller offices and conference rooms on either side. It has a size of 25x12 m and is covered by 3 APs. We collect measurements in 31 different locations, including the open area, a conference room (room 1) and two offices (2 and 3). The central area is covered by 2 APs, but walls, pillars and other obstacles create obstructed LOS at some of the points. Moreover, one AP provides coverage in the conference room and also provides obstructed LOS to some points in the central area through a glass wall. This allows to evaluate how MultiLoc deals with partially and fully obstructed LOS settings and environment dynamics.
Outdoor scenario: This scenario comprises 4 APs and it is depicted in Fig. 7(d). It has a size of 18x21 m. In general, the APs have a clear LOS but trees and pillars may cause NLOS in certain areas. This scenario represents the benign conditions under which baseline location systems are usually tested, with the majority of the APs having LOS and good channel quality, and unreliable location estimates coming from spurious NLOS can easily be filtered out.
Indoor/Outdoor scenario: In more complex deployments such as a campus or multi-building office premises, devices may move between indoor and outdoor settings. This makes accurate localization particularly challenging since indoor APs provide partial coverage at close by outdoor locations, and vice versa. Therefore, in Fig. 7(e) we explore a hybrid scenario of size 25x18 m with an indoor and an outdoor AP. We collect measurements at 20 points (blue dots), half of them indoors and half outdoors.

Comparison with other systems
We compare MultiLoc against the following benchmarks: • Spotfi [18] is a well-known sub-6 GHz location system based on AoA, which is estimated together with the path delay by a 2D MU-SIC version using spatial smoothing. It merges information from multiple APs to obtain the user location.
• High frequency baseline (HF baseline): To the best of our knowledge, the only other mmWave location system [17] that is based on angle and distance estimates ToF from Received Signal Strength Indicator (RSSI), which is highly inaccurate. comparison, we use the ToF from our mmWave FTM and the AoA obtained by MUltiple SIgnal Classification (MUSIC) [38] as improved 60 GHz baseline.
• Multiband baseline (MB baseline): The only multi-band system in the literature [23] fuses 60 GHz ToF information and AoA from sub-6 GHz extracted with MUSIC to localize targets. To replicate this system, we combine the mmWave FTM-ranging taken from the MikroTik and the AoA obtained with MUSIC from the ASUS AC2900 sub-6 GHz CSI.
Both the HF and MB baselines were designed for a single APs. Averaging information from all (including unreliable) APs degrades performance. For a fair comparison, we thus apply to these baselines the same AP and array selection strategies as for MultiLoc, and we verify that this indeed improves their performance.

