5G ISAC-Based UAV Detection and 3-D Tracking Using Uplink Sounding Reference Signals on an End-to-End O-RAN Simulation Testbed

1

5G ISAC-Based UAV Detection and 3-D Tracking Using Uplink Sounding Reference Signals on an End-to-End O-RAN Simulation Testbed

arXiv:2608.05826v1 [cs.NI] 6 Aug 2026

Arun K. Gurung, Senior Member, IEEE, Satha K. Sathananthan, and Shiva R. Pokhrel, Senior Member, IEEE

Abstract—Integrated Sensing and Communication (ISAC) lets cellular infrastructure serve communication users and sense on the same waveform. We present an end-to-end O-RAN simulation testbed for 5G ISAC targeting low-altitude UAV detection and 3-D tracking, built from open-source components— OpenAirInterface, FlexRIC and Sionna RT—in which the NR Uplink Sounding Reference Signal is repurposed as a passive radar waveform: a PHY-layer sensing stage inside the gNB produces detections that reach an Extended Kalman Filter tracking xApp over a custom E2 service model, with no change to the NR standard and no dedicated sensing waveform. A single bistatic pair leaves elevation unobservable, so the tracker needs a height prior; we remove it two independent ways and measure both — a planar receive array supplying a vertical aperture, and a second transmitter supplying range diversity. Both live results corroborate an offline ray-traced study of the same estimator, which converges from a deliberately wrong initial altitude to 1.8 m RMSE at a consistent filter, so altitude observability is established both in the signal-processing chain and end to end through the live stack. Detection coverage is preserved under a concurrent 10 Mbit s−1 uplink communications load. Index Terms—ISAC, O-RAN, 5G NR, UAV detection, drone tracking, UL-SRS, OpenAirInterface, FlexRIC, Sionna RT, xApp, Near-RT RIC, counter-UAS, EKF, bistatic sensing

I. I NTRODUCTION The proliferation of low-altitude unmanned aerial vehicles (UAVs) in civil airspace has created an urgent need for scalable, cost-effective counter unmanned-aircraft-system (CUAS) solutions. Traditional radar systems require dedicated spectrum, infrastructure, and operational budgets that are prohibitive for many deployment scenarios. Cellular networks, by contrast, already blanket terrestrial environments and can be reused for dual-purpose sensing, aligning with the Integrated Sensing and Communication (ISAC) vision being studied in 3GPP SA1 and RAN study items towards Release 19 [1], [2]. The wording matters: these are study reports, and at the time of writing no normative 3GPP sensing specification exists; the uplink sounding reference signal (UL-SRS) is a candidate sensing signal under study, not a standardized one. Open Radio Access Network (O-RAN) architecture disaggregates the base station into the O-RAN radio unit (ORU), distributed unit (O-DU), central unit (O-CU), and the A. K. Gurung is in Melbourne, Australia (e-mail: akgurung@ieee.org). S. K. Sathananthan is in Melbourne, Australia (e-mail: satha@nexvis.com.au). S. R. Pokhrel is with Deakin University, Burwood, Australia (e-mail: shiva.pokhrel@deakin.edu.au).

RAN Intelligent Controller (RIC), exposing standardized interfaces (E2, O1, A1) that enable third-party applications (xApps/rApps) to observe and control the radio stack in nearreal time [3]. This programmability makes O-RAN a natural host for ISAC processing: sensing algorithms can be embedded as xApps in the Near-RT RIC, co-located with the RAN, and fed detection results via the E2 interface [4]. Despite growing theoretical interest in 5G ISAC [5], [6], end-to-end open testbeds that integrate a real NR protocol stack, a standards-compliant RIC, and a ray-traced channel simulator especially UAV surveillance remain scarce. Contributions. This paper makes the following contributions: 1) An O-RAN compliant ISAC sensing plane, end to end: a live 5G NR stack, a Near-RT RIC and a raytraced channel wired into one containerized testbed, with UAV echo injection and a calibrated thermal-noise link budget, so detections come from a real PHY driven by physically-scaled signals. Sensing runs inside the OAI gNB (rank-Kc clutter-subspace deflation, 2-D OFDM Range-Doppler processing, OS-CFAR with single-peak grouping, closed-form interferometric angle of arrival) and every detection reaches a subscribing xApp over a prototype E2 service model (SM-SENS) using standard E2AP subscription/indication procedures — with no modification to the NR standard and no dedicated sensing waveform. 2) A bistatic tracker evaluation: an EKF xApp with a nonlinear range–range-rate–azimuth measurement model, Hungarian association and a time-driven trackmaintenance pass that bridges intermittent detection gaps to sustain continuity, evaluated per-CPI against raytraced ground truth with corrected bistatic definitions. The evaluation is deliberately adversarial: a height-prior ablation and single-pair observability analysis, a streetcanyon occlusion stress test, sensing under a concurrent 10 Mbit s−1 uplink load, and an end-to-end transport latency study (Section IV-C and Appendix C). 3) Two routes from 2-D to 3-D tracking: the singlepair height prior above is removed twice over. A twodimensional uniform planar array at the gNB adds a vertical baseline, and a separable dual phase-ramp estimator recovers elevation alongside azimuth — reducing exactly to the baseline azimuth estimator when the array is one-dimensional — feeding a 3-D EKF that estimates altitude online (Section VII). Independently, a second

2

nrUE forms a second bistatic pair whose range diversity fixes altitude by geometry alone, on the unmodified azimuth-only array (Section VIII). Over N = 5 seeded transits per configuration on one host and one build, both collapse the cross-seed spread of the final altitude from 12.7 m to 0.2 m — the observability signature. They are not equivalent: the multistatic route is pinned and unbiased (55.3 m against a 55 m truth, 2.2 m height RMSE), while the planar array carries a residual 6.0 m elevation bias and instead wins horizontal accuracy (3.8 m). The remainder of this paper is organized as follows. Section II surveys related work. Section III presents the system model. Section IV describes the testbed architecture. Section V details the UL-SRS sensing pipeline. Section VI presents evaluation results. Section IX discusses design insights and limitations. Section XI concludes the paper. II. R ELATED W ORK Table I positions this testbed against the closest open RAN digital-twin, O-RAN, and cellular-ISAC platforms along the axes a sensing testbed must satisfy; the remainder of this section discusses each line of work in turn. A. ISAC in 5G/6G Networks ISAC has been extensively studied as a key enabler of 6G [5], [16], [17]. Seminal work by Liu et al. [18] demonstrated joint beamforming design for dual-function radarcommunication (DFRC) systems. Subsequent contributions addressed waveform design, interference management, and performance bounds [19], [20]. The 3GPP standardization community formalized ISAC in TR 22.837 [1] (sensing use cases) and TR 38.867 [2] (the Release-19 ISAC channelmodel study item), which identify UL-SRS as a candidate sensing signal for range and velocity estimation in the sub6 GHz and mmWave bands. Concurrent work by Kumar et al., CellSense [12], targets clutter-robust passive sensing in the sub-6 GHz cellular band, validated via both Sionnabased OFDM link-level simulation and a USRP (Universal Software Radio Peripheral) hardware prototype – a validation methodology directly complementary to this paper’s Sionna RT-based simulation, with USRP hardware validation as this testbed’s own planned next step (Section IX). B. Passive UAV Detection UAV detection leveraging existing cellular waveforms has gained momentum as networks approach ubiquitous deployment [21]. Zhang et al. [15] demonstrated passive radar using LTE downlink signals for micro-drone detection at ranges up to 500 m. Falcone et al. [14] exploited DVB-T signals for multicopter detection. Drone signature extraction using Doppler micro-Doppler signatures of rotor blades has been validated in [22] and [23] using both radar and cellular signals. In the NR domain, an OFDM-waveform radar has been proposed [13] but full-stack integration with O-RAN remains undemonstrated.

