Vehicle and UAV Detection and Tracking with LTE Downlink Reference Signals: A Ray-Traced Evaluation on a Mapped Suburban Site with Licensed Base-Station Records

PREPRINT

1

Vehicle and UAV Detection and Tracking with LTE Downlink Reference Signals: A Ray-Traced Evaluation on a Mapped Suburban Site with Licensed Base-Station Records

arXiv:2611.01459v1 [cs.NI] 1 Nov 2026

Arun K. Gurung, Senior Member, IEEE, and Satha K. Sathananthan

Abstract—Passive sensing on the cellular downlink places the receiver at the user equipment and changes nothing in the network. We report simulation results for an LTE band3 cell-specific reference signal arm on a ray-traced channel. On a synthetic street canyon the arm is compared with an uplink sounding reference signal arm on the same band, target and scorer: missed-detection probabilities of 0.667 ± 0.021 and 0.772 ± 0.024. On a surveyed site built from OpenStreetMap footprints and the licensed site record, nine receiver positions along the street track the vehicle at coverage between 29.9 % and 61.7 %; a 283 m lap separates target height from trajectory at 1.6 to 30 m; a 137 m lap on the built-up street tracks a vehicle and a 15 m airborne target on every cell, and 8 receivers at 135 m spacing carry one illuminator’s coverage over 1140 m of the street. Potential future work includes extending the analysis to multiple illuminators and varying receiver configurations, and confirmation through over-the-air measurements. Index Terms—Passive radar, integrated sensing and communication, LTE, cell-specific reference signal, bistatic sensing, target tracking, UAV detection, receiver siting.

I. I NTRODUCTION A passive cellular sensing receiver observes a target through the echo of a signal transmitted for communication. In the downlink configuration studied here it sits at the userequipment end of the link, which requires no change at the base station. On the uplink it sits at the base station, which is where the processing, the calibration and the timing reference already are. Results for the two are usually reported separately, on different bands, scenes and scorers. The receiving node, the reference signal, the bandwidth and the association gate then vary together, and a difference between two published numbers cannot be attributed to any one of them. This paper reports the two arms on one band, one scene, one trajectory and one scorer, so that the remaining differences are enumerated. Contributions. (i) A matched-band downlink and uplink passive sensing comparison on LTE band 3, scored by one scorer at one association gate, with every unequalised item enumerated in Section IV. (ii) Detection reported in the 3GPP sensing quantities alongside the in-house tracking quantities, A. K. Gurung is with Krasara Pty Ltd, Australia (e-mail: arun.gurung@krasara.com.au). S. K. Sathananthan is with Nexvis Pty Ltd, Australia (e-mail: satha@nexvis.com.au). Manuscript revised 2026-11-01.

TABLE I ACRONYMS . ACMA CFAR CPI CRS eNB EIRP FAP2 FDD GOSPA IDF1, IDSW ISAC LOS LTE MDP NIS O-RAN OSM PCI PRB PD RCS RMSE SCS SRS UAV UE VDOP

Australian Communications and Media Authority constant false-alarm rate (OS: ordered-statistic) coherent processing interval cell-specific reference signal (LTE downlink) evolved Node B, the LTE base station equivalent isotropically radiated power type-2 false-alarm probability frequency-division duplex generalized optimal sub-pattern assignment metric identification F1 score; identity switches integrated sensing and communication line of sight Long-Term Evolution (4G cellular) missed-detection probability normalised innovation squared Open Radio Access Network OpenStreetMap physical cell identity physical resource block probability of detection radar cross-section root-mean-square error subcarrier spacing sounding reference signal (LTE uplink) unmanned aerial vehicle user equipment vertical dilution of precision

with the mapping between them stated in Section V. (iii) A null discipline in which every arm is reported against a targetabsent replay of its own scene and against displaced-truth nulls, so that a coverage figure is read against the coverage the same pipeline reports for a displaced truth. (iv) The downlink arm carried to a surveyed site built from public building footprints and the national licence record (Section VIII): receiver siting, trajectory length, target height from a ground vehicle to a 30 m airborne target, and a lap on the built-up street itself, each with the same nulls. (v) One illuminator’s coverage extended along 1140 m of the street by a chain of receivers run one at a time and assembled by time ordering (Section IX). (vi) The cells licensed at the site catalogued as further illuminators for one receiver, with their geometric dilution and one pair measured (Section X). Table I lists the acronyms used; the metrics are defined in Section V. Scope. The uplink arm is a baseline for the downlink arm. The channel is simulated. Each scene carries one target. The

PREPRINT

2

comparison of Sections IV–VII-B is between two receiving geometries at one operating point. II. R ELATED WORK AND 3GPP CONTEXT Integrated sensing and communication is a 3GPP study item, and the service requirements and use cases for it are set out in [1]. The two reference signals used here are standardised: the LTE cell-specific reference signal in [2], which is transmitted continuously on the downlink and requires no scheduling, and the sounding reference signal in [2], which is transmitted by the user equipment on the uplink. The channel is a ray-traced trace of the scene geometry, computed with an open-source differentiable ray tracer [3], [4]; the array element patterns follow [5]. Passive sensing on broadcast downlink signals and on uplink sounding signals are both established lines. Passive radar on the LTE downlink is reviewed in [6]; the 10 ms frame periodicity of the cell-specific reference signal and the interframe ambiguity it produces, together with its suppression by per-symbol normalisation of the reference, are analysed in [7]. The closest experimental comparisons are LTE passive bistatic detection of ground-moving targets over the air [8], a multistatic LTE system for UAV detection that proposes a dedicated localisation reference signal rather than the unmodified cellspecific one used here [9], and two recent experimental studies of passive UAV tracking on cellular downlink signals, one with a digital array measuring range, Doppler and angle of arrival [10] and one reconstructing a drone trajectory from Doppler at three passive receivers [11], with a follow-on bistatic study [12]. Table II places this paper beside them on the dimensions a reader needs to compare results: every comparison work measures a real channel over the air, and this paper does not; this paper reports controls with a known answer and a scoring convention held across every table, which the comparison works, as published, do not report. The uplink arm descends from an end-to-end O-RAN testbed in which the 5G NR sounding reference signal is used unmodified as the sensing waveform, detections are tracked by an extended Kalman filter deployed as an xApp, and the elevation ambiguity of a single bistatic pair is resolved by a vertical receive array or a second transmitter, with an altitude error of about 1.8 m RMSE reported in simulation [13]. The downlink arm keeps that testbed’s ray-traced scene, tracker and null discipline and moves the receiver to the user equipment. What this paper adds is the matched comparison and the null discipline. Section X carries the second-transmitter route of [13] over to the downlink, where the additional transmitters are the co-channel cells already licensed at the site. Section V states which 3GPP sensing quantity each quantity reported here corresponds to. Two of them — the misseddetection probability and the false-alarm probability of the second kind — follow the 3GPP sensing agreements and are computed in the same association pass as the detection probability, so they cannot use a different gate from it. The track coverage, the coverage-to-null ratio and the identity quantities are in-house and have no 3GPP equivalent; they are defined in Section V.

Four words recur and are used in one sense throughout. An arm is one transmit–receive configuration scored end to end — here the LTE-CRS downlink and the LTE-SRS uplink. A lap is one traversal of a road segment by the target, the unit a coverage figure is computed over. A cell is one simulation run of one arm at one noise seed, the unit n counts. A null is a control run or re-score in which the quantity under test is removed — the target, the time order of the ground truth, or its position — and whose score is what the arm earns without the thing it claims to measure. III. S YSTEM MODEL The transmitter and the sensing receiver are at fixed, distinct positions separated by a baseline of length L. A point target at position p is observed through the path transmitter–target– receiver. Writing RT and RR for the transmitter–target and target–receiver ranges, the quantity the detector resolves in delay is the excess bistatic range ρ(p) = RT + RR − L,

(1)

which is zero on the baseline and constant on a prolate spheroid with the two nodes at its foci. A single transmitter– receiver pair therefore constrains the target to such a surface and does not by itself observe elevation; the scene’s target height is supplied as a prior. For a target moving with velocity v, the Doppler shift observed on that path is 1 1 dρ = v · (ûT + ûR ), (2) λ dt λ with λ the carrier wavelength, ûT and ûR the unit vectors from the target toward the transmitter and the receiver, and the time dependence exp(+j2πf t), so that a closing target has dρ/dt < 0 and fD > 0. The radial velocity reported by the detector and used by the association rule and the tracker is vr = −dρ/dt = λfD , positive for a closing target, and |vr | ≤ 2|v| for fixed nodes, with equality on the baseline extension. This is the bistatic radial-velocity convention adopted for the 3GPP 6G ISAC evaluations [14], where it is written 2|v| cos(θB /2) cos δ with θB the bistatic angle and δ the angle between the velocity and the bisector (the symbols α, β, γ are reserved below for the TR 38.901 orientation triple). Both (1) and (2) are invariant under exchanging the two nodes, so they take the same form on the downlink and the uplink arm; what the exchange does change is the angle the receiving array measures and the position of the second focus. fD = −

A. Coordinate and angle conventions Scene coordinates are a local east–north–up frame with its origin at the tile’s geodetic origin: x is east, y is north, z is up. Azimuth ϕ is measured counter-clockwise from +x and elevation from the horizontal plane, so a compass bearing ψ, measured clockwise from north, enters as ϕ = 90◦ − ψ. Licensed sector azimuths are quoted below as compass bearings and are converted by that relation. Array orientations are the bearing–downtilt–slant triple (α, β, γ) of the global-to-local rotation of 3GPP TR 38.901 §7.1.3 [5]; that document’s zenith angle is θ = 90◦ − el in the elevation used here.

