Coded Backscattering Communication with LTE Pilots as Ambient Signal
Abstract
The 3GPP has recently conducted a study on the Ambient Internet of Things (AIoT), with a particular emphasis on examining backscatter communications as one of the primary techniques under consideration. Previous investigations into Ambient Backscatter Communications (AmBC) within the long term evolution (LTE) downlink have shown that it is feasible to utilize the user equipment channel estimator as a receiver for demodulating frequency shift keyed (FSK) messages transmitted by the backscatter devices. In practical deployment scenarios, the backscattered link often experiences a low signal-to-noise ratio, leading to subpar bit error rate (BER) performance in the case of uncoded transmissions. In this paper, we propose the adoption of the same convolutional coding methodology for backscatter links that is already employed for LTE downlink control signals. This approach facilitates the reuse of identical demodulation functions at the modem for both control signals and backscattered AIoT messages. To assess the performance of the proposed scheme, we conducted experiments utilizing real LTE downlink signals generated by a mobile operator within an office environment. When compared to uncoded FSK, convolutional channel coding delivers a notable gain of approximately 6 dB at a BER of . Consequently, the AmBC system demonstrates a high level of reliability, achieving a BER of at a Signal-to-Noise Ratio (SNR) of 5 dB.
Index Terms:
Ambient Backscatter Communications, LTE Cell Specific Reference Signals, Channel Estimation, Convolutional codingI Introduction
The Ambient Internet of Things (AIoT) [1] presents a demand for communication solutions tailored to Zero Energy Devices (ZEDs). AIoT relies on harvesting environmental energy to meet its power requirements. The 6G flagship project Hexa-X II [2], in continuity of Hexa-X-I [3], is committed to designing such zero-energy communication solutions in general, and to developing and trialing on the field one particularly promising technique called Ambient Backscatter Communication (AmBC) [4]. In the AmBC approach, backscatter devices (BDs) do not generate their own signals; instead, they rely on ambient radio frequency (RF) signals such as television broadcast and cellular signals for illumination. Information in AmBC is conveyed through modulation of the propagation channel, as BDs either reflect or absorb ambient RF signals.
The primary advantage of utilizing backscatter communications in AIoT resides in its exceptional energy efficiency. When compared to active transmitters, backscatter devices demonstrate a remarkable reduction in energy consumption, approximately 1000 times less, as discussed in [5]. This substantial reduction in energy consumption lays the foundation for the deployment of ZED, which can operate without batteries. Such devices have valuable practical applications, including asset tracking [6] and proximity-based localization [7].
A significant challenge in AmBC is dealing with direct path interference (DPI) caused by the higher power of the direct path signal compared to the scattered signal. Another challenge, especially in the case of ambient cellular signals, is the intermittent and bursty nature of the signals.
In long term evolutio(LTE) downlink, the receiver at the user equipment (UE) first synchronizes with the Base Station (BS, a.k.a eNB) using primary and secondary synchronization signals (PSS and SSS) and then employs the downlink Cell-Specific Reference Signals (CRS) to estimate the channel [8]. In [9, 10], an in-band ambient Frequency Shift Keying (FSK) backscatter communication system was proposed for LTE downlink, leveraging the UE receiver for demodulating the backscatter-generated FSK modulated messages. There reason for FSK modulation scheme is that FSK is a better modulation scheme than BPSK in AmBC [11].
The LTE channel estimator is engineered to withstand significant Doppler shifts, typically encountered in high-mobility scenarios. However, it’s essential to emphasize that in the majority of indoor and pedestrian deployments, the Doppler shift remains considerably below the maximum threshold. The proposed in-band LTE backscatter system effectively harnesses this excess bandwidth to facilitate backscatter communication. The BD employs FSK to introduce an artificial Doppler shift, which is larger than the natural Doppler within the channel yet smaller than the maximum Doppler tolerated by the channel estimator. This strategic choice enables the receiver to discern BD-modulated messages from the natural multi-path components in the Doppler frequency domain, thereby resolving the DPI issue. Additionally, CRS symbols are transmitted with fixed and often boosted power, even during cell idle periods, enabling the receiver to independently demodulate BD messages without dependence on LTE downlink traffic.
In prior studies concerning in-band LTE backscatter systems, the primary emphasis has been on uncoded modulation as the predominant operational mode for the BD. Empirical measurements [12] have unveiled that the system’s bit-error rate performance is poor in many practical scenarios. In response to this challenge, the integration of forward error correction (FEC) coding within the BD is proposed in this paper. To optimize the utilization of existing receiver components within the UE, the adoption of the same convolutional code for BD messages as is conventionally employed for downlink control messages is recommended. We validate the proposed system with over the air measurements by using ambient signal from commercial BS and processing the BD signal as it would be if an LTE UE would be the BD signal reader.