C. O-RAN Testbeds and xApp Research OpenAirInterface (OAI) provides an open-source, 3GPPcompliant NR stack widely used in research testbeds [24]. FlexRIC [25] implements the O-RAN Near-RT RIC with E2 interface support and a programmable xApp SDK. ColORAN [26] demonstrated data-driven RAN control at scale, while a broader architectural treatment of O-RAN interfaces, algorithms, and open research challenges is given in [27]. Data-driven O-RAN experimentation frameworks [28] and machine-learning channel datasets such as DeepMIMO [29] have advanced data-driven RAN research but do not address ISAC applications. Sionna [30] provides a GPU-accelerated link-level simulation framework with ray-tracing (Sionna RT [31]) that has been used for channel modeling; its integration with a live NR stack for ISAC purposes is novel. NVIDIA’s Sionna Research Kit [11] similarly couples Sionna with a live OAI-based stack on GPU-accelerated hardware, but targets AI-RAN neural-receiver research on communication-side key performance indicators (KPIs), not sensing – this work instead uses a CPU-only, containerized OAI+Sionna RT stack for active UAV ISAC sensing. Separately, a growing body of work builds wireless digital twins that pair a live or emulated RAN stack with ray-traced or otherwise site-specific channel models [32]. Colosseum [8] couples a large-scale RF emulator with a digital-twin control plane for O-RAN experimentation, and Boston Twin [9] provides a city-scale ray-tracing digital twin for 6G network studies. Villa et al. [10] integrate OAI with an NVIDIAaccelerated O-RAN testbed across multiple vendors. Closest to our own use of Sionna RT, the Open Wireless Digital Twin [7] couples OAI and Sionna RT under FlexRIC to emulate 5G mobility and monitor RAN KPIs (reference signal received power [RSRP], modulation and coding scheme [MCS], block error rate [BLER], throughput) via the Near-RT RIC – architecturally the same three-layer stack (OAI + FlexRIC + Sionna RT) as this paper, but applied to communication-side mobility emulation rather than active sensing. Concurrently, the dApp concept [33] proposes co-locating sub-10 ms inference microservices directly inside the O-DU alongside the physical layer (PHY), providing IQ-sample access that the E2 interface was never designed to carry. The sensing-dApp architecture of [34] formalizes this for monostatic ISAC: it specifies sensing dApps at the O-DU for delay, Doppler, and angle extraction, a companion E2SM-SENS service model for structured sensing telemetry, and the Open Fronthaul metadata required for waveform–echo association. This work implements a bistatic sensing pipeline and a parallel E2SMSENS transport independently, making the sensing PHY stage dApp-ready in principle while deferring a standards-compliant lifecycle to hardware integration (Section X). Gap. As Table I makes explicit, the three-layer OAI + FlexRIC + Sionna RT stack is not itself novel — the Open Wireless Digital Twin [7], Colosseum [8] and Boston Twin [9] all pair emulated or ray-traced RANs with a RIC control plane. What every prior platform instruments is the communication plane — RSRP, MCS, BLER, throughput. What this work adds is the sensing plane: a UL-SRS radar

3

TABLE I: Capability comparison against the closest prior platforms. ✓ = provided; – = not provided. Channel column: RT = ray-tracing simulation, sim = link-level or stochastic channel simulation, HW = real RF hardware. R/D/AoA = range, Doppler (range-rate) and azimuth/bearing all estimated and evaluated. Coex. = carries concurrent live communication traffic on the same waveform; Open = open-source code release. ‡ Built on open-source components (OAI, FlexRIC, Sionna) with the sensing code release pending. Platform

NR stack

RIC

Waveform

Channel

UAV

R/D/AoA

E2

Coex.

Open

OWDT [7] Colosseum [8] Boston Twin [9] O-RAN ARC [10] Sionna RK [11] CellSense [12] OFDM/passive radar [13]–[15]

OAI OAI/srsRAN – OAI OAI 5G OFDM –

✓ ✓ – ✓ – – –

– – – – – passive OFDM/passive

RT HW-emu RT HW RT+HW sim+HW HW

– – – – – – ✓

– – – – – ✓ ✓

✓ ✓ – ✓ – – –

✓ ✓ – ✓ ✓ ✓ –

–‡ ✓ ✓ ✓ ✓ – –

This work

OAI

✓

UL-SRS

RT

✓

✓

✓

✓

–‡

processing chain inside the gNB PHY, a bistatic tracker in the Near-RT RIC delivered over a custom E2SM-SENS service model, and an evaluation reported in sensing terms — range, range-rate and bearing accuracy against ray-traced ground truth, together with the geometric limits that bound them. To our knowledge this is the first end-to-end 5G O-RAN ISAC simulation testbed work for UAV tracking with extensive pipeline validation and identification of key limitations towards practical deployment. III. S YSTEM M ODEL A. Coordinate System and Conventions All positions are expressed in a local east–north–up (ENU) frame: x̂ points east, ŷ north and ẑ up. The gNB receive array is a uniform linear array (ULA) whose elements lie along ŷ, so its boresight is +x̂. Azimuth is measured at the array phase center — i.e. at the antenna, at height hgNB above the mast foot, which is where the bearing is physically subtended — from the +x̂ boresight towards +ŷ: a target whose horizontal offset from the phase center is (∆x, ∆y) therefore has θ = atan2(∆y, ∆x),

(1)

and the array’s unambiguous sector is θ ∈ [−90◦ , +90◦ ] (Fig. 1). Placing the array broadside to the target corridor this way makes the inter-element phase ramp signed and monotonic as the target crosses boresight; an endfire (+ŷboresight) orientation would leave the bearing sign ambiguous over the same corridor. B. Signal Model Consider a single 5G NR gNB equipped with Nrx = 4 receive antennas operating on Band n78 at carrier frequency fc = 3319.68 MHz (3.32 GHz) with system bandwidth B = 40 MHz over 106 physical resource blocks (PRBs) at 30 kHz subcarrier spacing (SCS). A UAV at 3D position pT (t) and velocity vT (t) acts as a non-cooperative passive scatter target while a registered nrUE transmits UL-SRS as part of the normal NR uplink procedure. The received baseband signal at the n-th gNB receive antenna after cyclic-prefix removal is yn [k, l] =

P X p=1

hn,p [k, l] s[k, l] + wn [k, l],

(2)

where s[k, l] is the SRS orthogonal frequency-division multiplexing (OFDM) symbol on subcarrier k and SRS occasion l, hn,p [k, l] is the channel coefficient of the p-th propagation path, P is the total number of paths, and wn [k, l] ∼ CN (0, σ 2 ) is complex additive white Gaussian noise (AWGN). Path budget in this testbed. The ray tracer returns P = 3 in the flat-LOS benchmark: 1) the direct UE→gNB path (LOS); 2) one static reflection — here the ground bounce — retained as the strongest surviving non-target path; and 3) the UAV echo, the bistatic path of interest. Paths (1) and (2) are static and share the zero-Doppler subspace that Section V-B deflates; path (3) is the only Dopplerbearing return, which is precisely why a rank-Kc = 1 deflation suffices in this scene and why a higher rank removes the target itself. This P = 3 budget is compute-conscious, but for the flat-LOS benchmark it is also physically complete, as quantified at the end of this subsection. Two simplifications follow from this budget. First, only the two strongest static paths are retained, so a real scene’s weaker multipath is absent: the clutter the canceller faces is optimistic. Second, all rays that scatter off the UAV are coherently summed into a single echo tap, so the target is rendered as one point scatterer rather than as a body with extent — fuselage multi-bounce and rotor micro-Doppler are not modeled. In the street-canyon scene the two static taps persist, but the UAV echo is absent entirely whenever the target is occluded (Appendix B), so there P drops to 2 and no pipeline could detect the target. Sufficiency of the three-path budget in flat-LOS. Three checks establish that two static taps plus one echo per target is the complete channel for this benchmark. (i) The taps sit well inside the cyclic prefix. At 30 kHz SCS the normal CP spans 2.34 µs, a maximum excess path of 703 m; the scene’s excess bistatic path lengths of 40 m to 85 m occupy under 12 % of that window, so the rendered paths are never delay-limited and the path count could be raised freely on this axis. (ii) Two static taps retain all of the static channel here. A per-CPI truncationheadroom audit—comparing, at each snapshot, the strongest discarded non-target path against the weakest retained one— discards 0 % of static path energy at two taps in the flatLOS scene, because the ray tracer returns only the LOS and