PREPRINT

3

TABLE II T HIS PAPER BESIDE THE CLOSEST LTE PASSIVE - SENSING EXPERIMENTS . E NTRIES ARE TAKEN FROM THE CITED ABSTRACTS AND TEXTS ; “ N . R .” IS NOT REPORTED THERE . T HE COMPARISON WORKS MEASURE OVER THE AIR ; THIS PAPER IS SIMULATION ONLY. work

waveform used

[8]

LTE downlink, full measured, signal the air

[9]

LTE with a pro- measured posed localisation simulated reference signal LTE downlink measured, the air

[10]

[11]

this paper

LTE downlink

channel

receive array

synchronisation

clutter

tracking metrics

published controls

over two channels reference chan- ground vehicles, (reference, nel six scenarios surveillance) and multiple network UAV receivers

real, direct-path cancellation real

detection only

n.r.

localisation error

n.r.

over digital array

UAV

real

drone

real

range, Doppler, AoA, n.r. tracking error (metre level) Doppler, trajectory er- n.r. ror

direct path

measured, the air

over three single- direct path channel receivers LTE CRS only ray-traced, two 1 × 2 self-referenced (and SRS on the taps, direct path to the cell’s uplink arm) normalised direct path

targets

one surrogate rendered sphere; vehicle geometry only and 15 m airborne

PD , MDP, FAP2 , coverage, IDF1, IDSW, OSPA/GOSPA, RMSE, NIS

permutation null, decoy null, target-absent null, execution repeat, one convention

The sensing receiver is a two-element uniform linear array whose boresight is its broadside, so at α = 0 the broadside points east and the element axis lies north–south. A linear array observes the direction cosine along its own axis, so the angle it reports is a cone angle ψc about that axis, sin ψc = sin(ϕ − α) cos(el),

(3)

and that cone is symmetric about the axis: the two half-spaces give the same measurement and one linear array cannot resolve between them. Every reported bearing in this work is ψc and not a scene azimuth. Two distinct things follow, and Fig. 1 separates them. The array measures the signed component of the target direction along its own axis, d sin ψc , so the sign of ψc is a measured quantity wherever that component is large. What the single array cannot resolve is the front-back branch about the axis: the two half-spaces that share one value of ψc . The first is a convention to be checked, implemented as a single parameter in the tracker (DL_CONE_SIGN, one value per arm, applied where detections become track candidates and in the filter’s measurement model); the second is a geometric ambiguity no convention removes, and both branches can be seeded (the birth-branch policy of Section VIII-E). The sign of ψc is checked per arm against the ground-truth cone angle on the detections the scorer associates. The target is a single ground vehicle travelling at 10 km h−1 on a straight trajectory at a height of 1.6 m, modelled as a sphere of 1.5 m radius. The transmitter and the sensing receiver are both at fixed positions on either side of that trajectory. Channel. The channel is rendered offline by a differentiable ray tracer [3], [4] on that library’s bundled street-canyon example scene with the building meshes removed, leaving the ground plane, so every path is either line-of-sight or a ground reflection; the solver resolves up to six interactions with specular reflection enabled and diffraction and refraction disabled. Those solver settings are the renderer’s defaults and are not recorded in the trace metadata, which records the scene, the carrier, the bandwidth, the array geometry and the trajectory. Each arm replays its own render of the same scene

element axis

d sin ψc

(signed, measured) broadside

ψc

±5 ∘ of broadside: sign undetermined, excluded reported branch mirror branch (not resolved)

Fig. 1. What the two-element array measures. The signed along-axis component d sin ψc is measured, so the sign of the cone angle ψc about the element axis is a measured quantity away from broadside; the front-back branch about the axis is not resolved by one linear array. Detections within 5◦ of broadside, shaded, are excluded from the sign audit because the along-axis component passes through zero there.

geometry at its own carrier, one channel snapshot per coherent processing interval, so the channel is held fixed inside each dwell and the phase progression that a target moving within the dwell would impose on the burst sequence is not represented; the Doppler the detector measures is that of the snapshotto-snapshot range change. The vehicle is the only moving scatterer. IV. A RMS AND THEIR ALIGNMENT The following items are equalised between the two arms. Coherent dwell: 0.64 s on arm A and 0.64 s on arm B, matched to the channel trace’s snapshot period so that one dwell advances one snapshot. Declared false-alarm probability: 10−6 per resolution cell on both, with the measured rate quoted against each detector’s own evaluated-cell readback, each bounded by eleven target-absent replays (Section XI). Association gate: one range grid bin, 2.44 m, and one Doppler bin, 0.2541 m s−1 on arm A and 0.2679 m s−1 on arm B

PREPRINT

4

TABLE III T HE TWO ARMS . T HE BANDWIDTH DIFFERENCE IS STATED AND IS NOT EQUALISED .

direction reference signal band cell grid, 15 kHz SCS reference-signal span occupied BW receiver CPI receiver gain CFAR trim

Arm A

Arm B

downlink LTE CRS 3 (FDD) 100 PRB 100 PRB 18.00 MHz UE-side, passive 0.64 s peak-hold, frozen 1.7 dB

uplink LTE SRS 3 (FDD) 100 PRB 96 PRB 17.28 MHz eNB-side 0.64 s pinned 82 dB 1.7 dB

(λ/TCPI ), each read back from the arm’s own cells. The range grid bin is the 30.72 MHz sample spacing of 9.76 m interpolated 4 times by zero padding of the 8192-point transform, while the nominal range resolution set by the occupied pilot span of 17.94 MHz is c/B = 16.71 m, before the range taper (Hann) widens it. Track-to-truth gate: 20 m, identical for both arms and for every null. Seed count: n = 5 noise realisations per arm, drawn from the same set. Scorer: one program, one version, invoked identically. Receiving array element count: two on both arms. The following items are not equalised. Carrier. Band 3 is frequency-division duplex, so the downlink and uplink legs are at 1845 MHz and 1750 MHz, a 5.4 % difference. One emulated carrier serves one leg, so the two arms cannot share a cell and are run separately. Occupied bandwidth. The sounding reference signal occupies 96 of the cell’s 100 resource blocks, 17.28 MHz against the 18.00 MHz of arm A, a difference of 0.72 MHz. The detector’s range cell is set by its range-transform aperture rather than by the occupied span, and is 2.44 m on arm A and 2.44 m on arm B. Receiver gain treatment. Each arm is held at a fixed operating point for the duration of a run, and the two points are not the same number; both are stated in Table III. No absolute detection level is claimed from either arm. a) Coverage denominator: Coverage is scored over the run length. A first-light abort makes run length outcomedependent, so the two arms are equalised on CPI count before their coverages are compared, or the comparison is not made. b) False-alarm denominator: PFA is quoted against the detector’s own evaluated-cell readback; the map size is not used. The two arms do not evaluate the same number of cells per CPI and the ratio is stated. A. Processing chain Each arm’s receiver extracts the reference-signal resource elements of every burst it processes, forms a per-burst channel estimate on the pilot grid, and transforms it to delay with an 8192-point transform (a Hann taper over the declared span, 4-fold zero padding, so one grid bin is 2.44 m), after subtraction of the direct path and the static taps by an extensive-cancellation step of the stated rank and a clutter

filter. 64 consecutive bursts, one every 20 slots, are transformed to Doppler with a Hamming taper, giving one range– Doppler map per coherent interval with a velocity bin of 0.2539 m s−1 . An ordered-statistic CFAR at the declared falsealarm probability, with the threshold trim of Table III, selects candidates inside the direct-path mask and the range gate; the two receive channels give a cone angle about the array axis per candidate. Candidates are published as level-C records; the tracker (an extended Kalman filter in excess bistatic range, range rate and cone angle, with the target height as a prior) seeds a track on a candidate, confirms it after three associated updates, and publishes level-D records that the scorer reads. The scorer associates one reported object with one target inside one range grid bin and one Doppler bin, and scores coverage on confirmed tracks within a 20 m gate against the rendered truth. Every number quoted for this chain is read back from the cell that produced it. V. M ETRICS AND THEIR 3GPP CORRESPONDENCE The detection metrics in this paper are the evaluation quantities of the 3GPP sensing agreements. They are stated in full below, because two of the three depend on an association rule the specification leaves to the implementer. A. Metric and KPI definitions The metrics below are those of 3GPP TR 38.765 [15], clause 4.1, which defines the missed-detection probability and two false-alarm probabilities over simulation drops and requires a one-to-one association between detected objects and true targets without fixing the association method. They are restated here because the same words carry different meanings in the radar and the cellular literature. 1) Evaluation instance: An evaluation instance is one coherent processing interval of one drop, and it takes the place of the drop in the definitions of [15]: a drop with N intervals contributes N instances, and all metrics are accumulated over instances. For instance n, let Mn be the number of targets present and Dn the number of those targets not reported; let Mn′ be the number of objects reported and Dn′ the number of reported objects that are not associated with a target. An interval in which the target is occluded and no echo is rendered contributes to neither sum. 2) Detection metrics: The missed-detection probability is accumulated over instances with at least one target present, and the type-2 false-alarm probability over instances with at least one reported object: P P D′ Dn , FAP2 = P n n′ . (4) MDP = P n n Mn n Mn With one target per instance, Mn = 1, the first expression equals the report’s Pmd , a mean over drops of Dn /Mn . The second is a ratio of sums over instances, whereas the report’s Pf2 is the mean over instances with at least one reported object of Dn′ /Mn′ ; the two differ when the number of reported objects varies between instances, and the report’s form is given beside this one where it is quoted; on the round of Table V at most 1 object is reported per instance, so the two forms coincide

PREPRINT

5

there (arm A 0.5149 against 0.5194 over 206 instances). The report’s type-1 false-alarm probability, the fraction of targetabsent drops in which any object is reported, is the quantity the target-absent cells of this paper measure at the reported-object level (Section VI). Both are defined per sensing mode and reported with the association rule that produced them. Neither definition contains a detection threshold, so a constant-falsealarm-rate setting is part of the configuration being evaluated and not a property of the metric. 3) Probability of detection and its relation to the misseddetection probability: The radar literature, and the operational specifications a sensing product is procured against, state detection performance as a probability of detection at a stated false-alarm rate. The probability of detection used here is the fraction of observable intervals in which the target is reported and associated: 1 X 1[target associated in instance n] , (5) PD = Nobs n∈O

where O is the set of observable instances — those in which the target is present and an echo is rendered — and Nobs = |O|. With one target per instance, Mn = 1 for every n ∈ O, so (4) and (5) are the same measurement read in opposite directions: PD = 1 − MDP, (6) provided that every instance carries one target, that both figures use the same observable set O, and that both use the same association rule. The identity holds only under those three conditions. The denominator must be the observable instances the receiver actually produced, not the intervals present in the trajectory: a replay that yields fewer intervals than the trajectory holds inflates MDP and deflates PD by the same ratio. The association rule must be the one stated in Section V; a detection counted as a hit under a wider gate is a hit for PD and for MDP alike, and the two figures diverge whenever they are computed at different gates. Instances in which the target is unobservable — occluded, or inside the direct-path mask — must be excluded from both or included in both. 4) Association: Dn , Dn′ and the indicator in (5) are all functions of an association rule. A reported object is associated with a target when it is that target’s nearest neighbour in normalised range and radial velocity and lies inside a gate of one range grid bin (2.44 m on both arms) and one Doppler bin (λ/TCPI : 0.2541 m/s on arm A, 0.2679 m/s on arm B), one object to one target. The specification does not fix the rule; the gate is stated with every result, and for a fixed set of reports widening it moves MDP down and FAP2 down, since a report that becomes associated is no longer counted as false. 5) Accuracy: Accuracy is the 90th percentile of the absolute error over associated detections, reported per quantity. 6) Reporting levels: Measurements are reported at level C of [15], clause 5.1 (option C1), one record per interval, carrying excess delay, Doppler, angle, received power and a confidence value; objects are reported at level D (option D1), one record per associated object, carrying position, radial velocity and a confidence value. Level A raw-measurement