The rest of paper is organized as follows: Sec. II discusses AmBC model and how BD signal is visible on UE side. Then, Sec. III outlines the AmBC receiver signal processing flows. Next, Sec. IV shows the experiment measurements under commercial LTE BS. Finally, Sec. V draws conclusions of this study.
II System model
The top-level of in-band LTE backscattering based AmBC system consists three parts, BS, UE and BD. BS continuously boardcasts LTE downlink pilots. Those ubiquitous continuous pilots enlighten BD. UE always estimates the channel base on pilot CRS signals. BD modulates the channel blindly, without know any ambient information. Once UE is close to BD, it can recognize the channel changes. In this way, information is sent from BD to UE.
As Fig. 4 illustrates. BS sends CRS to UE. BD reflects or absorbs the incident RF ambient signal, toggles states with different frequency and generates artificial Doppler frequencies. Those channel changes are picked up by UE, i.e. UE as AmBC receiver demodulates BD information based on the channel estimates.
II-A Channel Model
In the context of the LTE system, the variables and represent samples corresponding to transmitted and received LTE signals. The complex channel from the BS to the UE is denoted as . We note that the AmBC system operates independently of the LTE system. Specifically, BD is not synchronized with LTE nor it is aware of the downlink transmissions. Within the framework of AmBC, the backscatter link comprises two distinct components: the channel from the BS to the BD, denoted as , and the channel from the BD to the UE, represented by .
The ambient backscatter signal model is as [13, Eq. 2.11]
(1) |
where corresponds to off or on state for BD at sample time and is either 0 or 1, relates to scattered signal power strength from BD, and is i.i.d. additive white Gaussian noise. Limited by the hardware design, BD flips between two states, reflecting incident signal or absorbing incident signal. Therefore in such a system, a FSK is approximated by square-wave FSK.
The channel estimation in UE recognizes the changes in propagation environment. According to LTE specification [8], channel is estimated base on CRS. Those channel estimates include the artificial Doppler caused by BD square wave FSK. BD generates square wave FSK by toggling on and off states in two different speed. The LTE -th OFDM symbol estimates channel as [10]
(2) |
Study [10] shows a method that the AmBC receiver extracts channel change from pilot channel estimates.
III Backscatter receiver
The AmBC receiver efficiently repurposes the LTE Rx channel estimation, convolutional coding algorithm, and cyclic redundancy check (CRC). These components are intentionally designed with identical parameters to minimize receiver cost allowing the existing software components in the modem to be reused. The block diagram of the proposed backscatter receiver is illustrated in Fig. 1. The frame packet structure is organized as Fig. 2. In this section, we explain the FSK demodulator and convolutional decoder in more details.

III-A Symbol and frame synchronization
As previously discussed, the BD operates without synchronization to LTE transmissions. To enable the receiver to detect the start of the BD frame, a synchronization header is employed. The frame incorporates a synchronization header comprising three 7-bit Barker codes and 306 convolutional coded data bits, as illustrated in Fig. 2. The complete packet comprises a total of 327 symbols. The synchronization preamble is comprised of three sequences of 7-bit Barker code. Specifically, two standard 7-bit Barker code sequences, denoted as ’1110010’, are concatenated with an inverted 7-bit Barker code sequence, ’0001101’, effectively anchoring the header of a frame. Our measurements confirm that the sidelobe auto-correlation of these three 7-bit Barker codes is sufficiently low for effective synchronization.
Barker code synchronization is crucial because it serves as both the reference for the starting symbol of a frame and the reference for the starting sample of FSK symbols. The starting sample is determined by locating the peak of the auto-correlation between the received signal and the synchronization preamble. The header remains continuously synchronized within a frame packet time window. If there were any sample shifting in header synchronization, FSK demodulation would introduce high noise levels. The synchronization process involves a collaborative effort between Barker code synchronization and FSK demodulation, as depicted in Fig. 1 with the circular arrow. The sequence diagram for the synchronization loop software threads can be found in [14, Fig. 2], and the synchronization code is available as open source on GitHub [15].

III-B Square-wave FSK
We desing FSK to have higher frequency than natural Doppler frequency of a slow moving user. The square-wave FSK is demodulated by noncoherent detector after a low pass filter. This low pass filter removes the natural Doppler effect and frequency offset due to the clock drifting between transmitter and receiver. There are upper bound of FSK symbol frequency, Nyquist frequency. Each FSK symbol is oversampled by channel estimation speed. We select FSK frequencies to be less than 1 kHz, since in LTE the channel is estimated with 4 kHz, the pilots occur about every 250 s. However the pilots are inserted slightly non-uniformly [8] and therefore there is 1 kHz harmonic [10]. Hereby, the FSK frequency constraints to a narrow band, about several hundreds Hertz.