4

ground-bounce non-target paths: two taps is the entire static channel, not a subset. The identical audit on the street-canyon scene discards 64 % of static energy at two taps (the strongest dropped path within 1.7 dB of the weakest kept), which is why Appendix B treats the buildings result as a lower bound. (iii) One echo tap matches the achievable resolution. With bistatic range resolution ∆Rres = c/B ≈ 8.0 m (Eq. (11)), the range cell is far larger than a multirotor’s physical extent, so intra-body multi-bounce is not separable in delay and a point-scatterer echo is the correct rendering at this bandwidth; for the −20 dBsm to −10 dBsm small-to-mid targets studied here the residual multi-bounce return lies below the noise floor regardless. The UL-SRS sequence follows the 3GPP NR specification [35]: s[k] = r(α,δ) (k) ejϕseq (k) ,

k = 0, . . . , MSRS − 1,

(3)

where r(α,δ) (k) is a Zadoff-Chu root sequence with cyclic shift α. The SRS is transmitted on a comb-2 pattern (every second subcarrier), so MSRS = 624 tones are occupied across the 106 PRBs × 12 SC/PRB = 1272 subcarriers at 30 kHz SCS. The effective sensing bandwidth is the occupied span B ≈ 1272 × 30 kHz ≈ 38.2 MHz (taken as B = 40 MHz by the gNB PHY sensing module). A comb least-squares extractor packs the MSRS occupied tones gap-free before range processing; the ISAC IFFT for range profiling is zero-padded to 4096 points. C. Bistatic Geometry and Range-Doppler Processing The testbed operates in a bistatic configuration: the nrUE at position pU transmits UL-SRS; the gNB at position pG receives the direct signal and the UAV bistatic echo. The bistatic range is Rbi = |pT − pG | + |pT − pU |,

(4)

i.e. the total path length of the echo, the sum of the two legs. It is not a one-way range, and this distinction sets the range resolution in (11) below. Excess path as the measured observable. The gNB recovers the echo delay relative to the direct path, which arrives first and is used as the timing reference. What the sensing stage reports is therefore the excess bistatic range ∆Rbi = RT + RR − L,

L = |pG − pU |,

(5)

with L the (known) baseline. Since the transmitter and receiver positions are known, the tracker restores the total path length, R̂bi = ∆R̂bi + L, before applying the measurement model (14). The two quantities differ by 130 m in this testbed, and a range observable is not interpretable without stating which convention it follows. Per-pair form. Section VIII adds a second transmitter, so (5) is written in the indexed form used from here on and in Fig. 1. With i indexing the transmitters, all sharing the one gNB receiver, ∆Rbi,i = RT + RR,i − Li ,

Li = |pG − pUi |,

(6)

where RT — the gNB-to-target leg — is common to every pair, while the target-to-receiver leg RR,i and the baseline Li are not. That asymmetry is what makes a second transmitter informative about altitude: two excess-path measurements sharing RT constrain the target to the intersection of two ellipsoids with a common focus, which has vertical curvature that one ellipsoid alone does not. The single-pair sensor of this section is (6) at i = 1, and every quantity in (5) carries over unchanged. The bistatic range rate follows by differentiating (4) directly. Let pT − pU pT − pG , ûU = (7) ûG = |pT − pG | |pT − pU | be the unit vectors pointing from the gNB and from the nrUE towards the target — the position gradients of the two range terms in (4). Differentiating (4) gives the rate of change of the bistatic path, Ṙbi = vT · (ûG + ûU ): the sum appears, because either range term grows as the target recedes from its station. We report Doppler in the usual radar sense, positive for a closing target, so the reported observable is the negated path rate: vbi ≜ −Ṙbi = − vT · (ûG + ûU ) = −2 |vT | cos ψ cos(β/2) = λfD ,

(8)

with β the bistatic angle subtended at the target (between ûG and ûU ) and ψ the angle between vT and the bisector of those two directions. Equivalently, in terms of the propagation directions — the incident ray k̂in (UE→UAV) and the scattered ray k̂out (UAV→gNB), for which ûU = k̂in and ûG = −k̂out —   vbi = vT · k̂out − k̂in . (9) Both forms are given because the sign turns entirely on which is meant, and a Doppler reported without its convention is not interpretable; the scattered-ray form (9) is included only for physical intuition, while the projected form (8) is the one used throughout the implementation. Under this convention the transiting target of Section VI approaches (vbi > 0), passes through zero at the broadside crossing, and recedes (vbi < 0). Throughout, vbi denotes this projected quantity, not the target’s speed: recovering |vT | from a single pair would require the geometry factor 2 cos ψ cos(β/2), and ψ is not observable from one bistatic measurement. As the target approaches the baseline, β → 180◦ and cos(β/2) → 0: the geometry degenerates, and neither range nor Doppler is observable there. This near-baseline blind zone is a property of the geometry, not of the processing, and coherent processing intervals (CPIs) falling inside it are excluded from the measurement statistics of Section VI. After clutter-subspace deflation and isolation of ĥUAV [k, l], a 2D OFDM Range-Doppler map is computed by a zeropadded inverse discrete Fourier transform (DFT) over the K subcarriers (range) followed by a DFT over the Nocc SRS occasions (Doppler) within one CPI:

X [m, n] =

NX occ −1

K−1 X

l=0

k=0

! UAV

ĥ

[k, l] e

+j2π mk K

nl

e−j2π Nocc . (10)

5

The inner transform is an inverse DFT because the delay/range profile of a frequency-domain channel is IDFT{ĥ}. The resulting resolutions are: ∆Rres =

c ≈ 8.0 m BSRS

(bistatic range resolution), (11)

where BSRS is the occupied SRS frequency aperture — the span from the first to the last transmitted SRS tone — and not the nominal channel bandwidth. The sounding signal carries MSRS = 624 comb-2 tones spaced kTC ∆f = 60 kHz, so BSRS = (MSRS − 1) kTC ∆f ≈ 37.4 MHz. Five quantities are kept distinct here: the 40 MHz nominal channel bandwidth, the 38.16 MHz carrier occupied bandwidth (106 PRB), the 37.4 MHz SRS aperture that actually sets resolution, the 1.22 m zero-padded FFT bin spacing (below), and the resulting 8.0 m physical range resolution. Deriving the cell from the SRS aperture rather than the nominal 40 MHz is what moves it from the 7.5 m of earlier versions to 8.0 m. ∆v =

0.0903 λ ≈ 0.14 m s−1 , = TCPI 0.64

(12)

the bistatic Doppler resolution, where λ = c/fc = 0.0903 m and TCPI = Nocc · TSRS = 64 × 10 ms = 640 ms is the coherent processing interval. Resolution conventions and the absence of a factor of two. A delay resolution ∆τ = 1/B maps to a resolution in the measured quantity through ∆Rres = c ∆τ = c/B, because Rbi (4) is a total path length. The familiar ∆R = c/(2B) is a monostatic convention: it applies when the measured delay is a round trip that is then halved to a one-way range, which is not the case here. The same reasoning applies to Doppler, where the bistatic formula likewise carries no factor of 2 since the UE transmitter is not co-located with the gNB receiver. Resolution and bin spacing are distinct quantities, and are easily conflated. The range transform is zero-padded to NFFT = 4096 points over tones spaced kTC ∆f = 60 kHz (comb-2 at 30 kHz SCS), giving a bin spacing of δr = c/(NFFT kTC ∆f ) = 1.22 m. That is an interpolation step, not a resolution: it sets how finely the peak of the range response can be located, whereas ∆Rres sets how far apart two scatterers must be to appear as separate peaks. Consequently a range accuracy better than ∆Rres is possible in principle for an isolated, high signal-to-noise ratio (SNR) scatterer. In practice, however, the measured range accuracy is set by the transit geometry rather than by peak-location precision, and lands at about one resolution cell (Section VI).

where Nref = (2Nt,R +1)(2Nt,D +1)−(2Ng,R +1)(2Ng,D +1) and, for the cell-averaging estimator under an exponentiallydistributed noise power, the scaling factor that attains   a design −1/N false-alarm rate PFA is αCA = Nref PFA ref − 1 . The implementation, however, uses the order-statistic variant (OS-CFAR) [38]: it replaces the training-cell mean in (13) with the k-th order statistic of the training ring (k at the 75th percentile), so that a target’s own main-lobe leakage into the ring cannot inflate the threshold. The scaling factor αCA does not carry over: OS-CFAR has its own scaling law, PFA = Qk−1 Nref −i i=0 Nref −i+αOS , and applying the cell-averaging factor to an order-statistic threshold does not realize the nominal rate. The threshold used here is therefore set empirically rather than from a closed-form PFA , and the 10−4 figure in Table III should be read as the design target of the underlying CA formulation, not as a calibrated false-alarm rate. The realized PFA on target-absent data, a calibrated variant that attains the nominal rate, and the detection probability PD against echo SNR and range are characterized in Appendix A. E. Bistatic EKF Tracker Detections (Rbi , vbi , θ) are associated and tracked using an Extended Kalman Filter (EKF) [39] with Cartesian constantvelocity state x = [px , py , vx , vy ]⊤ . The nonlinear measurement function h : R4 → R3 maps state to predicted bistatic observables: h1 (x) = |p − pG | + |p − pU |,