reporting is not emitted. The distinction matters for a passive receiver: level C is observable with a one-dimensional array, and level D position is observable only under the height prior of Section VII. 7) Target values: The target levels used as the comparison scale in Table V are the performance objectives of TR 38.765 [15], Table 4.2-1: missed-detection probability 5%, false-alarm probability 5% for both types, horizontal and vertical position accuracy 10 m and velocity accuracy 5 m/s, each at a 90% confidence level, which the report defines as the 90th percentile of the error distribution; they were adopted by RAN1 at its meeting 122bis [16] and are unbracketed in the approved report. The report adopts them for the UAV use case with gNB-based monostatic sensing at 4 or 4.9 GHz (its Table 6.2-1), so they are a reference scale for a downlink passive bistatic arm on a ground-vehicle scene, with no matched requirement; every comparison against them in this paper is labelled as such. The SA1 service KPIs for UAV intrusion detection, TR 22.837 [1] Table 7.2-1, differ (false alarm 2%, 10 m at 95% confidence) and are not used as the scale. B. In-house quantities Neither arm approaches the reference MDP or false-alarm level. VI. R ESULTS : DETECTION The reference target levels quoted in Table V are the performance objectives of [15], Table 4.2-1, adopted for the UAV use case with gNB-based monostatic sensing. They are used here as a reference scale for two passive bistatic arms on a ground-vehicle scene. Every figure below carries its target-absent null in the same sentence, on first use, and every PD carries the gate it was measured with, because the Doppler window of the gate is derived from the coherent interval. The two arms run at the fixed operating points stated in Table III; arm A’s unrepresentative receiver level is described in Section IV, and no absolute detection level in this paper rests on it. Figure 2 shows one coherent interval of each arm’s range– Doppler map beside its target-absent twin. At the target’s own cell the present maps stand +40.1 dB (arm A) and +48.4 dB (arm B) above their own map median, against +2.2 dB and -4.7 dB in the absent twins. On the marked Doppler row the peak lies at 39.0 m, within one 2.44 m grid bin of the truth, and stays within 3 dB of that peak over 19.5–56.1 m, which is wider than the resolution cell, so the figure establishes the target’s range at the peak and not the width of the response. The two arms run different receiver-gain treatments (Section IV), so each panel is read against its own null and not against the other arm’s level. Arm A (LTE-CRS, downlink, the UE receives) holds PD = 0.333 ± 0.021 over n = 5 seeds on 59 gated observation opportunities with a 2.44 m range cell. Arm B (LTE-SRS, uplink, the eNB receives) holds PD = 0.228 ± 0.024 over n = 5 seeds on 56 opportunities with a 2.44 m range cell.

PREPRINT

6

TABLE IV I N - HOUSE METRICS , THEIR DEFINITIONS , AND THEIR NEAREST 3GPP QUANTITY. ours

nearest 3GPP

difference to state

PD (moving)

detection probability, (5) missed-detection probability, (4) type-2 false-alarm probability, (4)

same definition; gated to the moving transit, gate stated

MDP FAP2

Pf1

type-1 falsealarm probability, TR 38.765 cl. 4.1

coverage

—

permutation null

—

margin

—

decoy null, margin

—

both nulls cleared

—

IDF1 [17]

—

IDSW

—

OSPA / GOSPA [18]

—

RMSE

positioning accuracy, TS 38.857 class —

NIS

1 − PD by construction (Section XI) the report takes a mean of perinstance ratios and this paper a ratio of sums; identical here because at most 1 object is reported per instance (Section VI) measured on the round’s target-absent cell at the reported-object level, per coherent interval rather than per drop fraction of truth frames with a matched track within the 20 m scorer gate; denominator is run length coverage re-scored against the same truth in permuted time order; what a track that follows the geometry rather than the target earns coverage less the arm’s own permutation null, in percentage points; 20 pp is the readability gate used here coverage against truth displaced 40 m per axis, worst of four; margin is coverage less that worst value, in pp coverage exceeds both the permutation null and the worst decoy; the scorer’s tracking flag identification F1: harmonic mean of identity precision and recall over truth frames, 1 when one track holds one identity for the whole transit identity switches: number of times the track identity assigned to the target changes multi-target distance, order p = 2, cut-off c = 20 m (the scorer gate), GOSPA α = 2; for a single target a cardinality check bistatic range error rather than position error normalised innovation squared of the tracker, median over updates; near its degrees of freedom when the filter’s covariance is consistent

PD is conditional on an echo being rendered: intervals in which the target is occluded or outside the gate contribute to neither the numerator nor the denominator, so the figure is a detection probability given visibility, and the number of gated observation opportunities beside each PD is the denominator that conditioning leaves. On these two arms the condition removes almost nothing: arm A processes 59.4

TABLE V D ETECTION METRICS AGAINST THE REFERENCE LEVELS OF [15], n = 5 SEEDS PER ARM , ASSOCIATION AT ONE RANGE GRID BIN AND ONE D OPPLER BIN ; THE TARGET COLUMN IS TR 38.765 TABLE 4.2-1 [15]. B OTH ARMS ARE ONE ROUND ON ONE DETECTOR BUILD , RUN BACK TO BACK , THE SAME ROUND AS TABLE VI; THE TARGET- ABSENT COLUMN IS A FALSE - ALARM CONTROL AND CARRIES NO PD (S ECTION VI).

PD MDP FAP2 Pf1 objects reported unassociated raw cand./CPI

target

arm A (CRS)

— 0.05 0.05 0.05 — — —

0.333 0.667 0.515 — 41 21 8.14

arm B (SRS)

A/B null

0.228 — 0.772 — 0.562 — — 0.0000 / 0.0000 29 — 16 — 5.78 0.00 / 0.00

coherent intervals per cell and presents 59.4 moving instances, a removed fraction of 0.00 %, and arm B 56.2 against 56.0, a removed fraction of 0.35 % with a worst cell at 1.75 %. The target-absent cell of each arm measures false alarms. The detector’s mean raw candidate count per coherent interval is 0.00 on arm A over 61 intervals and 0.00 on arm B over 67. The type-1 false-alarm probability of TR 38.765 cl. 4.1 is measured on the same cells at the reported-object level: arm A publishes 0 objects over 63 intervals and arm B 0 over 68, so Pf1 = 0.0000 and 0.0000 on one cell per arm, which bounds the estimate at the cell level. Below the object level the threshold is crossed in 2 of 63 intervals on arm A and 1 of 68 on arm B. The arm-to-arm difference is reported per round, paired by noise seed. In the round of Tables V and VI arm A’s PD exceeds arm B’s by +0.105 ± 0.012 on 5 of 5 seeds, and in an earlier round on the same build by +0.073 ± 0.015 on 5 of 5; both exceed the execution threshold of Section VII-B, so the detection-rate ordering holds on this build, and its attribution among the four unequalised items of Section IV is open. A. Reproduction with a second receiver implementation Arm A’s detection rate is a property of the waveform, the geometry and the detector configuration, or it is a property of one receiver implementation. To separate these, the same scene was run through an independent downlink cell-specific reference signal receiver, built on a different software radio stack, at the same coherent dwell, pilot count, burst rate, receiver level, transit window and detection threshold as arm A, and scored by the same scorer at the same gate. Over n = 5 noise realisations the second receiver reports a detection probability of 0.351 ± 0.143 against 0.333 ± 0.021 for the arm A cells run beside it; the two agree within their spreads. Its track coverage does not agree: under the confirmed-track convention it reads 4.0 ± 5.5 % against 78.3 ± 1.8 %, with 0 of 5 cells clearing both nulls, because its tracks do not reach the confirmed state inside the gate. The second receiver reproduces arm A’s detection rate and bounds the detector; it is a control and does not appear in the tables. VII. R ESULTS : TRACKING Coverage counts truth frames with a matched track and says nothing about how long any one track is held: an arm can

PREPRINT

7

Arm A, target absent

Arm B (LTE-SRS, uplink), target present

Arm B, target absent power [dB], one scale across panels

bistatic range rate [m s−1]

Arm A (LTE-CRS, downlink), target present 6

0 −10 −20 −30 −40 −50 −60 −70

4 2 0 −2 −4 −6 0

20

40

60

80

100 120 140 0

excess bistatic range RT+RR−L [m]

20

40

60

80

100 120 140 0

excess bistatic range RT+RR−L [m]

20

40

60

80

100 120 140 0

excess bistatic range RT+RR−L [m]

20

40

60

80

100 120 140

excess bistatic range RT+RR−L [m]

Fig. 2. Post-cancellation range–Doppler maps for both arms with the target present and with it absent, at one coherent interval (dump index 6), on one colour scale across all four panels. The circle is the target’s own cell, 37.66 m of excess bistatic range and +2.32 m/s of bistatic range rate from the recorded ground truth, drawn identically on the target-absent panels, whose render carries no echo.

TABLE VI T RACKING , BAND 3 VEHICLE , MATCHED SCORER . N ULL COLUMN IS THE TARGET- ABSENT ARM SCORED IDENTICALLY. Arm A

A null

Arm B

B null

coverage (%) permutation null (%) OSPA (m) GOSPA loc (m) IDF1 ID switches RMSE (m) NIS median CPIs

78.3 26.7 15.69 6.94 0.265 21 7.68 0.48 59

0.0 — 20.00 0.00 0.000 0 — — 61

73.0 29.7 15.18 7.24 0.383 8 8.61 0.49 56

0.0 — 20.00 0.00 0.000 0 — — 67

worst decoy (%) decoy margin (pp)