The noncoherent detection corresponds power detector of the channel estimates. After obtaining symbol synchronization, the FSK demodulation receiver correlates the oversampled symbol sequence on several different lags. The maximum correlation peak provides us the start time of the frame.
Limited by the narrow FSK band, bit rate of AmBC is low, 25 bit/s in this case. This data rate is selected because detector needs longer symbol length for oversampling, to collect enough energy for symbol decision.
III-C Channel coding and CRC
Due to the absence of a buffer in this software implementation, the total frame length cannot be extended significantly. Each frame transmitted by the BD contains only an 80-bit information sequence. Additionally, a 16-bit CRC (CRC-CCITT) code is appended to the end of the information data to facilitate error bit detection and correction.
The CRC-CCITT cyclic generator polynomial, denoted as , is expressed as follows:
(3) |
This polynomial operates within the finite field in binary notation[16]. The CRC tail is generated based on the remainder of the information bit sequence divided by the hexadecimal number 0x11021. For a more detailed description of the CRC generator, please refer to [17].
Within the LTE technical specification, there exist four types of cyclic generator polynomials employed to generate parity bits: CRC-8-WCDMA, CRC-CCITT, CRC-24-Radix-64, and CRC-24-WCDMA [16]. Given that AmBC is susceptible to the effects of multipath fading, errors occurring over several consecutive symbols, often referred to as burst errors, are common. The 8-bit CRC, while effective, can detect only 98.44% of all error bursts with a length of 8 bits, which is deemed too short for handling the data packet in this context. On the other hand, the 24-bit CRC is overly long for this data packet, resulting in a reduction in effective information baud. In light of these considerations, the 16-bit CRC-CCITT emerges as an optimal choice, as it effectively detects 99.997% of error bursts with a length greater than 17 bits and captures all error bursts with a length of fewer than 16 bits, striking a perfect trade-off [17]. On the AmBC receiver side, received symbols undergo CRC checking after convolutional soft-decision Viterbi decoding.
There are many channel coding candidates, such as LDPC, Turbo, and polar coding. LTE specifies convolutional code for control channel and turbo code for data channels. Our practical backscattering implementation has a short 80-bit data packet. For such a short code convolutional coding outperforms other coding options, as demonstrated in [18, 19, 20]. LTE control channel uses a tail-biting convolutional code with a 1/3 coding rate and a constraint length of 7 [16]. This straightforward convolutional structure is easy to implement in a low cost BD device.

In Fig. 3, the encoder takes an information data stream as input, denoted as , and produces output streams at digital clock sample time , represented as , , and . The output stream at sample time is
This code generator is optimized, reaching upper bound free distance for coding rate , =15 [21, Tab. 8.3-2]. After channel coding, the encoded bits is three times than bit number of information sequence and 16-bit CRC, padding with 6 zeros tail. Considering 21-bit synchronization header, the number of symbol in one frame reaches to 327 symbol in total, which spends about 13 seconds for only one frame.
For convolutional decoder, the soft-decision Viterbi decode algorithm is applied. However, convolutional coding is optimal under BPSK or QPSK. In this implementation we use FSK and that deteriorates the BER performance.
IV Experimental results
To evaluate the feasibility of the proposed system, an experiment was conducted using real commercial LTE downlink signals within the indoor environment of the second floor of the Aalto University TUAS building in Espoo, Finland. Fig. 4 illustrates the wireless LTE downlink measurement setup. Tab. I presents some essential parameters related to the BS, BD, and UE. The experiment uses a commercial BS, providing a reference signal received power (RSRP) of approximately -70 dBm at the measurement location. The distance between the BD and UE is half a meter.
The BD operates create its packets without any knowledge of the LTE downlink signals. The BD was a Rasperry Pi connected to a diode based backscatter module. The generated frame was 13.08 s. Each frame was followed by half a second sleep after which BD restarts transmission. This half-second silence serves the purpose of separating two consecutive frames, allowing the receiver to synchronize with the next frame using its synchronization header.
On the reader end, the UE equipment is emulated as a software-defined radio (SDR) with computer and B210 USRP frontend from National Instrument. This emulated UE synchronizes with the commercial LTE downlink, performs channel estimation, and subsequently transmits the channel estimates to a laptop via the User Datagram Protocol (UDP).