(14)

h2 (x) = − v · ûG (p) + ûU (p) ,

(15)

h3 (x) = atan2(py − pG,y , px − pG,x ),

(16)

where h1 takes the total path length — the measured excess range of (5) having had the baseline restored — p = [px , py , htgt ]⊤ augments the 2-D state with a fixed height prior htgt (the 2-D EKF does not observe elevation), and the azimuth h3 follows the ENU convention of (1), referenced to the gNB position pG and matching the gNB’s own 4-element Rx ULA, at which the bearing is estimated as an angle of arrival (AoA) on the receive side. The EKF predict-update cycle follows the standard formulation xt|t−1 = F xt−1|t−1 ,

(17) ⊤

Pt|t−1 = F Pt−1|t−1 F + Q, Kt = Pt|t−1 H⊤ t

(18)

−1 Ht Pt|t−1 H⊤ , t +R

xt|t = xt|t−1 + Kt zt − h(xt|t−1 ) , D. CFAR Detection Cell-averaging constant false-alarm rate (CA-CFAR) [36], [37] detection is applied to |X [m, n]|2 to detect UAV targets with a controlled false alarm rate PFA . The detection threshold for guard windows of (Ng,R , Ng,D ) cells and training windows of (Nt,R , Nt,D ) cells in the (range, Doppler) dimensions is η = αCA ·

1 Nref

X (m′ ,n′ )∈W

|X [m′ , n′ ]|2 ,

(13)

(19) (20)

where F is the constant-velocity transition matrix with ∆t = TCPI = 640 ms, Ht = ∂h/∂x x is the numerical Jacobian t|t−1 evaluated at the predicted state, Q the process noise covariance 2 (acceleration model, σa = 0.5 m/s2 ), R = diag(σR , σv2 , σθ2 ) ⊤ the measurement noise and zt = [R̂bi , v̂bi , θ̂] the detection. The range noise is set to approximately one resolution cell, σR = 8.0 m ≈ ∆Rres ; the range-rate noise σv = 0.89 m s−1 is set from the measured range-rate residual over a full transit (Section VI-C), some six times the one-Doppler-cell

6

∆v = 0.14 m s−1 ; and the azimuth noise is σθ = 9◦ . The last was chosen a priori as a conservative value for a 4-element aperture, and the measured bearing error over a full transit (7.0◦ , Section VI) sits a little below it — so the prior is appropriately conservative without being pessimistic. Note that σR follows the total-path convention of (11); the monostatic c/(2B) value would make the filter over-trust range by a factor of two, and we report the effect of that mis-setting as an ablation in Section VI. Data association uses the Hungarian algorithm with a Mahalanobis gating threshold γ = 16 and SNR fingerprint consistency as a secondary cost term. IV. T ESTBED A RCHITECTURE A. Overview Fig. 2 illustrates the end-to-end testbed comprising five integrated components: (1) an OAI gNB carrying the ISAC PHY sensing stage, (2) an OAI nrUE acting as the SRS transmitter, (3) FlexRIC Near-RT RIC with ISAC EKF xApp, (4) Sionna RT channel emulator, and (5) real-time sensing dashboard. All components run as Docker containers orchestrated as a single container stack, so that a run is reproducible from the parameters and seeds reported in Section VI-F. B. OAI gNB and nrUE The gNB is instantiated using OpenAirInterface 5G NR [24] in monolithic CU+DU mode. It operates on Band n78 (3.32 GHz) with a 40 MHz channel bandwidth, 30 kHz subcarrier spacing (numerology 1), and 106 PRBs. The time-division duplex (TDD) frame structure is DDDDDDSUU (7 DL + 2 UL slots per 5 ms half-frame). The gNB is equipped with Nrx = 4 receive antenna ports modeled as a half-wavelength ULA. The nrUE is the illuminator: a ground-level, networkregistered UE that transmits UL-SRS as part of normal uplink operation. The UAV is not a network subscriber — the UAV is a passive, non-cooperative scatterer that reflects the UE’s SRS towards the gNB. Nothing is mounted on the target, which is what makes the geometry bistatic and the sensing passive. It is configured with Ntx = 4 transmit antennas forming a halfwavelength ULA (4-element nrUE TX ULA), and transmits periodic UL-SRS with a period of TSRS = 10 ms (one burst per 20 slots) across the full 40 MHz bandwidth. An ISAC sensing hook inserted into the OAI gNB PHY uplink channel-estimation stage intercepts per-SRS occasion channel estimates Ĥ[nrx , k] for each of the Nrx receive ports after minimum mean-square error (MMSE) channel estimation. These are accumulated in a CPI ring buffer until Nocc = 64 bursts are collected, then forwarded to the sensing pipeline (Section V). C. Detection Report and Transport FlexRIC [25], [26] provides the Near-RT RIC hosting the ISAC EKF xApp. Each CPI, the gNB emits a detection report: a schema version, a detection count, a CPI timestamp, and one record per detection. Table II specifies the fields, their units and their valid ranges, so that the report can be reproduced without reference to our implementation.

TABLE II: Per-CPI detection report. One header per CPI, one record per detection. Field

Units

Range

Notes

Header (once per CPI) schema version detection count CPI timestamp

— — µs

— 0–16 monotonic

report format revision CFAR cap per CPI anchors the latency chain

Per detection excess bistatic range

m

0–85

bistatic range rate

m s−1

±4.5

azimuth (AoA at gNB) target-cell echo SNR

◦

−90–+90 —

∆Rbi , (5); 1.22 m bin; scene-gated signed; ±Nyquist at the 100 Hz pulse repetition frequency (PRF) ENU convention, (1) per-detection rangeDoppler cell SNR (echo power over local noise); median 23.1 dB at the operating point, characterized in Appendix A (Fig. 13)

dB

Transport. We define SM-SENS, an E2 service model that carries the report of Table II as a RIC INDICATION from the gNB’s E2 agent, through the Near-RT RIC, to the subscribing xApp. The xApp issues a RIC SUBSCRIPTION for the SMSENS RAN function, and the agent then emits one indication per CPI over the standard E2 Application Protocol (E2AP) subscription/indication machinery — the same path every other FlexRIC service model uses. This is the path that carries the detections evaluated in this paper. A second, non-E2 delivery path exists — a direct in-memory queue between the gNB and the xApp — retained as a lowlatency reference against which the E2 path can be compared (Appendix D). The two are selectable at run time, and we report both. To verify that the E2 path genuinely carries the data rather than merely being subscribed, we disable the queue entirely and confirm that the number of indications the xApp receives equals the number of CPIs the gNB detected in: with the queue off, delivery is one-for-one. The scope of SM-SENS should be clear. It follows the structural pattern of an existing service model and uses the same E2AP procedures, but it has no ASN.1 specification (its payload uses the plain encoding FlexRIC’s other custom service models use), and it has not been tested for interoperability against any other RIC or E2 node. It should be read as a working demonstration of what a sensing service model must carry — the field set in Table II — rather than as a standards contribution. An ASN.1-specified, interoperabilitytested E2SM remains future work. The xApp decodes the report, runs the bistatic EKF tracker (Section III), and publishes per-track state to a key-value store at each CPI for the dashboard to poll. D. Sionna RT Channel Emulation A Sionna RT [30] server computes, once per simulation step, a ray-traced static channel impulse response (CIR) between the gNB and nrUE (direct/multipath taps: per-path delay and complex gain) together with per-UAV bistatic echo

7

measured (per pair i): excess path ∆Rbi,i = RT + RR,i − Li

vT UAV pT , vT

RR,2 RT

+ŷ

nrUE2 (SRS Tx)