0.0 78.3

0.0 —

1.7 71.4

0.0 —

cover most of the transit through a succession of short tracks, which IDF1 and the identity-switch count of Table VI record and coverage does not. The two are reported together for that reason, and a coverage figure quoted alone is not a statement of sustained tracking. Measured on the same records, the same window and the same gate as coverage, the two arms separate on continuity. Arm A’s covered frames fall into 1.4 runs per cell, the longest of them 295 frames — 206.5 s and 90.1 m of the ground truth’s own path — and arm B’s into 2.0 runs with a longest run of 83.6 m. Coverage is held in one or two long runs per cell on both arms. A covered transit of 90.1 m held under one identifier for 74.1 m is what the IDF1 column of Table VI reports. A. Null gates for coverage An absent cell on this testbed has been credited coverage with zero detections, so a coverage figure is quoted here only beside two nulls, both scored by the same code on the same cells. • The permutation null re-scores each arm against a permuted ground-truth order. Arm A reaches 78.3 % against 26.7 %, arm B 73.0 % against 29.7 %. • The decoy null re-scores each arm against ground truth displaced 40 m along each axis in turn and keeps the worst. Arm A’s worst decoy is 0.0 %, arm B’s 1.7 %. The margin of coverage over the worst decoy, in percentage points, is reported with every coverage figure (arm A 78.3 pp,

arm B 71.4 pp); a cell whose coverage does not exceed both its permutation null and its worst decoy is not credited with tracking, which is the two-null rule of Table IV applied throughout, and the margin over the permutation null states by how much. The nulls are controls with a known answer, and the pass rule is a comparison against them with a 5 pp margin and is a pass rule, with no significance level attached. The coverage-to-decoy ratio of an earlier draft is not reported, since it is undefined where the worst decoy is zero (5 of arm A’s 5 cells). B. Run-to-run variance The noise seed does not define a reproducible experimental unit. The five seeds of arm B were re-executed in four further blocks on one build with the same configuration and the same input trace (checked by hash), 20 cells on an idle host: the execution standard deviation, pooled within seed, is 0.024 in PD , 3.6 pp in coverage and 0.098 in IDF1, against betweenseed standard deviations of 0.021, 3.0 pp and 0.087. The number of coherent intervals scored moves on identical inputs, 52 to 65 over 20 cells (43 in one cell that overlapped other work on the host), and it is the denominator of coverage and PD ; host contention is one cause and the emulator’s scheduling and acquisition time are not separated from it. Every ± in this paper is a between-cell standard deviation that contains execution variance, and an arm-to-arm difference below 0.02 of PD or 3.6 pp of coverage is not resolvable at the n reported here. VIII. A REAL SITE GEOMETRY: H IGH S T, R ESERVOIR The arms above run on a synthetic street canyon. This section repeats arm A on a surveyed Australian site. A. Scene and geometry The scene is built from OpenStreetMap building footprints for a 1900 m square centred on High St, Reservoir, Victoria, and rendered with the same ray tracer and the same two-tap channel as every other cell in this paper. The transmitter is a band-3 LTE eNB at (531.0, −747.1, 29.0) m; the passive receiver is a stationary UE at (287.3, −547.7, 1.5) m, giving a 316 m baseline. The target is a car on a straight 105 m section of Pender St, driven one way at 5.47 m s−1 (20 km h−1 )

PREPRINT

for 19.2 s, which the 0.64 s coherent interval samples as 27 intervals. Carrier 1845 MHz, bandwidth 20 MHz, as in Table III. Table VIII states the simulation conditions in full. Figure 3 shows the layout. The nearest building footprint is 178 m from the lap and 291 m from the 315 m receiver siting, so this geometry is open ground rather than a built-up street, and the clutter statements of Section XI are read in that light. The illuminator is licensed site 102006, whose record places it at the simulated transmitter position and height; its licensed carrier is 1812.5 MHz in 15 MHz, while the render uses 1845 MHz in 20 MHz: the geometry is taken from the licence record. Figure 3(b) and Table VII are read as a deployment statement. The 3 neighbours are licensed sites, not rendered transmitters: every result here uses one illuminator, because the emulated receiver does not hold synchronisation when more than one cell identity is present. In the field that restriction does not apply, and the route is per-identity extraction on a single recording. Cells on the same carrier arrive in the same samples, so one capture at one receiver yields one bistatic pair per co-channel cell, each with its own frame offset and its own delay origin, and the reference signals of five of every six neighbouring identities fall on a different subcarrier comb from the illuminator’s. Two of the table’s columns decide which neighbours can contribute at all. A neighbour is a usable pair only if it is co-channel with the illuminator and one of its sectors faces the receiver, and those two conditions do not follow distance: the nearest neighbour at 521 m is 51◦ off its best sector, the strongest is boresight-on but carries no co-channel component, and the only neighbour that is both co-channel and within 30◦ is the furthest at 1177 m. The illuminator itself is a three-sector site, and the arm reported here was rendered on the sector 19◦ off the receiver. The lap was sited so that no part of it falls inside the directpath mask: the excess bistatic range stays between 27.2 m and 69.6 m, clearing the 24.4 m mask throughout and leaving 15.4 m of margin against the 85 m range gate. The receiver array is a two-element isotropic pair; the transmitter array follows TR 38.901. Both sit at 0◦ boresight. B. Detection Detection on the site is reported at the same operating point as the synthetic scene. Each cell yields 8.1 moving detections over 27 coherent intervals at n = 15, with the delay origin resolved to the same range bin on every interval of every cell and the direct path standing 44.5 dB above the profile median. No observation falls inside the masked band. The 5 targetabsent cells, the same renders with the echo zeroed, return zero moving records. C. Tracking and null gates Coverage on this geometry is 48.1 % with a standard deviation of 14.2 % over n = 15 cells that differ only in noise seed. Read against the two-gate criterion of Section VII-A, 10 of 15 cells demonstrate tracking; those that do have coverage 55.4 %.

8

D. Trajectory length and target height The lap is extended to 283 m at 4.60 m s−1 and repeated with the target at 15 m and 30 m above ground over the same ground track, so target height is the only quantity that differs between the three arms. Figure 4 draws the three trajectories over the layout of Figure 3(a). The receiver is at the 315 m siting of Section VIII-E, raised to 10 m, and the range gate is 300 m; Table VIII notes every other difference from the 105 m round. Table IX reports each arm over cells that differ only in noise seed, with the detector’s range taper applied over the occupied subcarrier band rather than over the full transform grid; every other figure in this paper was measured with the full-grid taper, which on this lap gives detection rates of 0.315 ± 0.004 (n = 15), 0.394 ± 0.007 (n = 21) and 0.322 ± 0.007 (n = 20) for the same three arms, identity scores of 0.926, 0.690 and 0.738, and the same null. The occupied-band taper raises the detection rate by 62 % to 76 % on these arms; its false-alarm rate on target-absent cells is 6.6×10−6 per scanned cell against 2.0 × 10−6 with the full-grid taper. Detection and identity do not order the same way. The airborne arm at 15 m has the highest detection rate, 0.632 ± 0.006, and the lowest identity score, 0.761 ± 0.050; the ground arm detects least often, 0.551 ± 0.013, and holds one identity on 4 of 5 cells. The arm at 30 m sits between them on identity with fewer switches than the lower one. On this geometry the airborne arms exceed the ground arm in detection rate and fall below it in identity continuity. Figure 5 shows the final frame of the animation of one cell of the vehicle arm and of one cell with the airborne target at 15 m rendered at 0 dB re 1 m2 , the lowest rung of a 0, −10 and −20 dB re 1 m2 ladder at which the arm still tracks; the ladder’s detection rates are held in the repository record. E. Receiver siting Over the whole lap the target subtends 5.9◦ of azimuth at the reported receiver siting, so the measurement is close to rangeonly and a decoy displaced along a locus of constant bistatic range is close to indistinguishable from the target. Whether a receiver placed elsewhere on the kerbside line, where the lap subtends more, tracks better is the question this subsection measures. Nine positions along that line were run with the transmitter, the lap, the image and the operating point held fixed, at n = 15 noise seeds per position, on one detector build and one scoring convention, with one birth branch seeded (the policy question is returned to below). Table X gives the subtense, the coverage and the pass fraction at each position. Birth-branch policy. The relay forms a track seed from a detection’s range, range rate and cone angle; the cone is ambiguous about the array axis, so a seed can be placed on either of two mirror solutions, and seeding both doubles the seed count and the association load. The two policies were run at the two ends of the line only (table footnote). Seeding both lowers the mean coverage and widens its spread at both, and raises the pass fraction at 3.7◦ from 6 to 9 of 15, which is the one quantity a mirror seed can buy: on a road that lies on the far side of the array axis the single branch returns no track while the detections themselves are correct. The policy

PREPRINT

9

(a) bistatic geometry

−500

(b) licensed band-3 sites

400 200 0 −200 −400 −600 −800

−550 y (m)

−600 −650 −700

vehicle path, 105 m baseline, 267 m illuminator siting, all cells track siting, not all cells track siting, no cell sync

−750 −800

300

400 x (m)

licensed band-3 neighbour receiver, reference siting for distances S2 licensed sector azimuth, 62° wedge

S3

TX S1

500

0

500 x (m)

1000

Fig. 3. High St Reservoir layout, drawn from the scene’s own meshes, the rendered trace, and the ACMA band-3 licence records: (a) the bistatic geometry of the 105 m lap and every receiver siting tested, coloured by outcome; (b) the illuminator and the 3 nearest licensed band-3 sites with their sector azimuths. Direct-path levels in Table VII are free-space bounds at the licensed maximum EIRP, which is the right regime here because the two-ray break point is 3.3 km. TABLE VII L ICENSED BAND -3 SITES AT THE SCENE , FROM THE ACMA RECORD SUBSET (71 SECTOR - CARRIER RECORDS OVER 7 SITES ). TX IS THE SIMULATED ILLUMINATOR ; S1–S3 ARE THE NEAREST NEIGHBOURS , WITH DISTANCE MEASURED FROM THE 315 m RECEIVER SITING .

TX S1 S2 S3

site

d (m)

h (m)

carriers (MHz)

BW (MHz)

EIRPa (dBW)

Prx b (dBm)

AZc (deg)

∆ϕd (deg)

102006 303268 302246 152292

267 541 1153 1163

29.0 15.3 14.2 17.0

1812 1812–1858 (5) 1826–1858 (4) 1812

15 2.5, 12.5, 15 2.5, 12.5, 15 15

32.8 41.4 41.6 30.8

-23 -21 -27 -38

330 110 220 250

-16 -50 -1 -31

a Licensed maximum EIRP, not a measured transmit power. b Free-space direct-path level at the receiver at that EIRP, an upper bound; ground reflection adds

at most about 6 dB at these ranges. c The licensed sector azimuth, of that site’s several, whose boresight comes closest to the 315 m receiver siting. d The angle off that sector’s boresight. A sector pointed away is not a usable bistatic pair at any distance or EIRP: the nearest neighbour here is the worst-pointed, and the only co-channel neighbour within 30◦ is the furthest.

therefore follows from which side of the axis the road lies on, which is known once the siting is chosen. Siting and detection count. A geometric screen over 1112 candidate positions, applying the mask, range gate, Doppler knee, ambiguity bound and a two-way loss budget, returns 18 feasible sitings, every one limited by the same constraint: between 41.9 % and 48.4 % of the lap falls below the clutterfilter knee at this speed. None raises the usable fraction above the 58.1 % the reported siting already achieves. The knee is moved by the filter’s training length or the dwell; placement does not move it. F. Coverage of one transmitter–receiver pair A bistatic pair does not cover a disc around its receiver. Detectability is bounded by the excess bistatic range ∆ρ = Rtx +Rrx −L, so the covered region lies between two confocal ellipses with the transmitter and receiver at the foci: inside by the 24.4 m direct-path mask, outside by the 85 m range gate. Applying the detector’s gates on a 10 m grid over 36 target headings at 5.56 m s−1 gives, for the three receiver positions

that synchronise, covered areas of 4.49, 4.01 and 3.32 ha with target-to-receiver ranges spanning 15 m to 352 m. The area is set by the pair’s geometry; covering more ground requires more pairs. This construction states where detection is geometrically admissible; it does not predict how often the target is detected there. Checked against the five receiver positions whose outcomes are known, it marks 16 to 18 of the lap’s 31 coherent intervals geometrically usable at every one of them — both ends of the measured coverage range (29.9 % to 61.7 %). Geometry excludes positions and does not rank the usable ones; a coverage polygon drawn from geometry alone overstates what the system delivers.