Rotation analysis
In order to expand on the intuitions of Section 2, we perform an extensive rotation analysis of the client. Fig. 7(a) shows the coverage map for that scenario. We have divided the analysis of the indoor scenario in two separate sets to better explain the challenges to overcome, i.e., one set with positions and rotations where one of the APs is in LOS, and one set with the positions and rotations where no AP is in LOS for azimuth and elevation angles and ToF ranging. As explained in Section 2, mmWave is very susceptible to antenna misalignment when the client array is not directly facing the AP. Therefore, we quantify the estimation error according to array orientation, where the geometrical oracle indicates the array that is most closely aligned with the direct line between AP and client, and the misalignment in degrees indicates by how much the other orientations deviate from that direct line. Fig. 8 shows the empirical CDF for all the cases. In particular, subfigures (a) and (d) show the results for azimuth in LOS and NLOS, respectively, (b) and (e) show elevation results for LOS and NLOS and (c) and (f) show ToF results in LOS and NLOS. The figures include all estimates from all APs, not just the ones that would be chosen by MultiLoc.
From Fig. 8(a) with azimuth error for indoor LOS, we observe that if we choose the optimal rotation, there is less than 2.75 • of angle estimation error for 90% of the cases. The next best rotation is 180 • with an error of less than 33 • for 90% of the cases since it receives the direct path via the backplane and estimates a good angle with the sign changed. (However, 45 • has a better median error of 1.8 • .) The worst estimates are obtained when the antenna arrays are perpendicular to each other, i.e., ±90 • . The default beam patterns of the MikroTik devices favor pointing to the right side of the device, which can be seen also for the two rotations of ±45 • . As a comparison, results for sub-6 GHz have less than 10 • of error for 90% of the cases. It is also noticeable that the azimuth errors for the oracle rotation jump from less than 5 • to more than 120 • , which is due to the spatial ambiguity as it may select the incorrect azimuth angle. MultiLoc resolves this ambiguity using sub-6 GHz information and obtain a maximum error of 6.04 • . The LOS elevation errors are depicted in Fig. 8(b). As for the azimuth case, the oracle orientation provides the most accurate elevation estimates as the errors are below 5 • for the 90% of the cases. We also observe a jump from 5 • to 10 • due to the influence of a first order reflection path that bounces off the floor of the room. This is an extremely challenging case since this path has a similar azimuth angle but a slightly different elevation angle than the direct path. Therefore, the MultiLoc AoA estimator might not discriminate these two paths and estimates only one path with a correct azimuth but with a slight elevation error. The other orientations behave similarly without an excessive degradation in the elevation errors, which implies that MultiLoc estimates either the elevation from the direct path or from the path that reflects off the floor. Unfortunately, sub-6GHz estimates the azimuth only due to the geometry of the antenna array, therefore elevation cannot be extracted. Fig. 8(c) shows the estimated ToF ranging error for LOS. The oracle rotation has an error of less than 0.21 m, and even for the deviations of ±45 • we obtain less than 1.2 m of error for 90% of the cases. The worst case here is for 180 • , as it always captures a very long reflected path. In comparison, sub-6 GHz has less than 2 m error for 90% of the cases. We next summarize the NLOS case. In Fig. 8(d) are depicted the NLOS azimuth errors, we see that the azimuth estimated for mmWave is affected by huge errors for all rotations, while sub-6 GHz always performs better and reports less than 23 • of error for 90% of the cases.The NLOS elevation errors are found in Fig. 8(e). It is noticeable that all the rotations perform at the same level achieving an elevation error of 7 • for the 90% of the cases. Finally, we show in Fig. 8(f) the estimated distance error for the NLOS case. mmWave still yields better results than sub-6 GHz for 75% of the cases, with a median error of 0.4 m for the oracle orientation. Although the corridor has only one 60 GHz AP in LOS, all of the other NLOS APs still provide coverage to some parts of it. Next to the doors to the rooms, for example the door in room number 1, the coverage mainly comes from reflections, but the top part of the corridor also has coverage from AP 2 via obstructed LOS directly through the wall.
For brevity we omit the figures for the rest of the scenarios and we summarize the results for the outdoor one. Different from the indoor scenario, there is no significant NLOS. We observe less than 3.1 • of azimuth error for 90% of the cases. Here, the two offsets of ±45 • perform better than 180 • as there are no close walls that can reflect that signal. Once more, the two offsets ±90 • perform worst. With sub-6 GHz we get less than a 7 • error for 90% of the cases. Regarding the elevation angle, all the errors are below 4 • for the oracle orientation since the path that reflects off the ground is considerably weaker than in the indoor scenario as the ground of the outdoor scenario is grass. Hence the interference that this path adds to the estimation of the direct path is almost negligible. As for the distance, the oracle rotation has less than 0.55 m of error for all the points, followed by offset −45 • with an error of less than 0.42 m for 90% of the cases. For sub-6 GHz we obtain a maximum error of 4.8 m for all the points.
In summary, mmWave performance is excellent under ideal conditions but degrades even for small changes in device orientation. The sub-6 GHz system has less attenuation when traversing obstacles and walls and the omnidirectional antennas are insensitive to rotation, but it is less accurate.