L2

RR,1

θaz

htgt

+x̂ (boresight)

direct path

hgNB nrUE1 (SRS Tx)

gNB 4-el. ULA elevation plane (side view) — UPA UAV θel

baseline L1 = |pG − pU | 1

pz

gNB z = [R, v, θaz , θel ] → pz

Fig. 1: UL-SRS sensing geometry with the multistatic extension. Each nrUE transmits SRS; the single gNB receives, for each transmitter, the direct path and the UAV echo, and measures delay relative to the direct path, so the per-pair observable is the excess bistatic path ∆Rbi,i = RT + RR,i − Li (the tracker restores the total path by adding the known baseline Li ). Azimuth θaz is the angle of arrival at the gNB’s own 4-element ULA, from the +x̂ boresight towards +ŷ (Section III-A), subtended at the array phase center at antenna height hgNB . The baseline single pair (nrUE1 ) gives no elevation observability, so target height htgt is a prior. Two independent upgrades can make it observable. Adding a second nrUE (nrUE2 ) forms a second bistatic pair sharing the gNB receiver, whose range diversity fixes altitude through geometry alone (Section VIII; measured, and the most accurate of the configurations reported). Alternatively, a planar array (UPA) at the gNB resolves the orthogonal vertical plane shown in the inset: it measures an elevation angle θel , extending the per-pair measurement to [R, v, θaz , θel ] so the 3-D EKF estimates altitude pz directly (Section VII). Either way htgt is estimated rather than assumed. direct queue (reference)

Sionna RT ray tracer paths, echo params OAI nrUE (SRS Tx)

UL-SRS

Channel emulator CIR conv. · UAV echo inject. calibrated thermal-noise AWGN

IQ

OAI gNB NR PHY + UL-SRS sensing stage

E2 / SM-SENS (measured)

Near-RT RIC (FlexRIC)

EKF xApp bistatic tracker

tracks

Dashboard

single container stack

Fig. 2: Testbed architecture. The nrUE’s UL-SRS is propagated through a ray-traced channel with UAV echo injection and calibrated thermal noise, and the gNB’s PHY sensing stage produces per-CPI detections. Solid arrows carry the measured results: each CPI’s detection report is sent as a RIC INDICATION for the SM-SENS service model, through the Near-RT RIC, to the subscribing EKF xApp. A direct in-memory queue (dashed, gray) is retained as a low-latency reference for the transport comparison of Appendix D.

parameters (bistatic delay, Doppler shift, complex amplitude), serving both via a REST API to the channel emulator container. Uplink and downlink share the same underlying ray trace rather than requiring a second PathSolver run: by TDD reciprocity the downlink CIR is the transpose of the uplink T CIR, Hdl = Hul , computed once and cached alongside the uplink result. The channel emulator acts as an rfsimulator proxy between the nrUE and gNB, running independently on the uplink and downlink IQ streams. Each direction convolves the clean transmitted signal through its static CIR tap(s) and adds the UAV echoes (delay, Doppler, complex amplitude) before an absolute link-budget calibration stage injects thermal-noise-referenced AWGN, applies a headroom-safe automatic gain, and quantizes to the wire’s fixed-point (16-bit) in-phase/quadrature (IQ)

format (Table IV and Section IX). UAV motion is modeled using a 3D kinematic state (position, velocity, radar crosssection [RCS]) with Gauss-Markov hovering and constantvelocity transit modes. E. Sensing Dashboard A real-time web dashboard (Python/FastAPI with an HTML5 canvas frontend) provides operator situational awareness: a live top-down tracking map of UAV ground-truth positions, EKF track estimates and velocity vectors; an EKF position-error time series (∆x, ∆y per UAV); and a parameter summary table, refreshed by HTTP polling against a state endpoint. All state is exchanged through the key-value store, so the dashboard is stateless, and it supports live debugging and post-run playback of the recorded state history.

8

V. UL-SRS S ENSING P IPELINE

C. Range-Doppler Map and CFAR

The full sensing pipeline executes in two stages: (i) the gNB PHY sensing module (C, FFTW, runs per CPI at TCPI = 640 ms) and (ii) the ISAC xApp EKF tracker (Python, runs on the Near-RT RIC per SM-SENS indication). This split keeps computationally intensive signal processing close to the PHY while allowing algorithmic sensing logic to evolve independently as an xApp.

A. SRS Resource Configuration UL-SRS is configured with periodicity TSRS = 10 ms (one SRS burst per 20 TDD slots at 30 kHz SCS). The coherent processing interval spans Nocc = 64 consecutive SRS bursts, yielding TCPI = Nocc · TSRS = 640 ms and a bistatic Doppler resolution of ≈ 0.14 m s−1 at fc = 3319.68 MHz.

B. Clutter-Subspace Deflation Let H ∈ CNocc ×K collect one receive port’s channel estimates over a CPI, its rows the Nocc slow-time occasions and its columns the K packed subcarriers. The disturbance — the direct path and the static ground return, which after interoccasion phase-ramp carrier-frequency-offset (CFO) compensation are constant across slow time — occupies the dominant left singular subspace of H. It is removed by deflating the leading Kc such directions: H(0) = H, ui = arg max uH H(i−1) 2 , ∥u∥=1
(i) (i−1) (i−1) H =H − ui uH , i H

(21) i = 1, . . . , Kc ,

(22)

each ui being obtained by power iteration on H(i−1) H(i−1)H without forming the covariance explicitly. The result H(Kc ) is the clutter-canceled estimate Ĥ UAV used in (10). Cancellation operates on the current CPI only, with no memory across CPIs. Relation to ECA. This is a reference-free subspace deflation, and not as the Extensive Cancellation Algorithm (ECA) of the passive-radar literature [40]. ECA projects the surveillance channel onto the orthogonal complement of a subspace spanned by delay- and Doppler-shifted replicas of a separately acquired reference channel; here the disturbance subspace is instead estimated from the surveillance data itself, as its dominant slow-time singular subspace. The two share a goal — suppressing the zero-Doppler direct and static returns — but not a mechanism. We adopt the subspace form because the gNB has no separate reference receive chain to supply ECA’s replica bank. In the flat-LOS single-target scene the rank must be held at Kc = 1: the UAV echo is the second-strongest return, so a rank Kc ≥ 2 deflation subtracts the target itself and leaves only a smeared residual (Section IX). Scenes with additional strong static multipath (e.g. building bounces) require a higher, scene-dependent rank, which we do not exercise in the flatLOS evaluation here.

The 2D map of (10) is computed per receive antenna using zero-padded transforms (range: 4096 points, Doppler: 128 points) and non-coherently combined: Xcomb [m, n] =

Nrx X

|Xi [m, n]|2 .

(23)

i=1

The range transform is an inverse DFT, since the delay/range profile of a frequency-domain channel is h(τ ) = IDFT{H(f )}. Order-statistic CFAR (OS-CFAR [38], 75th percentile training statistic, robust to the target’s own mainlobe leakage) is applied with guard window (Ng,R , Ng,D ) = (14, 5) cells and training window (Nt,R , Nt,D ) = (28, 8) cells, PFA = 10−4 , up to a maximum of 16 detections per CPI. A single-peak non-maximum suppression (NMS) — which keeps only the locally strongest range-Doppler cell and discards weaker cells within a fixed radius around it — with a range radius of 18 bins then groups each target’s comb-least-squares window sidelobes into one detection, so a single physical target yields a single detection per CPI. D. Azimuth Estimation: Single-Snapshot Interferometric AoA Estimator. Let a = [a0 , . . . , aNrx −1 ]⊤ denote the complex range-Doppler cell values of a detected target across the Nrx = 4 receive ports. For a single dominant scatterer on a halfwavelength ULA, ap = s e jπp sin θ + np : the inter-element phase step is π sin θ, and averaging it over the three available baselines gives the bearing in closed form, !! NX rx −2 1 ∗ ap+1 ap . (24) arg θ̂ = arcsin π p=0 This is a single-snapshot interferometric (adjacent-element phase-difference) estimator. For a single source on a uniform linear array with unit inter-element displacement it coincides with the least-squares ESPRIT (estimation of signal parameters via rotational invariance techniques) solution over maximally-overlapping subarrays [41]; we describe it as ESPRIT-type only in that reduced sense and do not invoke the subspace machinery. It is unambiguous for | sin θ| < 1 and, at high SNR away from endfire, approximately unbiased; its bias grows toward endfire, as the error breakdown below and in Section VI shows. It produces every bearing reported in this paper. Array geometry. The four spatial channels are the gNB’s own 4-element half-wavelength Rx ULA, read directly from its four receive chains. The array lies along ŷ with boresight +x̂ (Section III-A), which gives a signed, monotonic phase ramp as the target crosses broadside and resolves the sign ambiguity an endfire orientation would suffer over this target corridor. Element geometry is encoded by the ray tracer’s own per-element path solving. Limitations. The 4-element aperture is modest: we assign σθ ≈ 9◦ in the filter (against ≈ 30◦ for a 2-element ULA), which comfortably bounds the measured bearing error of 7.0◦ over a full transit (Section VI). The error is not uniform across the transit: it is smallest near broadside and grows as