G. Cost of establishing each reliability figure Four quantities have to be separated when a coverage claim is made for this class of system, and they are established at different cost.

PREPRINT

10

(a) bistatic geometry

y (m)

−700 −800

height [m]

−500 −600

(b) licensed band-3 sites

height over the track

30 20 10

0

100

200

along track [m] vehicle, 283 m, z=1.6 m UAV, z=15.0 m (same ground track) UAV, z=30.0 m (same ground track) baseline, 267 m illuminator siting, all cells track siting, not all cells track siting, no cell sync

300

400 500 x (m)

600

400 200 0 −200 −400 −600 −800

licensed band-3 neighbour receiver, reference siting for distances S2 licensed sector azimuth, 62° wedge

S3

TX S1

0

500 x (m)

1000

Fig. 4. The 283 m Pender St lap at target heights 1.6 m, 15 m and 30 m over one common ground track, with the heights inset: (a) the bistatic geometry, with the receiver-siting markers of the 105 m round (Section VIII-E), which are not re-evaluated on this lap; (b) the illuminator and the 3 nearest licensed band-3 sites with their sector azimuths. Direct-path levels and sector angles are those of Table VII.

Geometric admissibility. This costs seconds and is exact: a position either satisfies the mask, gate, Doppler knee and ambiguity bound or it does not. Detection probability. This requires cells. On this scene PD per coherent interval is 0.28 to 0.35 with the target-absent null at zero, and it varies by excess-range band rather than uniformly over the covered area. Tracking coverage. This requires both nulls of Section VII-A and 15 seeds per position to bound: across the nine sitings of Table X it spans 29.9 % to 61.7 % with per-position spreads of 8.6 % to 19.4 %, so two positions are separable only when the difference between them exceeds that spread, which no adjacent pair on the line does. Intervals. An interval on each requires n. Fifteen cells differing only in noise seed give a standard error of 1.7 pp on coverage; five cells gave a standard deviation of 16 pp and could not test the point prediction registered against them. Cells must also be scored over a matched window: an arm whose cells replayed the target path a different number of times reported a pass fraction of 4 of 15 where a matched window gives 2 of 15. What simulation cannot settle is the absolute level: clutter, co-channel interference, receiver clock and gain behaviour are the measurement’s alone. One field capture with the mast surveyed and the vehicle on GPS anchors the geometry end to end, by the criterion already registered — the detector’s reported range must track the GPS-derived excess bistatic range within one range grid bin (2.44 m) across a lap. H. A built-up section of High St Every lap above runs on Pender St, where the nearest building footprint is 178 m from the track. This subsection moves the lap onto High St itself, where the footprints line

both kerbs, and asks whether detection and tracking survive the change from open ground to a street canyon with the detector, the tracker, the scorer and the operating point held fixed. The illuminator is a different licensed site from the one that serves the Pender St laps (site S1 of Table VII, which is the nearer of the two to this section of High St): site 303268 at (−130.9, −828.0, 15.3) m, 17.6 m west of the street centreline, rendered on the sector that faces along the street; the receiver is a stationary UE at (−77.7, −578.0, 8.0) m on the same centreline, 255.7 m from the illuminator, with its array boresight across the street. The lap is 137 m of the centreline, which bears 7.7◦ , driven one way at no more than 3.5 m s−1 ; the vehicle arm places the target at 1.6 m and the airborne arm at 15 m over the same ground track. The carrier is the site’s licensed 1842.5 MHz rather than the 1845 MHz of the Pender St laps; on the Pender geometry that change moves coverage by −2.38 pp (t = −1.32), which is not separable from seed at n = 5 and is declared and left uncorrected. The coherent interval, range gate, Doppler gate and range taper are those of Table IX. Figure 6 draws the geometry. Table XI reports both arms over n = 5 cells differing only in noise seed, beside a reference arm that is the 315 m Pender St siting of Section VIII-E re-run on the same seeds with the occupied-band taper. The reference is re-run because the siting figures of Table X were measured with the full-grid taper, under which the same siting reads 54.84 % ± 5.45 %; pairing the canyon against that number would charge about 40 pp of taper to the geometry. All three arms are scored over one pass of the lap, cut at the first replay of the trajectory, because the driver’s own scoring window admits the replay and credits it. Tracking is demonstrated on both canyon arms on every cell: coverage exceeds its own permutation null by 44.00 pp ± 6.83 pp for the vehicle and 43.44 pp ± 2.09 pp for the airborne target, and exceeds the worst decoy by 35.5 pp to

PREPRINT

11

Fig. 5. Final frames of the animations of the 283 m lap, one cell each: top, the vehicle at 1.6 m; bottom, the airborne target at 15 m rendered at a mean bistatic RCS of 0 dB re 1 m2 (1.13 m sphere equivalent), smaller than the target of Table IX. Panels: the scene with ground truth, detections on both branches of the receive cone and the tracker output; the post-cancellation range–Doppler map of the last coherent interval with the direct-path mask and Doppler guard marked; the detected and tracked cone angle against ground truth per interval.

49.6 pp on the vehicle cells and 41.6 pp to 46.5 pp on the airborne cells. The permutation null and the identity switches share one geometric cause, which the layout measures directly. The lap subtends 0.7◦ of azimuth at the receiver against 14.6◦ at the reference siting, because the receiver stands on the street axis and the target runs almost directly away from it; the bistatic range rate is 1.998 times the ground speed on this trace, so the measurement is close to range-only. A 1 × 2 array has no azimuth leverage on a radial track, so any track placed along that radial covers the truth under the scorer’s gate, which is what a permutation null of 61 % to 67 % records, and the tracker cannot hold an identity across the detection gaps that a range-only measurement leaves. That attribution was tested by moving the receiver 15 m east of the centreline, onto the kerb line, which raises the subtense to 44.5◦ for −2.57 dB of echo and leaves the line of sight to every snapshot of the lap. Over n = 5 cells paired by seed with the centreline receiver, the identity switches halve, 9.6 ± 2.7 against 15.2 ± 4.0 per cell, lower on 5 of 5 pairs; the position error rises by 1.41 m on 5 of 5 pairs; and the identity score, 0.211 ± 0.076, the detection rate, 0.365 ± 0.065, the coverage, 77.78 % ± 13.67 %, and the margin over the permutation null, 39.64 pp ± 10.77 pp, do not separate from the centreline values at this n (the coverage spread carries

one cell at 53.8 %). On this lap subtense improves identity continuity and leaves identity score and detections within their spread; the chain of Section IX is built on the centreline. IX. C OVERAGE FROM INDEPENDENT RECEIVER SEGMENTS ALONG ONE KILOMETRE OF STREET

One receiver on the street axis covers a stretch bounded on the near side by the direct-path mask and on the far side by the range gate; on this geometry that stretch is 155 m, and it lies north of the receiver only, because the street runs nearly along the baseline and the southern side is the bistatic blind zone. Covering a longer length of street with one illuminator is therefore a question of how many receivers, at what spacing, and whether the pairs further from the illuminator still track. This section places 8 receivers along High St at 135 m spacing, from the receiver of Section VIII-H at y = −578 m to y = 367 m, and runs the vehicle and the airborne target past each. The 20 m overlap between adjacent stretches is chosen to exceed the distance the target covers while the tracker’s birth rule accumulates its first confirmations. The chain spans 1140 m of street from the first stretch’s start to the last stretch’s end. Each receiver is run as its own cell, with the target driven over that receiver’s stretch plus 20 m either side (195 m at 3.5 m s−1 ) on waypoints taken from one global parametrisation of the whole street, so every cell’s record carries global

PREPRINT

12

(a) bistatic geometry

−400

y (m)

−500 −250 S3 S2 −500 −750

−600 −700 height [m]

−800

height over the track 15 10

(b) licensed band-3 sites

−1000

−500 x (m)

licensed band-3 neighbour receiver, reference siting for distances

5 0

100

S1

TX

0

500

licensed sector azimuth, 62° wedge

along track [m]

−100 x (m) vehicle 1.6 m, 137 m, z=1.6 m

drone 15 m, z=15.0 m (same ground track) baseline, 256 m illuminator

0

siting, all cells track siting, not all cells track siting, no cell sync

Fig. 6. The 137 m High St lap with the receiver on the street centreline, from the scene’s meshes, the rendered trace and the ACMA licence records: (a) the bistatic geometry, with the building footprints that line both kerbs and the two target heights inset; (b) the illuminator 303268 and the three nearest licensed band-3 sites with their sector azimuths. The lap subtends 0.7◦ at the receiver.

time and position and the chain is assembled offline by time ordering alone. No detection or track is fused across receivers and no identity is carried over a handover; each receiver’s cell is replayed in isolation, so the chain is a set of independent local trials assembled on a common clock; simultaneous reception and continuous tracking across receivers are not demonstrated, and mutual interference between receivers, which a passive receiver does not create, and the sharedilluminator timing that simultaneous reception would require are not represented. Every receiver is screened on its rendered trace before a cell is run: all 8 hold line of sight to the target on every snapshot, the direct path falls to −10.57 dB relative to the first receiver at the eighth, and the echo-to-direct ratio is 7.3 dB to 7.8 dB better than the first receiver’s at every other one, because each lap begins 20 m before its own receiver rather than 150 m from it. Three target-absent cells are run per receiver. Figure 7 and Table XII report 5 noise seeds per receiver and target, 40 vehicle cells and 40 airborne cells over the 8 receivers. The vehicle’s coverage exceeds both of its nulls on 37 of those 40 cells and on every seed at 5 of the 8 receivers, with per-receiver means over the receiver’s own stretch between 44.2 % and 83.2 %, a length-weighted mean of 69.4 %, and a per-receiver standard deviation over seeds between 1.6 % and 30.4 %. The airborne target’s does so on

32 of 40 cells and on every seed at 4 receivers, with a lengthweighted mean of 68.3 %. Receivers 2,3,7,8 are the rows where the outcome is not the same on every seed: they pass on some seeds and fail the decoy or permutation null on others, so the standard deviation there spans two modes and is not a spread, and the coverage of the seeds that passed is 40.4 % to 84.7 % for the airborne target. Detection rate per receiver is 0.17 to 0.33 for the vehicle and 0.16 to 0.34 for the airborne target, at the registered ±1 range cell and ±1 Doppler bin gate. The eighth receiver, whose direct path is at the level at which the second illuminator of Section X-E failed, clears both nulls for both targets with full line of sight; that failure is therefore not attributable to the direct-path level alone. The target-absent cells cover between 0.0 % and 20.9 % of the truth with no detection on the target, 5 of 8 above 5 %, which is the gate-occupancy null of Section VII-A at a 300 m gate, and each coverage figure in the table is read against its own row’s value. None of the absent cells demonstrates tracking on any seed. The seed-to-seed spread is not uniform along the chain, and it separates two regimes. Where the vehicle clears both nulls on every seed, the standard deviation over seeds is 1.6 % to 7.7 % of coverage, so the per-receiver figure is reproducible at that receiver. At receivers 1,2,7 it does not clear them on every seed, and the standard deviation reaches 30.4 % because