To counteract clock drifting in B210 the frame length is deliberately kept short, and synchronization occurs frequently. This approach helps prevent the accumulation of clock errors, ensuring that symbols can be demodulated accurately within their correct symbol duration. Although there are many good channel coding for long packet, but that clock drifting prevents to design long packet.
The received channel estimates are post processed in MATLAB program, which serves as the AmBC receiver module depicted in Fig. 1.
It’s worth noting that, in comparison to mass-produced UE transceiver RF front-ends, the USRP is equipped with a 12-bit analog-to-digital converter (ADC) and is not using automatic gain control (AGC). To achieve an optimal balance between the dynamic range, quantization error, and signal clipping, the gain settings are selected by hand.
Parameter | Value | |
---|---|---|
BS | Commercial BS | LTE downlink |
Carrier frequency | 806MHz | |
Bandwidth | 7.68 MHz | |
BD | Micro controller | Raspberry Pi nano |
Antenna | RaTLSnake M6 telescopic antenna | |
Symbol duration | 40 ms | |
Synchronization | three 7-bit Braker code | |
Encoding | Convolutional coder, R=1/3 | |
Modulation scheme | FSK, Hz and Hz | |
Sync header | Three 7-bit Barker code | |
UE | Device | NI USRP-B210 |
Antenna | RaTLSnake M6 telescopic antenna | |
AD converter | 12 bits |

The measuements we done by keeping measurement setup in Fig. 4 in location. The measurement campaign was carried out during two days. During that time the channel varies due to users movement in surrounding. During the campaign we collected 6050 packets. For each packet we recorded the signal-to-noise ratio (SNR) and amount of errors. In BER computation we split the SNR into 0.25 dB intervals. The final bit error rate (BER) is computed over all the packets that are in the same interval Fig. 5.
In Fig. 5 we give also uncoded and convolutional coded FSK theoretical performance curves. The theoretical noncoherent FSK BER is [21, Eq. 4.5-46]
(4) |
where energy per bit and is noise power density. The convolutional coding reference curve is evaluated by Monte Carlo simulation. For a convolutional code we can estimate a coding gain as
(5) |
For the used convolutional code and BPSK modulation the coding gain upper bound is 6.99 dB [21, Tab. 8.6-1]. In Fig. 5 the coding gain at BER is about 6.28 dB.
At high SNR the measured results align well with the theoretical curve. At low SNR the measured performance is better than theory predicts. This discrepancy is explained by synchronization failure at low SNR. In our measurements we ignored packets that we could not synchronize to. That biased the measurements. Conversely, at high end of SNR the outliers are due to the lack of measured packet samples in this area.
The measurement results demonstrate that AmBC is viable even under a 5 dB SNR, achieving a BER of less than . This represents a gain of at least 6 dB when compared to uncoded alone. Furthermore, the implemented AmBC receiver takes advantage of LTE UE receiver. It reuses the UE existing modules such as channel estimation, convolutional channel decoder, and CRC.

V Conclusions
In this paper, we have integrated convolutional channel coding and CRC into an AmBC system that relies on LTE downlink pilots. Our experiments conducted in a real commercial LTE environment validate the feasibility of AmBC with the proposed receiver. The introduction of convolutional channel coding has led to a noteworthy 6 dB improvement in BER performance, particularly at a challenging SNR of 5 dB. The results consistently show that this AmBC system can achieve a BER of at least under the specified 5 dB SNR conditions, which are relevant for a BD and UE separation distance of half a meter. In summary, our research suggests the potential applicability of our AmBC solution in the context of 6G ZED communication, representing a notable advancement in the field.
VI Acknowledgements
This work is in part supported by the European Project Hexa-X II under (grant 101095759) and Business Finland Project eMTC (Dnro 8028/31/2022).
References
- [1] 3GPP, “Study on ambient IoT (Internet of Things) in RAN (Release 18),” 3rd Generation Partnership Project (3GPP), Technical Specification Group Radio Access Network TR 38.848 V18.0.0, 2023, release 18. [Online]. Available: https://www.3gpp.org/ftp/specs/archive/38_series/38.848
- [2] “Hexa-x ii deliverable D5.2 characteristics and classification of 6G device classes,” 2023. [Online]. Available: https://hexa-x-ii.eu/wp-content/uploads/2023/11/Hexa-X-II_D5.2_final.pdf
- [3] D. Sabella et al., “Innovation management in 6G research: the case of Hexa-X project,” IEEE Communications Magazine, 2023.
- [4] V. Liu, A. Parks, V. Talla, S. Gollakota, D. Wetherall, and J. R. Smith, “Ambient backscatter: Wireless communication out of thin air,” ACM SIGCOMM computer communication review, vol. 43, no. 4, pp. 39–50, 2013.