9

the target approaches endfire, where the inter-element phase ramp of (24) becomes insensitive to bearing. Cross-range uncertainty therefore grows linearly with range (Section IX). Because the array is one-dimensional, (24) resolves azimuth only and cannot disambiguate elevation, so target height is not sensed and is instead supplied as a prior (Table III). E. EKF xApp Integration Detections passing the CFAR threshold are assembled into a per-CPI detection report (Table II) and delivered to the NearRT RIC over the transport described in Section IV-C. On receipt the xApp first restores the baseline, R̂bi = ∆R̂bi + L ((5)), converting the reported excess range into the total path length that (14) expects. It then performs Hungarian data association with a Mahalanobis gate of γ = 16, and runs one EKF predict-update cycle per track per CPI. Track management follows 1-of-1 initiation (any ungated detection spawns a track) and a coast limit of 5 missed CPIs before deletion. Because any ungated detection spawns a new track, CPIs carrying more than one detection can seed spurious tracks; this initiation policy is the direct cause of the 2.6 ± 0.5 track identifiers per run reported in Table V, and it is analyzed in Section VI. The active track state is written to the key-value store for dashboard display. VI. E VALUATION AND R ESULTS A. Simulation Setup Experiments are conducted using the parameters listed in Tables III and IV. The gNB is placed at (−75, 0, 10) m and the nrUE at (55, 0, 1.5) m, giving a bistatic baseline L = 130 m along the main street corridor. A UAV performs a horizontal transit at fixed x = 27 m and altitude z = 55 m (above rooftop level, line-of-sight), flying south-to-north along +y at 2 m s−1 from y = −40 m to y = +42 m. This trajectory carries the target through the array broadside near y = 0, so a single run exercises the full signature of interest: the bistatic range sweeps to a minimum and back, the radial velocity reverses sign through the crossing, and the azimuth sweeps through boresight. The UAV is modeled as a diffuse sphere (radius 3 m, scattering coefficient 0.9), whose mean bistatic radar cross-section measures 13.9 dBsm — about 0.6 dB below its πr2 optical limit of 14.5 dBsm. This is a deliberately strong reference target; the RCS ladder of Fig. 13 scales it down to the realistic small-UAV band (−20 to −10 dBsm) at which PD is reported. Ground truth positions are provided by the channel emulator’s UAV kinematic model and published to the key-value store for real-time comparison with EKF estimates, and the full run is additionally recorded as an annotated trajectory video (ground truth vs. EKF estimate) for qualitative inspection. The evaluation scene is the flat-LOS benchmark (Fig. 4a); results use the Sionna RT ray-traced channel model, providing ray-traced echo coefficients (bistatic delay, Doppler shift, complex amplitude) for the UAV at every simulation step. Two counts appear in this paper and are kept strictly separate: N is always a number of runs, and n is always a number of pooled per-CPI samples. n is used only for

TABLE III: Radio and Sensing Configuration Parameter

Value

NR Band (carrier) Subcarrier spacing Channel bandwidth

n78, fc = 3319.68 MHz 30 kHz (numerology 1) 40 MHz nominal; 106 PRBs = 38.16 MHz occupied DDDDDDSUU (7+2 per 5 ms) 4 (half-λ ULA) 4 (half-λ ULA) gNB Rx: array along y-axis, boresight +x (east, broadside to the target corridor, giving a signed and resolvable azimuth); nrUE Tx: array along x-axis, boresight +y (north) Isotropic; both gNB Rx and nrUE Tx

TDD pattern gNB Rx antennas (Nrx ) nrUE Tx antennas (Ntx ) Antenna ULA orientation

Antenna element pattern SRS occupied tones (MSRS ) SRS periodicity (TSRS ) CPI length (Nocc ) CPI duration (TCPI ) Range resolution (∆Rres ) Doppler resolution (∆v) Wavelength (λ) Clutter-deflation rank (Kc ) CFAR type CFAR guard (range, Doppler) CFAR training (range, Doppler) CFAR PFA Single-peak NMS range radius Max detections per CPI EKF σR EKF σv EKF σθ EKF σa (process noise) Mahalanobis gate (γ) Coast limit Height prior htgt (2-D EKF)

624 (comb-2, every 2nd subcarrier over 106 PRBs; 1272 subcarriers total) 10 ms 64 occasions 640 ms 8.0 m (c/BSRS , BSRS ≈ 37.4 MHz SRS aperture, total bistatic path); zeropadded bin 1.22 m 0.14 m s−1 (λ/TCPI ); 0.07 m s−1 zero-padded bin 0.0903 m 1 (direct path is the sole strong static return in the flat-LOS single-target scene) Order-statistic (OS-CFAR), 75th percentile training 14, 5 cells (comb-LS range response) 28, 8 cells 10−4 18 range bins (groups a target’s window sidelobes into one detection) 16 8.0 m (≈ one resolution cell) 0.89 m s−1 (measured range-rate residual) 9◦ (4-el gNB Rx ULA, phase-ramp AoA; conservative vs. the measured 7.0◦ bearing error) 0.5 m/s2 16 5 CPIs 55 m — a deployment parameter (the expected UAV altitude band), not a quantity inferred from the measurements: a single bistatic pair has no elevation observability. Here it matches the scenario’s transit altitude; the cost of a mismatched prior is the ablation in Section VI

latency, where the per-CPI distribution — not the run-to-run distribution — is what matters. A single transit yields ≈ 79 observable CPIs. Metric definitions. Three reported quantities need stating precisely. Detection coverage is the fraction of observable CPIs in which the pipeline reports at least one detection. A CPI is observable when the ray tracer returns a UAV echo at all and the target lies outside the near-baseline blind zone. Lineof-sight visibility is the fraction of blind-zone-excluded CPIs that are observable in that sense; in free space it is unity, and in the street canyon it is the occlusion penalty. The two

10

gNB PHY

Near-RT RIC xApp

SRS channel estimates Ĥ[n, k, l]

comb-LS tone packing

phase-ramp (CFO) comp.

rank-Kc clutter subspace deflation

range IDFT × Doppler DFT

non-coh. combine (4 Rx)

OS-CFAR + single-peak NMS

phase-ramp AoA (interferometric)

detection report

Hungarian association

EKF predict/update

restore baseline R̂bi = ∆R̂bi + L

track store → dashboard

Fig. 3: UL-SRS sensing pipeline. The gNB PHY stage runs once per CPI: SRS channel estimates are packed gap-free across the comb, phase-ramp (CFO) compensated, and the dominant static (direct-path) subspace is deflated; a zero-padded range IDFT and slow-time Doppler DFT form the range-Doppler map, which is combined non-coherently across the four receive ports before OS-CFAR detection with single-peak grouping, and the bearing of the detected cell is estimated in closed form. The xApp restores the baseline to convert the measured excess bistatic range to a total path length before association and EKF update.

gNB UE −100−75 −50−25

−20 0 x (m) 25 50 75 −60−40 100 gNB

UE

0

20

40

m y(

gNB

bldg-6

bldg-2

bldg-1

bldg-5

UE

−100−75 −50−25

)

UAV (transit S–N)

bldg-4

bldg-3x=27 m · z=55 m UAV

−20 0 x (m) 25 50 75 −60−40 100

UAV transit path (y: −40→+42 m)

0

20

y(

40

90 80 70 60 50 40 30 20 10 0 60

z (m)

UAV x=27 m · z=55 m

90 80 70 60 50 40 30 20 10 0 60

(b) Street-Canyon — NLOS / Occlusion

z (m)

(a) Flat-Building — All-LOS Benchmark

m)