PREPRINT

13

(a) one illuminator, 8 receivers along High St 100

#8 #7

200

80

#6

y (m)

0

60

#5 40

#4

−200

#3

−400

20

#2 0

#1

−600 −200 vehicle 1.6 m, mean coverage

0 x (m)

200

UAV 15 m, mean coverage

(b) level and coverage along the street 7.5

80

4/5

4/5

2.5

60

0.0

4/5

−2.5

40

−5.0

coverage / null [%]

level vs receiver #1 [dB]

target-absent coverage (tick length)

100

10.0 5.0

one-pass coverage over the receiver's own stretch, mean over the row's seeds [%]

400

20

−7.5 −10.0

second illuminator's level (-10.73 dB): no track, LOS 26 %

0 direct-path level vs #1 [dB] echo level vs #1 [dB]

200

400

600

800

distance north of receiver #1 along the street [m] coverage [%], mean over seeds

permutation null [%]

1000

0 cleared both nulls on k of n seeds

Fig. 7. One illuminator and 8 receivers along High St: (a) the chain over the building footprints, each receiver’s stretch drawn as two strips coloured by the mean one-pass coverage over seeds for the vehicle (left) and the airborne target (right), with the target-absent coverage as a tick whose length is its value; (b) direct-path and echo level relative to the first receiver, mean vehicle coverage with its standard deviation over seeds and the permutation null per stretch against distance north of the first receiver, rows that cleared both nulls on k of n seeds ringed, and the direct-path level of the failed second illuminator of Section X-E marked.

the row holds a mode that tracks and a mode that does not; the airborne rows behave the same way at receivers 2,3,7,8. The figure to read for those rows is the coverage of the seeds that cleared both nulls, 45.9 % to 83.3 % for the vehicle, with the pass fraction beside it in the table. The chain’s claim is the length of street over which the vehicle clears both nulls on every seed — 5 of 8 receivers — and the value in any single row is secondary to it. The intervals of Table XI do not transfer to these rows: the chain states where one illuminator’s coverage ends along the street; the reliability at any one receiver is given by that receiver’s own row.

A. Field bounds on the chain The simulated receiver is not noise-limited (Section XI), so the question a deployment asks — at which receiver along the street the echo falls into the noise — is answered from a link budget, since the cells do not reach the noise floor. Table XIII gives it per receiver: free-space direct path and echo from the licensed EIRP of 65.83 dBm, a point target of 10 dB re 1 m2 , unity receive gain, and a thermal floor of −92.42 dBm in 18 MHz at a 9 dB noise figure, with 41.07 dB of coherent gain, 10 log10 (200×64), from 200 reference resource elements per occasion coherently combined over 64 occasions, an upper bound that assumes a stationary echo over the interval and no loss from the taper. At the eighth receiver, 1209 m from the

PREPRINT

14

TABLE VIII S IMULATION CONDITIONS , H IGH S T R ESERVOIR . G EOMETRY AND WAYPOINTS ARE READ FROM THE RENDERED TRACE ’ S OWN METADATA ; DETECTOR SETTINGS ARE THOSE OF THE CRS ARM OF TABLE III.

TABLE X R ECEIVER SITING ALONG THE STREET, ONE BIRTH BRANCH , n = 15 SEEDS PER POSITION ON ONE BUILD AND ONE SCORING CONVENTION . C OVERAGE IS THE MEAN OVER SEEDS WITH ONE SAMPLE STANDARD DEVIATION ; PASS IS THE NUMBER OF CELLS CLEARING BOTH NULLS . T HE LAP ’ S ANGULAR SUBTENSE AT THE RECEIVER DOES NOT ORDER THE COVERAGE .

Scene source geometry buildings propagation

OpenStreetMap footprints, 1900 m square 451 building meshes, 7829 triangles extruded, not flattened Sionna RT, two static taps

Geometry transmitter (eNB) receiver (UE) baseline line of sight tx array rx array

(531.0, −747.1, 29.0) m (287.3, −547.7, 1.5) m 316 m unobstructed (mesh ray cast) 1 × 2 TR 38.901, 0◦ 1 × 2 isotropic, 0◦

Target path speed duration model mean RCS, path mean

straight, 105 m on Pender St 5.47 m s−1 (20 km h−1 ) 19.2 s, one way sphere, 1.5 m radius, at 1.6 m 18.45 dB re 1 m2

Both-branch policy, run at the two extreme sitings only: 3.7◦ reads 32.9 ± 26.2 % with 9/15 passing, and 121.8◦ reads 22.7 ± 25.0 % with 5/15. Coverage is lower in both and the spread is larger; the pass fraction at 3.7◦ is the one quantity the second branch improves.

Waveform and detector carrier / bandwidth reference signal burst stride / CPI coherent dwell range grid bin / velocity bin CFAR direct-path mask range gate velocity bound clutter knee

1845 MHz / 20 MHz LTE CRS, downlink 20 slots / 64 bursts 640 ms = ∆t 2.44 m / 0.2539 m s−1 OS, rank 0.75, 8192 FFT 24.4 m 85 m 7.6 m s−1 2.031 m s−1

TABLE XI T HE 137 m H IGH S T LAP AT TWO TARGET HEIGHTS BESIDE THE 315 m P ENDER S T SITING RE - RUN WITH THE SAME TAPER AND SEEDS , n = 5 CELLS DIFFERING ONLY IN NOISE SEED , ± ONE STANDARD DEVIATION , CELL SCORER AT A 20 m GATE OVER ONE PASS OF THE LAP. M ARGIN IS COVERAGE LESS THE ARM ’ S OWN PERMUTATION NULL ; DECOY MARGIN IS THE RANGE OF COVERAGE LESS THE WORST DECOY; NULL IS THE COVERAGE OF THE TARGET- ABSENT RE - RENDER .

Round cells per arm varied between cells

15 present, 5 absent noise seed only

TABLE IX T HE 283 m P ENDER S T LAP AT THREE TARGET HEIGHTS WITH THE RANGE TAPER OVER THE OCCUPIED BAND , CELL SCORER AT A 20 m GATE , CELLS DIFFERING ONLY IN NOISE SEED , ± ONE STANDARD ERROR OF THE MEAN . E ACH ARM ’ S TARGET- ABSENT RE - RENDER COVERS 0.00 %. z n [m]

PD

IDF1

vehicle 1.6 5 0.551 ± 0.013 0.900 ± 0.039 UAV 15 5 0.632 ± 0.006 0.761 ± 0.050 UAV 30 5 0.563 ± 0.014 0.796 ± 0.081

coverage (%)

pass

3.7 5.9 10.5 14.6 21.3 27.8 40.3 88.0 121.8

42.3 ± 19.1 48.1 ± 14.2 42.7 ± 11.3 46.1 ± 15.1 52.4 ± 8.6 61.7 ± 19.4 60.9 ± 11.6 29.9 ± 11.7 32.3 ± 14.1

6/15 10/15 6/15 13/15 14/15 14/15 14/15 9/15 5/15

High St vehicle

Section VIII-D reports arms that differ from this configuration in lap length (283 m), ground speed (4.60 m s−1 ), receiver position (the 315 m siting of Section VIII-E, at 10 m), range gate (300 m), target height and the range taper (occupied band).

target

subtense (deg)

IDSW 1.20 1.80 1.40

GOSPA [m] 6.28 ± 0.39 8.84 ± 1.08 6.50 ± 0.31

illuminator, the echo at the far end of the lap is −80.7 dBm, 52.8 dB above the floor after integration and 51.1 dB above the detector’s threshold trim; the direct path there is −33.6 dBm, 47 dB above the echo. Under these assumptions no receiver of the chain is bounded by the thermal floor, and the quantity that binds is the direct-path-to-echo ratio, which is the limit the simulated arm already operates at. The budget is free space with a point target and no multipath, building or clutter loss, and is a bound: a deployment will sit below it. Two further measurements bound how the chain can be joined. The 300 m range gate ends each receiver’s detections 4 m short of where the next receiver’s begin, so no truth

High St UAV

Pender St reference

target height [m] 1.6 15 1.6 lap subtense at RX [deg] 0.7 0.7 14.6 coverage [%] 85.36 ± 0.98 84.98 ± 1.57 85.02 ± 3.84 permutation null [%] 41.36 ± 6.90 41.54 ± 1.89 13.32 ± 0.70 margin [pp] 44.00 ± 6.83 43.44 ± 2.09 71.70 ± 3.41 decoy margin [pp] +35.5–+49.6 +41.6–+46.5 +66.7–+75.0 PD 0.381 ± 0.021 0.396 ± 0.006 0.521 ± 0.048 IDF1 0.175 ± 0.055 0.159 ± 0.027 0.248 ± 0.013 IDSW 11–19 13–18 3–14 RMSE [m] 7.50 ± 1.12 5.75 ± 0.50 6.35 ± 0.92 null [%] 0.0 0.0 2.0

position is seen by two receivers at once and no measurement can be fused across a handover at this spacing. Widening the gate to 400 m at receiver 3, with every other setting and the same five seeds held, opens a 21 m band seen by both receivers, raises the detection rate from 0.328 ± 0.023 to 0.401 ± 0.121, and lowers coverage from 83.2 % ± 1.6 %, both nulls cleared on 5 of 5 seeds, to 67.6 % ± 25.3 % on 4 of 5, with the reported-object count rising from 292 to 619 per cell; the chain keeps the 300 m gate. In the opened band, 21 truth frames over the five seeds carry a detection from both receivers; locating the target on the street line (the line is the third constraint; two bistatic ranges alone fix a curve rather than a point) from one receiver’s bistatic range gives an error of 1.46 m ± 1.13 m, from the two receivers’ ranges combined 1.54 m ± 1.06 m, against a permutation null of 2.1 m to 9.7 m: both beat the null and the two are indistinguishable. Half a range grid bin projected onto the street is 1.03 m, of the same order as the single-receiver error.