Location results
MultiLoc overcomes the limitations of standalone mmWave systems by identifying when mmWave estimates are accurate and when they are not. We now analyze the joint location accuracy for clients with 1, 2, 4 and 8 mmWave antenna arrays. For the case of fewer than 8 arrays, we report the location errors per measurement point for each of the (8, 4 and 2) possible rotations. We compare MultiLoc and its stand-alone subsystems, i.e., the mmWave module (HF MultiLoc) and the sub-6 GHz module (LF MultiLoc), to the baselines described in Section 5.2. Due to limited space, we only show in the empirical CDF of the performance for the 8 arrays and 1 array cases. While in the figures we report the location accuracy for a 2D system, the elevation angle allows to also compute the 3D coordinates of the client, and in the text we also report the accuracy of the 3D version of MultiLoc.
5.4.1 Indoor scenario with 5 APs. Fig. 7(a) shows the scenario with 5 multi-band APs, located in rooms 1, 2, 4 and 6 and in corridor 7. In this dense deployment, NLOS propagation happens only in rooms 3 and 5, where we collect 14 measurement points. Results can be found in Fig. 9(a) for the cases of 8 and 1 arrays and in Fig. 11 for all the cases. For the 8 arrays case, MultiLoc, its HF component and the HF baseline exhibit a median error of 13 cm that grows up to 45 cm for the MB baseline because of the lower accuracy of the sub-6 GHz AoA. Moreover, while the maximum error achieved by MultiLoc is as low as 0.5 m, it grows to 5 m for the HF baseline that can not cope with spatial ambiguity. Regarding the sub-6 GHz results, LF MultiLoc achieves a median error of 1 m whereas Spotfi obtains 2.8 m: this indicates that weighting the APs by their distance considerably improves the performance. We emphasize that for the 1 array case, MultiLoc correctly selects either 60 GHz or sub-6 GHz, while the MB baseline, HF MultiLoc and HF baseline perform poorly with median errors of 1.9 m, 3.15 m and 3.7 m. With few arrays, MultiLoc and the MB baseline perform better than mmWave-only systems since the sub-6 GHz information is less dependent on the rotation of the user. Interestingly, the accuracy for the sub-6 GHz system is lower in the corridor where multipath is more significant. In general, mmWave sees much less multipath due to the narrow antenna beams and the higher signal attenuation, which leads to higher accuracy. We also observe that the median error remains stable between 8 and 4 arrays (13 cm) and it slightly degrades for 2 arrays (23 cm), but for 1 array, there is a significant increase in the median error to 65 cm. This indicates that a 2 arrays setting is an appropriate trade-off between accuracy and cost. Finally, even tough there are pure NLOS areas (rooms 3 and 5), MultiLoc is able to achieve an error of less than 0.5 m in all cases. For 3D MultiLoc, the median error slightly degrades from 13 cm (2D) to 19 cm (3D) for the 8 array case. However, MultiLoc accuracy for the bottom 10% of the cases degrades more significantly from 50 cm (2D) to 2.5 m (3D). This is caused by the influence of the ground reflection on the elevation angle estimation as explained in Section 5.3. Instead of 8, when the array size is changed to 4, 2 and 1 arrays, the median errors of 3D MultiLoc increase to 18 cm, 37 cm and 71 cm, respectively.

5.4.2
Indoor scenario with 2 APs. This scenario mimics a sparse deployment where only the large rooms contain 60 GHz APs, whereas the other rooms are covered by sub-6 GHz APs, as shown in Fig. 7(b). We measure the same 110 points as in the 5 APs scenario, with the difference that there is only mmWave LOS in rooms 1 and 2, and obstructed LOS in the corridor, whereas the rest of the rooms have NLOS coverage from sub-6 GHz.
We summarize results in Fig. 9(b). For the 8 arrays case, the median errors are 16 cm for MultiLoc, HF MultiLoc and the HF baseline while they are 21 cm, 53 cm, 1.25 m and 3 m for 3D MultiLoc, MB baseline, LF MultiLoc and Spotfi. We note that mmWave-only systems do not work in many positions: almost 20% of the points are without 60GHz coverage. Here, MultiLoc provides reasonable accuracy thanks to sub-6 GHz with a maximum error of 4.5 m. It is worth highlighting that Spotfi gets poor accuracy for the bottom 20% of the cases with errors above 6 m, which indicates that it also suffers from the lack of APs. Regarding results with 1 array, MultiLoc achieves one meter median error while the others perform poorly achieving results that are worse than Spotfi. Impressively, with 4 and 8 antenna arrays, MultiLoc is able to find a direct path in all the LOS rooms and even in some parts of the corridor where there is through-wall coverage from APs 1 and 2. Overall, MultiLoc takes advantage of mmWave in (obstructed) and in LOS areas and sub-6 GHz in NLOS, reducing the median error by a factor of 5.8 between MultiLoc and a mmWave-only system.     Figure 11: Location accuracy for different systems and antenna array configurations in the indoor scenario.