Bistatic path gNB→UAV→UE

Fig. 4: The two evaluation scenes, drawn to a common viewpoint and marker set. In both, the gNB sits at (−75, 0, 10) m, the nrUE at (55, 0, 1.5) m, and the UAV transits south-to-north (along +y) at x = 27 m, z = 55 m through the bistatic broadside. (a) Flat-LOS benchmark — the ray-traced canyon with all buildings removed, giving unobstructed line-of-sight throughout the transit. (b) Street-canyon NLOS/occlusion scene — the same geometry with the six buildings restored. The gNB at 10 m looks up past buildings reaching 51 m, so the gNB→UAV ray is intercepted for much of the transit even though the UAV flies above the rooftops at 55 m: the occlusion is set by the gNB height, not the target’s.

are reported separately, since a CPI in which the target is physically occluded is not a detection failure. Track continuity is the fraction of a target’s observable CPIs in which it is tracked at all — matched by at least one of its (possibly several) track fragments. With Cobs the set of observable CPIs and Cmatch ⊆ Cobs those in which some fragment of the target is associated, continuity =

|Cmatch | . |Cobs |

(25)

Scored over the union of the target’s fragments (as the ag-

gregator computes it, consistent with the position rows of Table V), continuity is coverage-complete: a target handed between several identifiers still counts as tracked at each CPI, so the shortfall below 100 % measures CPIs in which no fragment of the target is associated — an association/detection loss — not identifier churn. Identifier fragmentation is a distinct effect, reported separately as the per-run track count (Section VI-E); together the two say how often the target is tracked and across how many identifiers. Unless stated otherwise continuity counts only detection-associated CPIs;

11

TABLE IV: Simulation Scene and Target Parameter

Value

gNB / nrUE TX power (calibrated label)

33 / 23 dBm — rfsimulator’s baseband IQ loopback has no physical RF stage and transmits at a fixed digital amplitude regardless of configured power, so these are calibration-constant labels assigned to that invariant waveform, not power-control targets 5 / 9 dB; thermal noise (kB T0 B) is injected as calibrated AWGN at this NF (plus a configurable interference-overthermal margin, 0 dB here) after the CIR convolution stage (Section IV)

gNB / nrUE receiver noise figure

UAV-A (transit)

gNB position UE position (bistatic baseline) Scene boundary (x, y) Channel model

x = 27 m, z = 55 m, vy = 2 m s−1 , y : −40 → +42 m (south-to-north transit through the baseline broadside), sphere target, diffuse scattering 0.9 (−75, 0, 10) m (55, 0, 1.5) m, L = 130 m [−100, 100] m, [−60, 60] m Sionna RT (ray-traced echo injection; low-permittivity dry-ground floor, buildings removed for the flat-LOS benchmark)

the coast-bridged variant (Section VI-E) additionally counts a CPI spanned by a confirmed track’s predicted (coasted) state, and is thus a track-level figure that includes bounded predicted coverage between measurements. Finally, CPIs falling inside the near-baseline blind zone are excluded from the measurement statistics. As the target crosses the baseline the bistatic angle approaches 180◦ , the excess range approaches zero and the geometry degenerates (Section III); reporting a range or Doppler error there would measure the geometry’s singularity, not the pipeline’s accuracy.

B. Calibration Validation The link budget underlying Table IV’s noise-floor and TXpower entries is cross-checked against closed-form references before being trusted for the results below. For the direct UE→gNB path (d = 130 m at fc = 3.32 GHz), free-space path loss gives FSPL ≈ 85.1 dB, which against the 23 dBm UE TX power predicts a received level of ≈ −62 dBm – consistent with the emulator’s calibrated digital-to-dBm mapping (Section IV). The injected thermal noise floor is set from −174 + 10 log10 (38.16 MHz) + NF, with NF = 5 dB at the gNB, giving ≈ −93.2 dBm; a representative UAV echo (RT ≈ 110 m from gNB to the above-rooftop target, RR ≈ 60 m from target to UE) lands well below the per-sample noise floor and is recovered only via the ∼ 50 dB coherent processing gain of the 640 ms CPI – the expected regime for a physically-calibrated ISAC link. These three anchors (FSPL, thermal floor, echo level) are computed analytically from the same constants the emulator uses at runtime; a full numerical cross-validation against the Sionna RT-reported path gains and an in-loop dBm audit at each proxy stage (analogous for RSRP consistency) are left as follow-up verification work.

C. Filter Consistency: NIS and NEES Calibrating the link budget establishes that the measurements are physically sound; it says nothing about whether the tracker’s assumed uncertainty matches its actual error. The two standard consistency statistics test that directly, checking the filter’s self-reported confidence against its observed error. The normalized innovation squared, NIS = ỹ⊤ S−1 ỹ, uses only the innovation ỹ and its covariance S = HPH⊤ + R and therefore needs no ground truth; under a correctly specified filter it is χ2 -distributed with dim(z) = 3 degrees of freedom, so E[NIS] = 3. The normalized estimation error squared, NEES = e⊤ P−1 e with e = x̂ − xtrue , requires ground truth and tests the state covariance itself, with E[NEES] = dim(x) = 4. Measured over the flat-LOS campaign, the two disagree in opposite directions. NIS averages 0.55 against an expected 3 — conservative, indicating that the assumed measurement covariance is if anything too large for the innovations actually observed. NEES, by contrast, averages 23.29 against an expected 4 — over-confident, the state covariance roughly six times smaller than the estimation error it is supposed to describe. A filter whose R is merely mis-scaled cannot produce this combination, because rescaling R moves the two statistics in the same sense: inflating R to pull NEES down drives NIS further below its expectation, and shrinking R to raise NIS inflates NEES. The filter is already run with σv set from the measurement-minus-truth residuals — the range-rate error over a full transit is 0.89 m s−1 (N = 5), about six times the one-Doppler-cell 0.14 m s−1 a naive model would assume — yet NEES stays at 23.29, far above 4. No single choice of R makes the filter self-consistent: the residual over-confidence is structural (unmodelled cross-axis correlation and the heavytailed azimuth error of Section VI), not a scale error. The residual over-confidence is therefore not a mis-set covariance but structural, from two effects the two-dimensional filter cannot represent. First, the bistatic range estimate carries a consistent bias of about −8 m — roughly one range cell, against a residual spread of only 2.3 m — so the position error has a systematic component that repeated, mutually consistent measurements make the filter increasingly confident about rather than reveal. Second, a constant-velocity dynamic model with a fixed height prior in a two-dimensional state cannot represent the true motion and geometry closely enough for the covariance to be believed, however R is chosen. A filter that is optimistic by this margin should not have its uncertainty used for gating or fusion decisions downstream. It also identifies where the fix must come from: elevation is unobservable from a single bistatic pair with azimuth-only bearing, so removing the height prior requires multistatic geometry rather than a larger state vector (Section X). D. Range-Doppler Map Fig. 5 shows the Range-Doppler (RD) map of a representative mid-transit CPI before and after clutter suppression. Before clutter cancellation (Fig. 5(a)) a strong zero-Doppler ridge – the static direct UE→gNB path plus the ground bounce – dominates across all ranges. After a rank-1 clutter-subspace

12

TABLE V: UAV flat-LOS transit. Mean ± sample std over N = 5 independent runs differing only in the noise seed. Measurement rows compare the strongest detection per CPI against ray-traced ground truth; position rows are the downstream 2-D EKF. CPIs inside the near-baseline blind zone are excluded (Section III). OSPA and GOSPA are the (generalized) optimal sub-pattern assignment distances. Quantity

Value (N = 5 runs)

Measurement accuracy (per CPI, vs. ground truth) Excess bistatic range RMSE (m) Bistatic range-rate RMSE (m/s) Azimuth RMSE (deg), 4-element gNB Rx ULA Range-rate sign agreement (%)

8.66 ± 0.04 0.44 ± 0.12 7.02 ± 0.01 96.4 ± 0.7

Detection Detection coverage (% of observable CPIs) Single-detection CPIs (%) CFAR margin (dB above threshold)