PREPRINT

15

TABLE XII T HE 1140 m CHAIN , MEAN ± STANDARD DEVIATION OVER 5 NOISE SEEDS PER RECEIVER AND TARGET, CELL SCORER AT A 20 m GATE OVER ONE PASS OF EACH RECEIVER ’ S LAP, WITH ∆Pdir THE RENDERED DIRECT- PATH LEVEL RELATIVE TO RECEIVER 1, MARGIN THE COVERAGE LESS THE PERMUTATION NULL , AND ABSENT THE COVERAGE OF THE TARGET- ABSENT CELLS . A SUPERSCRIPT k/n MARKS A ROW THAT EXCEEDED BOTH OF ITS NULLS ON k OF n SEEDS , SO ITS MEAN AND STANDARD DEVIATION SPAN TWO MODES ; THE ABSENT COLUMN CARRIES NONE BECAUSE k = 0 IS ITS REQUIRED OUTCOME . #

1 2 3 4 5 6 7 8

y

∆Pdir

vehicle, 1.6 m

UAV, 15 m

[m]

[dB]

cov. [%]

margin [pp]

PD

cov. [%]

margin [pp]

PD

cov. [%]

-578 -443 -308 -173 -38 97 232 367

+0.0 -1.4 -4.0 -5.6 -7.1 -8.4 -9.6 -10.6

73.2 ± 22.74/5 44.2 ± 21.64/5 83.2 ± 1.6 81.8 ± 2.1 82.7 ± 4.2 77.7 ± 7.7 66.4 ± 30.44/5 45.9 ± 6.2

+32.0 +12.7 +35.4 +42.3 +34.0 +39.2 +32.8 +15.7

0.21 0.22 0.33 0.27 0.30 0.27 0.22 0.17

81.1 ± 5.6 34.7 ± 6.81/5 70.5 ± 26.94/5 81.2 ± 3.5 83.9 ± 1.9 84.7 ± 1.2 64.1 ± 33.44/5 46.7 ± 21.93/5

+38.2 +4.6 +25.5 +44.6 +31.8 +43.8 +31.0 +12.3

0.26 0.16 0.34 0.28 0.30 0.28 0.23 0.24

4.1 ± 1.9 10.2 ± 3.2 11.1 ± 11.9 17.1 ± 7.3 0.0 ± 0.0 20.9 ± 12.7 14.2 ± 0.9 2.0 ± 3.5

TABLE XIII F IELD LINK BUDGET PER CHAIN RECEIVER , FREE SPACE FROM THE LICENSED EIRP WITH A 10 dB RE 1 m2 POINT TARGET AND UNITY RECEIVE GAIN ; SNR IS AFTER 41.07 dB OF COHERENT GAIN AGAINST A −92.42 dBm FLOOR . T HE BUDGET IS AN UPPER BOUND : NO MULTIPATH , BUILDING OR CLUTTER LOSS IS INCLUDED . #

baseline

Pdir

[m]

[dBm]

[dBm]

SNR [dB]

[dBm]

SNR [dB]

1 2 3 4 5 6 7 8

256 392 528 664 800 937 1073 1209

-20.1 -23.8 -26.4 -28.4 -30.0 -31.4 -32.5 -33.6

-46.9 -50.8 -53.5 -55.6 -57.3 -58.7 -59.9 -61.0

+86.6 +82.7 +79.9 +77.9 +76.2 +74.8 +73.6 +72.5

-70.6 -73.0 -74.8 -76.4 -77.7 -78.8 -79.8 -80.7

+62.9 +60.5 +58.7 +57.1 +55.8 +54.7 +53.7 +52.8

echo, lap start

echo, lap end

X. M ULTIPLE ILLUMINATORS AT ONE RECEIVER A single transmitter–receiver pair measures excess bistatic range, range rate and a cone angle about the receiver array axis; it does not measure elevation, and the tracks of Section VIII-D are therefore confined to the intersection of the target-height plane with the constant-bistatic-range surface, with the height taken from the scene; the planar description is an approximation that holds while the transmitter and receiver heights differ from the target’s by less than the baseline. In the uplink testbed the elevation was recovered by a second transmitter [13]. On the downlink the same role is taken by the co-channel cells licensed around the receiver: each cell identity received at one user-equipment position forms its own bistatic pair, self-referenced to that cell’s own direct path; two constant-bistatic-range surfaces intersect in a curve, and a third pair, or the target-height plane used as a prior in this paper, is needed to fix a point, so the dilution computed below is that of three or more surfaces or of two surfaces with the height plane, as stated per row. This section states the configuration under construction and the geometric dilution it affords. A. One cell identity per measurement The emulated receiver holds synchronisation on one cell identity. With 4 identities present in the emulated channel

absent

the receiver re-synchronised 475 times over the run and produced no usable detection stream, so the multi-illuminator measurement is built from single-identity cells rendered on one trace timeline and fused offline, one illuminator per cell. In the field the restriction does not apply: cells on the same carrier arrive in the same samples, and one capture at one receiver yields one pair per co-channel identity, each with its own frame timing and delay origin, with five of every six identities placing their reference signal on a different subcarrier comb from the serving cell’s (Section VIII). The field route is therefore peridentity extraction on a single recording, and the simulated route is its one-identity-per-cell equivalent. B. Illuminators available at the site Table VII decides which licensed sites can contribute. A neighbour is a usable pair only if it is co-channel with the serving cell and one of its sectors faces the receiver; at this site the nearest neighbour is 51◦ off its best sector, the strongest carries no co-channel component, and the only neighbour that is both co-channel and within 30◦ of boresight is the furthest, at 1177 m with a free-space direct-path bound of −38 dBm. The serving site itself is three-sectored; the sector reported in Section VIII is 19◦ off the receiver and the other two present their back lobes to it. Whether a cell search on the live band3 carrier returns the furthest neighbour at a kerbside receiver is not answerable in simulation and is deferred to the first recording. C. Geometric dilution of the candidate configurations Table XIV gives the vertical dilution of precision of three receiver configurations against the 14 co-channel sectors over 5 licensed sites of the scene, from a bistatic-range-only Jacobian with equal measurement error per pair, an azimuth wedge of 32.5◦ either side of each sector’s boresight and no link budget; the medians are taken over the grid cells that every configuration can solve. One receiver with the licensed transmitters resolves altitude at 100 m with a dilution of 1.65; a second receiver at a different height lowers it to 1.17 and more than doubles the solvable fraction of the grid, and a third receiver adds coverage rather than lowering dilution.

PREPRINT

16

TABLE XIV V ERTICAL DILUTION OF PRECISION (VDOP, MEDIAN OVER THE COMMONLY SOLVABLE GRID ) AND SOLVABLE FRACTION OF THE 1900 m TILE FOR THREE RECEIVER CONFIGURATIONS AGAINST THE CO - CHANNEL SECTORS OF TABLE VII, FROM GEOMETRY ALONE , COMPUTED WITH NO LINK BUDGET AND EQUAL ERROR PER PAIR . receivers (N transmitters)

solvable [%]

VDOP at 1.6 m

VDOP at 100 m

1 2, staggered height 3, staggered height

34.5 69.5 100.0

16.6 5.95 5.66

1.65 1.17 0.95

Forcing every transmitter to one mast height leaves the onereceiver dilution at 1.67, so the vertical sensitivity comes from the transmitters’ spread in azimuth and range, not from their heights. Three receivers at a common height is the worst configuration computed, because the three pairs share both the transmitter leg and the receiver height. The dilution treats each transmitter–receiver pair as an independent range with equal error; co-sited sectors of one licensed site share a mast and a clock, so their reference errors are correlated and the dilution understates the vertical error where such pairs dominate. D. Measurement plan and gates The first configuration is one receiver with the serving sector and each usable co-channel sector in turn, on the 283 m lap of Section VIII-D; each illuminator carries its own alignment record (boresight, element gain and excess-range support) and a sector that fails that record is reported and not run. Fusion is at the detection level with a three-dimensional state. Two controls gate any fused figure: the fusion of the target-absent streams of every illuminator must produce no track, and the fusion of repeated copies of one illuminator’s stream must reproduce that illuminator’s single-pair result. The quantities to be reported are the single-pair and fused identity, switch and GOSPA figures of Section V on the same cells, and the altitude error of the fused track against the rendered height, which no single pair here can report. E. A second illuminator at the street receiver One pair of that plan has been run, at the High St receiver of Section VIII-H: licensed site 102006 at 1812.5 MHz, 632.1 m from the receiver and 44.5◦ off its nearest sector, as a separate cell because its carrier is 30 MHz from the primary’s. Its direct path arrives −10.73 dB relative to the primary’s and its echoto-direct ratio over the lap is within −2.52 dB of the primary’s, so the pair passes a ratio screen. The rendered trace carries the echo in 16 of 62 snapshots (26 %), the northern third of the lap being shadowed by the frontage from this transmitter’s direction, and the cell detects the target in 1 of 16 opportunities (PD = 0.062), with coverage 0.0 %, a permutation null of 0.0 % and a worst decoy of 0.0 %: under the confirmed-track convention the arm scores nothing at all, so no track is claimed and no null comparison is made for it. At the same trim it publishes 307 detection records over the run, read from the cell’s own stream, against the primary illuminator’s 164 ± 12 over 5 cells: the occluded illuminator emits more records while

detecting the target in 1 of 16 opportunities. Three things differ from the primary at once — the 26 % line-of-sight fraction, the lower direct path and hence a different cancellation residual at the same trim, and the off-boresight illumination — and one cell does not separate them. What the cell establishes is that a ratio screen is not a sufficient admission gate for a second illuminator, and that at this receiver the pair contributes no measurable quantity to fuse; the plan above starts from the line-of-sight fraction of each candidate pair, read from the trace before any cell is run. XI. L IMITATIONS Association gate. Every coverage figure is a decision at the 20 m scorer gate, which on this scene thresholds a continuous track-position error: at a 30 m gate the two coverage populations of 84 % and 68 % converge to 87.5 %–87.8 %, and with the position error removed the same runs reach 87.8 %. A coverage figure from this scene is a thresholded position error at a stated gate. Channel sampling within the dwell. The channel trace is sampled once per coherent interval, so range migration and channel variation inside a dwell are not represented and their effect on coverage is not quantified. Illuminator pattern, ports, tilt and polarisation. The transmitter is one TR 38.901 element (65◦ by 65◦ ) on one reference-signal port with no vertical array factor and no downtilt, and the channel model injects a single transmit column, so a deployed panel’s 6◦ –7◦ elevation pattern, its port count and its slant polarisation are recorded with each configuration and not applied. The Pender St figures are for the sector 19◦ off the receiver; the facing sector lifts coverage by +6.29 pp (standard error 3.40 pp), which is not separable, so the figures are those of a stated configuration. Elevation geometry of an aerial target. Over the published panel’s electrical tilt range the echo-to-direct ratio at the receiver changes by −1.93 dB–+1.10 dB for a target at 15 m and by −21.66 dB–−6.32 dB at 60 m; the 15 m results transfer to a deployed panel within about 2 dB of illumination and the 60 m results do not. The first sidelobe is not modelled and the quantity bounded is illumination. Channel realism. The channel carries 2 static taps (rms delay spread 0.11 m), a cap of the channel forwarder, so every statement about the built-up street describes a two-path rendering of its geometry; clutter, multipath richness and groundbounce structure are not represented, and results that depend on the number or spread of static returns (direct-path mask, CFAR training) do not carry to a measured channel. A delayspread estimate from a public live-downlink recording [19] did not pass its controls and is not quoted. Noise and absolute level. The receiver is not noiselimited: an injected tone reads back within 0.42 dB, but the receiver’s own noise readback (−160.0 dBm, produced at lte_ue_measurements.c:264, gainand FFT-referred, printed as an integer) is 1.43 LSB of amplitude, −67.6 dB from kT0 B at the declared 9.0 dB noise figure over 18.0 MHz, and the configuration readback gives 0.12 LSB rms; the two readbacks disagree and