Office scenario.
The previous scenarios are devoid of obstacles, and an entire room either had good LOS coverage by one AP, or had no LOS coverage at all. We now study a more realistic scenario Fig. 7(c), with more complex obstructed LOS cases from several APs. For instance, the central area contains obstacles that block the direct path at some points and it also has obstructed coverage by the AP in the conference room (room 1). The results of this scenario are shown in Fig. 9(c). For the 8 array case, MultiLoc is the most accurate one achieving a median error of 18 cm while 3D MultiLoc, HF MultiLoc and HF and MB baselines achieve 35 cm, 31 cm, 31 cm and 60 cm, respectively. Although the scenario is much richer in multipath components than the previous one, the median error does not degrade which implies that the mmWave directional links make localization more robust to reflections from surrounding objects. However, the maximum errors are higher, up to 5 m, due to the difficult conditions for the points in the corridor and in rooms 2 and 3. The corridor has mmWave coverage via first order reflection from a wall (black wall in Fig. 7(c)), which makes mmWave localization unreliable. The measurement points in rooms 2 and 3 also have mmWave coverage via reflections since the walls of the rooms obstruct the LOS path. For all these points, MultiLoc filters the unreliable mmWave locations and uses sub-6GHz information. As a result, the MultiLoc errors are below 5 m while HF MultiLoc, HF and MB baselines get errors above 15 m. Interestingly, the yellow point exhibits accurate mmWave localization since one AP in the central area provides partially obstructed LOS mmWave coverage. Regarding the 1 array case, MultiLoc provides sub-meter median accuracy (90 cm) while 3D MultiLoc, HF MultiLoc and HF and MB baselines have median errors of 1 m, 2.5 m, 5 m and 3.3 m, respectively. Concerning the sub-6GHz-only systems, the LF MultiLoc outperforms Spotfi, as expected, with a median error of 1.2 m compared to 2.5 m.

Outdoor scenario.
The outdoor scenario has fewer reflections than the indoor one since walls are much further away. For most of the cases we either have a direct path or a very large reflection, except when there is a tree in the middle. This leads to an improvement compared to the indoor scenario, with the median error decreasing to 10 cm as depicted in Fig. 10(a). For sub-6 GHz, also LF MultiLoc and Spotfi achieve better performance with errors of 90 cm and 1.5 m. Every time the mmWave system sees a reflection, MultiLoc is able to correctly identify it and fall back to sub-6 GHz. For 1 array, MultiLoc's errors are below 4 m while the other mmWave approaches have errors above 15 m. Here, 3D MultiLoc achieves a median error of 20 cm and a maximum error of 40 cm, since MultiLoc estimates more accurately the elevation angle as the reflections from the grass-covered ground are weaker.

Indoor/Outdoor scenario
The last scenario contains two APs, one indoors and one outdoors. In this case, selecting the correct AP is critical to avoid large location errors. We show results in Fig. 10(b). Regarding the 8 array case, both MultiLoc and HF MultiLoc exhibit a median error of 17 cm while 3D MultiLoc and the HF and multiband baselines obtain 25 cm, 30 cm and 55 cm, respectively. Again, LF MultiLoc achieves better performance than Spotfi. For the 1 array setting, MultiLoc is the only system achieving a submeter median error (75 cm). Interestingly, there are a few points where MultiLoc selects the outdoor AP when the client is inside and vice versa: this happens when the direct path crosses a window (we depict windows in cyan in Fig. 7(e)). In these cases we observe similar positioning accuracies as with LOS conditions. This indicates that in buildings with glass walls, the positioning accuracy of outdoor clients can be as good as indoor ones. We also note that the accuracy of LF MultiLoc is slightly worse in indoor conditions due to the rich multipath environment, while mmWave for both, indoor and outdoor, produces similar accuracy due to multipath sparsity.