- [5] V. Talla, M. Hessar, B. Kellogg, A. Najafi, J. R. Smith, and S. Gollakota, “Lora backscatter: Enabling the vision of ubiquitous connectivity,” Proceedings of the ACM on interactive, mobile, wearable and ubiquitous technologies, vol. 1, no. 3, pp. 1–24, 2017.
- [6] D.-T. Phan-Huy, D. Barthel, P. Ratajczak, R. Fara, M. di Renzo, and J. de Rosny, “Ambient backscatter communications in mobile networks: Crowd-detectable zero-energy-devices,” in 2021 IEEE International Conference on RFID Technology and Applications (RFID-TA). IEEE, 2021, pp. 81–84.
- [7] S. Yang, Y. Bénédic, D.-T. Phan Huy, J.-M. Gorce, and G. Villemaud, “Indoor localization of smartphones thanks to zero-energy-devices beacons,” in 18th European Conference on Antennas and Propagation (EuCAP), 2024.
- [8] Technical Specification Group Radio Access Network, “Physical channels and modulation,” in Physical Channels and Modulation, Valbonne, France, Mar. 2023, no. V17.3.0, pp. 147–150,180–184.
- [9] K. Ruttik, X. Wang, J. Liao, R. Jäntti, and P.-H. Dinh-Thuy, “Ambient backscatter communications using lte cell specific reference signals,” in 2022 IEEE 12th International Conference on RFID Technology and Applications (RFID-TA), 2022, pp. 67–70.
- [10] J. Liao, X. Wang, K. Ruttik, R. Jäntti, and D.-T. Phan-Huy, “In-band ambient fsk backscatter communications leveraging lte cell-specific reference signals,” IEEE Journal of Radio Frequency Identification, vol. 7, pp. 267–277, 2023.
- [11] G. Vougioukas and A. Bletsas, “Switching frequency techniques for universal ambient backscatter networking,” IEEE Journal on Selected Areas in Communications, vol. 37, no. 2, pp. 464–477, 2019.
- [12] P. Ndiaye, D.-T. Phan-Huy, A. Hassan, J. Liao, X. Wang, K. Ruttik, and R. Jantti, “Zero-energy-device for 6g: First real-time backscatter communication thanks to the detection of pilots from an ambient commercial cellular network,” in 2023 2nd International Conference on 6G Networking (6GNet), 2023, pp. 1–3.
- [13] J. K. Devineni, “Ambient backscatter communication systems: Design, signal detection and bit error rate analysis,” Ph.D. dissertation, Virginia Tech, 2021.
- [14] J. Liao, K. Ruttik, R. Jäntti, and D.-T. Phan-Huy, “Demo: Ue assisted ambient iot in lte downlink, in real-time and open source,” in Proceedings of the 21st Annual International Conference on Mobile Systems, Applications and Services, ser. MobiSys ’23. New York, NY, USA: Association for Computing Machinery, 2023, p. 588–589. [Online]. Available: https://doi.org/10.1145/3581791.3597285
- [15] K. Ruttik, “LTE RX state machine,” https://github.com/Aalto5G/CellularAmBC/blob/main/CPP/Nodes/LTE_RX_StateMachine.cpp, Dec. 2023.
- [16] 3rd Generation Partnership Project (3GPP), “Multiplexing and channel coding,” Evolved Universal Terrestrial Radio Access (E-UTRA), Technical Specification TS 36.212, Sep. 2023, version 18.0.0.
- [17] S. B. Wicker, Error control systems for digital communication and storage. USA: Prentice-Hall, Inc., 1994, ch. 5.3 Shortened Cyclic Codes and CRC Error Detection, pp. 121–127.
- [18] B. Tahir, S. Schwarz, and M. Rupp, “Ber comparison between convolutional, turbo, ldpc, and polar codes,” in 2017 24th International Conference on Telecommunications (ICT), 2017, pp. 1–7.
- [19] L. Gaudio, T. Ninacs, T. Jerkovits, and G. Liva, “On the performance of short tail-biting convolutional codes for ultra-reliable communications,” in SCC 2017; 11th International ITG Conference on Systems, Communications and Coding, 2017, pp. 1–6.
- [20] O. Iscan, D. Lentner, and W. Xu, “A comparison of channel coding schemes for 5g short message transmission,” in 2016 IEEE Globecom Workshops (GC Wkshps), 2016, pp. 1–6.
- [21] P. Massoud Salehi and J. Proakis, Digital Communications. McGraw-Hill Education, 2007.