PREPRINT

17

both place the floor at or below the quantiser. The direct path is carried at a normalised level, 3.0 dB below full scale of the 16-bit word, whereas a receiver at the free-space bound of Table VII would hold it at most 69 dB above thermal noise. No range limit is noise-bounded, no noise-sensitivity claim is made, and no absolute-level conclusion transfers to a deployment. Doppler margin and dwell. The unambiguous bistatic range-rate span at this burst stride is ±8.13 m s−1 against a trajectory maximum of 3.68 m s−1 ; a faster or more radial target aliases. Processing every slot removes the bound and shortens the dwell to 64 ms, which requires a trace re-rendered at that snapshot period and a threshold trim derived at that dwell; neither is reported here. Scene, receiver position, height and speed. One target on one straight trajectory per scene; nothing bears on multiple targets. A receiver at half the baseline, two positions outside the directional illumination and heights above 7 m (where the user equipment does not synchronise) are not measurable with this arm, and the half-baseline comparison rests on detection alone (0.776 against 0.667). Detection depends on target speed (missed-detection probability 0.780, 0.556 and 0.666 at 3, 7 and 10 km h−1 ; no detection at 25 km h−1 , where part of the range rate falls outside the unambiguous span); no quantity is corrected for it, and both arms share the trajectory. Scan volume. Widening the range gate from 85 m to 200 m and 315 m raises the type-2 false-alarm probability from 0.571 to 0.692 and 0.780 (single cells), so receiver-position figures are quoted against the 200 m control. Scoring convention. Every coverage figure is scored on confirmed tracks with one scorer version. Under the earlier convention, which counted every published record, the second receiver implementation (Section VI-A), the half-baseline position, the two range-gate controls and two earlier rounds of arm A read 13.7 %–72.9 % with every cell passing; under the present one they read 0.0 %–4.1 % with none passing, and the two headline arms of Table VI moved by −16.7 pp and −19.4 pp and kept every cell. Those families are reported as negative results. Resolution at this n. An arm-to-arm difference below the execution interval of Section VII-B (0.02 of PD , 3.6 pp of coverage) is not resolvable at n = 5; the coverage ordering between the arms changes sign between two rounds on one build (5.2 pp and −2.9 pp) and is not claimed. Metric scope and false-alarm bound. The misseddetection probability is computed from the same detection flag as the detection probability, so their identity holds by construction; the coverage and identity quantities have no 3GPP equivalent. The false-alarm rates are upper bounds from eleven target-absent replays per arm (about 106 scanned cells each) that treat neighbouring cells as independent trials, and cannot separate two arms that both meet the declared rate. XII. C ONCLUSION A downlink cell-specific reference signal arm with the receiver at the user equipment detects and tracks a single ground vehicle and a single airborne target on the scenes reported,

under one receiver implementation, one scorer, one association gate and one scoring convention held across the paper, with every coverage figure read against a permutation null, a decoy null and a target-absent null, and with the configurations that do not demonstrate tracking under that convention reported beside those that do. On the synthetic canyon its misseddetection probability, 0.667 ± 0.021 over n = 5 noise realisations, is below that of an uplink sounding reference signal arm on the same band and target, 0.772 ± 0.024, by +0.105 of detection probability paired by seed; both arms exceed the 3GPP reference target of 0.05 by an order of magnitude. On the surveyed site, nine receiver sitings along the street all track the vehicle, at coverage between 29.9 % and 61.7 %; target height between 1.6 and 30 m changes identity more than detection; and the built-up street itself costs detection rate and identity against open ground while leaving coverage unchanged; a receiver displaced off the street axis halves the identity switches and changes nothing else. Eight receivers at 135 m along the street carry one illuminator’s coverage over 1140 m: the vehicle clears both nulls on 37 of 40 cells and on every seed at 5 of the 8 receivers, the airborne target on 32 of 40, and a free-space link budget places every receiver of the chain above the thermal floor, so the field limit of this arm is the direct-path ratio. The four unequalised items of Section IV and the limitations of Section XI bound what these numbers support. The planned over-the-air capture at the surveyed site with the mast and the vehicle surveyed will be used to anchor the geometry and the absolute level of the measurement. ACKNOWLEDGMENT The channel traces were rendered with Sionna RT [3], [4]. The live-downlink recording used for the delay-spread comparison in Section XI was published by Daniel Estévez under CC BY 4.0 and is used unmodified apart from truncation [19]; its author is not associated with this work and did not review it. Building footprints are © OpenStreetMap contributors, used under the Open Database Licence; the band-3 site records are from the Australian Communications and Media Authority’s Register of Radiocommunications Licences. R EFERENCES [1] 3GPP, “Feasibility study on Integrated Sensing and Communication,” 3rd Generation Partnership Project, TR 22.837 V19.4.0, Jun. 2024, release 19; clause 3.1 KPI definitions, Table 7.2-1 consolidated KPIs. [2] ——, “Evolved Universal Terrestrial Radio Access (E-UTRA); physical channels and modulation,” 3rd Generation Partnership Project, TS 36.211 V19.3.0, Mar. 2026, release 19; cell-specific reference signal, clause 6.10.1. [3] J. Hoydis, S. Cammerer, F. Ait Aoudia, A. Vem, N. Binder, G. Marcus, and A. Keller, “Sionna: An open-source library for next-generation physical layer research,” arXiv:2203.11854, 2022. [4] J. Hoydis, F. Ait Aoudia, S. Cammerer, M. Nimier-David, N. Binder, G. Marcus, and A. Keller, “Sionna RT: Differentiable ray tracing for radio propagation modeling,” arXiv:2303.11103, 2023. [5] 3GPP, “Study on channel model for frequencies from 0.5 to 100 GHz,” 3rd Generation Partnership Project, TR 38.901 V19.5.0, Sep. 2026, release 19; clause 7.9 channel model for ISAC, Table 7.9.2.1-1 RCS of sensing targets. [6] P. K. Rai, A. Kumar, M. Z. A. Khan, and L. R. Cenkeramaddi, “LTEbased passive radars and applications: a review,” International Journal of Remote Sensing, vol. 42, no. 19, pp. 7489–7518, 2021.

PREPRINT

[7] B. Wang, J. Yi, X. Wan, and Y. Dan, “Inter-frame ambiguity analysis and suppression of LTE signal for passive radar,” Journal of Radars, vol. 7, no. 4, pp. 514–522, 2018. [8] R. S. A. Raja Abdullah, A. A. Salah, A. Ismail, F. Hashim, N. E. Abdul Rashid, and N. H. Abdul Aziz, “LTE-based passive bistatic radar system for detection of ground-moving targets,” ETRI Journal, vol. 38, no. 2, pp. 302–313, 2016. [9] Z. Geng, R. Xu, and H. Deng, “LTE-based multistatic passive radar system for UAV detection,” IET Radar, Sonar and Navigation, vol. 14, no. 7, pp. 1088–1097, 2020. [10] Y. Sun, C. Yu, Y. Luo, T. X. Han, H. Tan, R. Wang, and F. C. M. Lau, “An experimental study of passive UAV tracking with digital arrays and cellular downlink signals,” arXiv:2412.20788, Dec. 2024. [11] C. Ji, Q. Liu, J. Liu, C. Yu, Y. Sun, R. Wang, and F. Liu, “Doppler-based multistatic drone tracking via cellular downlink signals,” arXiv:2509.25732, Sep. 2025. [12] C. Ji, J. Liu, Q. Liu, Y. Sun, C. Yu, and R. Wang, “An experimental study on fine-grained bistatic sensing of UAV trajectory via cellular downlink signals,” arXiv:2602.08203, Feb. 2026. [13] A. K. Gurung, S. K. Sathananthan, and S. R. Pokhrel, “5G ISAC-based UAV detection and 3-D tracking using uplink sounding reference signals on an end-to-end O-RAN simulation testbed,” arXiv:2608.05826, 2026. [14] 3GPP TSG RAN WG1, “Chair’s notes, RAN1#126bis, agenda item 10.8.1 (6G ISAC evaluations): true radial velocity for bistatic sensing,” Jeju, Korea, Oct. 2026, release 20; defines the true radial velocity as the sum of the velocity projections on the unit vectors from target to transmitter and from target to receiver, equal to 2v cos(β/2) cos α for static nodes. [15] 3GPP, “Study on Integrated Sensing And Communication (ISAC) for NR,” 3rd Generation Partnership Project, TR 38.765 V20.0.0, Jun. 2026, release 20; clause 4.1 performance-metric definitions, Table 4.2-1 performance objectives, clause 5.1 measurement levels A–D. [16] 3GPP TSG RAN WG1, “Chair’s notes, RAN1#122bis, agenda item 10.5 (study on ISAC for NR): agreements on performance metrics and performance objectives,” Prague, Czech Republic, Oct. 2025, release 20; adopts the performance objectives later captured in TR 38.765 Table 4.21 (values bracketed at the meeting) and the definition of K in the type-2 false-alarm probability. [17] E. Ristani, F. Solera, R. Zou, R. Cucchiara, and C. Tomasi, “Performance measures and a data set for multi-target, multi-camera tracking,” in Computer Vision – ECCV 2016 Workshops. Springer, 2016. [18] A. S. Rahmathullah, Á. F. Garcı́a-Fernández, and L. Svensson, “Generalized optimal sub-pattern assignment metric,” in Proc. 20th Int. Conf. Information Fusion (FUSION), 2017, pp. 1–8. [19] D. Estévez, “Recording of the LTE downlink signal of the vodafone PCI 380 cell, 10 MHz band-20 channel at 806 MHz,” 2022, complex int16 recording at 30.72 MS/s, USRP B205mini, Madrid, 2022-04-09, distributed by the author under CC BY 4.0. The published SigMF excerpt’s core:sha512 was recomputed and matches; no digital object identifier is published for it, so this entry carries none.

18

Related documents

• Opportunities for Direct-to-Cell Polarization MIMO in the Downlink of a LEO Satellite Footprint#1483184
• Joint and Streamwise Distributed MIMO Satellite Communications with Multi-Antenna Ground Users#1343525
• Channel Modeling Framework for Both Communications and Bistatic Sensing Under 3GPP Standard#155498
• Non-Uniform Activation Aided Distributed Generalized Spatial Modulation for DMIMO Systems#1077986
• A Stochastic Geometry Framework for Performance Analysis of RIS-assisted OFDM Cellular Networks#1327184