RELATED WORK
Location systems at different frequencies have attracted a lot of interest, as we summarize next.
• Sub-6GHz: Localization using sub-6GHz channels has been extensively studied over the past two decades. In the early 2000s, the first localization systems were using RSSI to estimate distance [4,6,51,52]. However, due to the unpredictable effects of the environment on the RSSI, overall accuracy was limited. Huge improvements were demonstrated with the arrival of IEEE 802.11n enabling new approaches for AoA and ToF estimation [10,18,35,39,43,49,50]. In 2016, IEEE introduced FTM ranging protocol for WiFi, which was thoroughly evaluated both in indoor and outdoor environments [14,16]. More recently, [33] presented a sub-6 GHz location system with sub-meter accuracy in NLOS settings.
• mmWave: Localization with such high frequencies is appealing due to the high spatial and temporal resolution. The first mmWave location system [42] estimated the position of the target directly using RSSI. This approach was later extended to RSSI fingerprinting [13,29] and was also combined with AoA measurements [17]. AoA and Angle difference of Arrival (AdoA) techniques were also evaluated in [5,20,31] and were shown to achieve good performance. In addition, mmWave localization can be used to drive handover decisions [30]. Different from these angle based systems, which multiple APs per room, MultiLoc works with just one. Similar to MultiLoc, the ToF-based localization system in [21,22] achieve outstanding accuracy but they were implemented on an experimental platform. MultiLoc, instead, is implemented on COTS devices, which makes its deployment more straightforward. We would like to highlight that MultiLoc is the first system implemented on COTS devices that enables estimation of AoA and ToF. Finally, also passive mmWave localization was investigated in [8,45,46].
• Multiband: To the best of our knowledge, the only multiband location system other than MultiLoc is reported in [23]. That system, however, merges sub-6 GHz AoA and 60 GHz ranging to estimate the position of the target device. MultiLoc, instead, combines complete position estimates from the two bands to improve localization performance. For this reason, MultiLoc is much more robust since it continues to work when 60 GHz is not available and can filter unreliable mmWave estimates. Multi-connectivity systems combine sub-6 GHz and mmWave bands for other purposes, e.g., to reduce mmWave beam training overhead using sub-6 GHz information. It was demonstrated that there is a strong correlation between high and low frequency bands [24], which enables the design of sub-6 GHz assisted mmWave beam steering mechanism. The authors of [11] show how to improve mmWave beam search using sub-6 GHz information, simulating a sub-6 GHz antenna with 4 elements and a 32-element mmWave antenna. A similar approach is taken in [36] which focuses on sub-6 GHz assisted mmWave beam steering and link maintenance. The authors experimentally demonstrate how to use sub-6 GHz ToF and an external gyroscope to estimate the position of the AP. In [2], the spatial correlation matrix is transformed from sub-6 GHz to 60 GHz in order to reduce mmWave training overhead. Such transformation can also be determined using deep-learning techniques [3]. Testbeds are essential for mmWave experimentation. OpenMili [53] and X60 platform [37] are both FPGA-based 60 GHz testbeds with custom antenna arrays. M-Cube [54] reverse engineers the control path of COTS 60 GHz RF frontends to build mmWave multiarray and MIMO systems with up to 8 antenna arrays. The MI-MORPH platform [19] is an open source FPGA-based multiband system that supports real time operation. Several efforts exist to instrument COTS devices for mmWave experimentation. The first work in this direction is [40] which extracts signal strength of received frames from a 60 GHz TP-Link Talon AD7200 to directly determine angle information from only a few beam training packets and thus reduce beam-training overhead. For the same COTS devices, it is even possible to extract the CSI to then design custom beam patterns that maximize the signal-to-noise ratio [32]. From a practical perspective, such COTS testbeds are highly important since they can be deployed easily and at the same time show the constraints of realistic consumer hardware. Besides localization, they can be an important platform for research on wireless sensing, imaging, mapping and backscatter. We note that while extracting the CSI from the aforementioned Talon routers is possible, the Talon's physical shape of the antenna array makes AoA estimation more difficult and less accurate, since the antenna elements are not uniformly distributed as in the MikroTik we use here.

CONCLUSIONS
In this paper, we demonstrated that the accuracy of stand-alone mmWave location systems highly depends on the antenna array orientation. To address this problem, we introduced MultiLoc, a dual band location system which uses sub-6 GHz technology to i) decide which of the mmWave APs and which of the available antenna arrays to choose when localizing a target and to ii) directly determine the position of the client when the mmWave location estimate is unreliable. We carried out an extensive measurement campaign for both bands to evaluate MultiLoc. The results show that our system is the first to achieve 18 cm median location error with off-the-shelf devices in complex indoor environments. To inspire future research on mmWave and multi-band localization, we publicly released the location system and the CSI and FTM extraction tools, as well as the datasets of our measurement campaigns.