92.7 ± 0.5 87.7 ± 1.7 15.2 ± 0.1

End-to-end 2-D EKF position (target, over all track fragments) Range (∆x) RMSE (m) 7.26 ± 1.88 Cross-range (∆y) RMSE (m) 5.32 ± 0.63 Track continuity (%) 54.2 ± 3.7 with coast-bridging (Section VI-E) 88.31 ± 0.90 Track identifiers per run 2.6 ± 0.5 with coast-bridging 3.00 ± 0.00 OSPA (c = 20 m, p = 2) (m) 13.60 ± 0.24 GOSPA (α = 2, c = 20 m) (m) 10.95 ± 0.28

deflation pass (Fig. 5(b)) this ridge is removed and the moving UAV emerges as a single compact peak at its true bistatic range and Doppler. Obtaining this clean single peak required two signalprocessing corrections to the gNB pipeline, each of which we found could otherwise fragment a single physical target into several competing detections (Section IX): (i) the deflation rank is held at Kc = 1 so that only the direct-path/static subspace is removed — in this flat-LOS single-target scene the target is the second-strongest return, and a higher rank subtracts the target itself; and (ii) a single-peak non-maximumsuppression radius wide enough to absorb the comb-leastsquares window sidelobes (±18 range bins) collapses the target’s main-lobe and sidelobes into one detection. With these in place, the RD map contains one dominant target peak per CPI over the whole transit. E. Detection and Tracking Performance Table V reports the pipeline’s performance on the flat-LOS transit, separating the raw measurement accuracy (the strongest detection per CPI compared against ray-traced ground truth) from the downstream 2-D EKF position accuracy. The two answer different questions — what the gNB measured, and where the tracker put the target. At the measurement level the pipeline is clean. It produces a detection in every observable CPI of the transit, and the strongest detection tracks the target’s excess bistatic range to 8.7 m root-mean-square error (RMSE), its bistatic range rate to 0.44 m/s, and its azimuth to 7.0◦ . All three characteristic signatures of a broadside transit are recovered as a single smooth track: the range sweeps to a minimum near the y = 0 crossing and back out; the range rate passes through zero and

reverses sign (approach → recede); and the azimuth sweeps monotonically through boresight (Fig. 6). The range figure is the one governed by the corrected definition of Section III. A range RMSE of 8.7 m sits at about one 8.0 m resolution cell of (11) — slightly above it. This is not sub-resolution-cell accuracy: the error is dominated not by how precisely an isolated peak can be located (which the 1.22 m zero-padded bin spacing would allow to be far finer) but by the geometry at the ends of the transit, where the target approaches endfire and both the range and the bearing estimate degrade. Averaged over the whole transit the pipeline therefore delivers about one resolution cell of range accuracy, and the run-to-run spread (Table V) reflects how much of the poor-geometry tail a given noise draw happens to survive. Fig. 7 makes this geometry dependence explicit: binned against the bistatic angle β (at the target, between the target–gNB and target–nrUE rays), the range error grows by 1.34× from broadside toward the low-β transit ends and the azimuth error by 1.94× (correlations −0.51 and −0.24 over 368 target-matched CPIs). Because the target is high (z = 55 m) and the baseline single, β itself stays within 81–94◦ — a narrow angular diversity that is a limitation of the single-pair geometry and a further motivation for the multistatic extension of Section X. Downstream, the 2-D EKF tracks the target to 7.3 m in range (∆x) and 5.3 m in cross-range (∆y). To avoid rewarding identifier fragmentation (below), each figure is computed over the target’s entire set of track fragments — at every CPI the estimate closest to ground truth is scored; this makes the numbers coverage-complete and reproducible run to run. Those two figures therefore describe the accuracy of the union of the target’s tracks, and that is a different quantity from the accuracy of any one of them. Because the union is scored per CPI at whichever fragment is closest, its accuracy improves with the number of fragments. Scored that way, over the one track that carries the target for the largest share of the transit, the same runs give a 2-D position RMSE of 14.28 ± 0.34 m. Both are reported here deliberately: the pooled figure answers “how well was the target covered”, the singleidentifier figure answers “how good is the track a consumer acts on”, and the gap between them is a direct measure of the fragmentation quantified below. The cross-range figure is about one 8.0 m range cell, at the measurement floor. The range figure is several cells larger, and it is not additional measurement error: the measurement-level range RMSE is only 8.7 m. It is the amplification incurred when the 2-D filter converts the bistatic slant range to a ground-plane x under a single elevation prior — largest near the transit ends, where the target approaches array endfire and the ellipse-toground mapping is most sensitive to residual range and bearing error. A filter with elevation observability (a 3-D state, or a second receiver) would relax this term; within the 2-D filter it dominates ∆x. This qualifier is why σR is treated as a result rather than a detail. Because a single bistatic pair provides no elevation observability, the 2-D filter must convert the measured slant range to a ground range using the height prior htgt (Table III), and it must weigh that range against the bearing using σR .

40

2

20

0

0

−2 −4

0

20

40

60

80

−20 −40 −60

Bistatic Range Rbi (m)

(a) Before clutter cancellation

ΔRbi = 8.0 m, Δv = 0.14 m/s

4 2

0

0

−20

−2

−40

−4

−60

0

20

40

60

80

Power (dB)

4

Bistatic Doppler velocity vbi (m/s)

ΔRbi = 8.0 m, Δv = 0.14 m/s Power (dB)

Bistatic Doppler velocity vbi (m/s)

13

Bistatic Range Rbi (m)

(b) After deflation + single-peak detection

Fig. 5: Range-Doppler map of the same CPI — the first of the transit (CPI 0, UAV at y ≈ −39 m, approaching) — before and after clutter cancellation, at ∆Rres = 8.0 m range and ∆v = 0.14 m s−1 Doppler resolution over a 64 × 10 ms CPI. (a) The static direct-path/ground ridge dominates at zero Doppler; (b) after rank-1 clutter-subspace deflation and the singlepeak corrections of Section VI-D, the moving UAV survives as a single compact peak at (Rbi , vbi ) ≈ (54 m, +1.6 m s−1 ), matching the ray-traced ground truth (59.5 m, +1.74 m s−1 ) to within the range bias of Section VI.

Get either wrong and the position degrades even though the measurement is untouched — which is precisely what Table VI shows. Track fragmentation. Fig. 9 overlays the EKF state estimates on the ground-truth transit in the ground plane. The estimated track follows the south–north transit over its full extent. The transit is covered by 2.6 ± 0.5 track identifiers rather than one: the tracker’s association gate opens a new identifier whenever a run of CPIs yields more than one detection and the incumbent track is not the one updated. This is an identifier limitation, not a coverage one — the fragments all lie on the same true trajectory, and scored over all of them (as Table V’s position rows are) the target is tracked for 54.2% of its observable transit. As single-number multi-target scores the transit yields an optimal sub-pattern assignment (OSPA) of 13.60 ± 0.24 m and a generalized OSPA (GOSPA) of 10.95 ± 0.28 m (c = 20 m, p = 2); the GOSPA decomposition — localization 4.09 ± 0.60 m, missed 6.57 ± 0.42 m, false 0.47 ± 0.18 m — shows the error is split between localization and the missed CPIs of an intermittent track, with a negligible false-track term, i.e. the fragmentation costs identifier continuity rather than spawning spurious targets. The tracker already applies the standard consolidation stack — M -of-N track confirmation, intra-CPI detection clustering, predicted-measurement (Mahalanobis) gating, adaptive coast, and track merging with duplicate removal — which suppresses spurious identifiers but does not, on its own, hold a single identifier across the periodic multi-detection CPIs. The timedriven maintenance pass described next recovers most of this continuity by keeping a confirmed track alive across detection gaps, but it does not reduce the identifier count — a republished coasted track is not merged with the fragment that later re-confirms, so continuity and identity move independently. Collapsing the transit onto a single stable identifier remains for future work: graph-based or joint probabilistic data association

(JPDA), or admitting more than one detection per track per CPI, would consolidate the fragments directly. Two properties of the identifier count reported here should be read carefully. It is measured over a fixed pool of three track slots, so it is bounded above by three; and because a released slot is immediately reusable, two tracks that are disjoint in time can share one identifier and be counted once. The figure is therefore a lower bound on the number of distinct tracks the transit is split into, and the identity metrics of the multiobject-tracking literature (identity switches and IDF1, which are invariant to identifier relabelling) are the sounder basis for comparison. Fig. 8 locates the switches for the baseline tracker (coast-bridging disabled): pooled over five seeds they number 38 (∼7.6 per transit) and, rather than clustering at the endfire ends where the geometry is worst, they fall throughout the transit and if anything concentrate near broadside — consistent with the cause being per-CPI detection dropouts (a CPI carrying two returns re-spawns the track) rather than a geometry-specific failure. Time-driven coast-bridging. The tracker is detectiondriven: it advances a track only on a detection that is both delivered over the E2SM-SENS service model and associated to that track. Per-CPI detection is near-complete — the target is detected on the large majority of CPIs, with a median interdetection gap of only 0.6 s and a longest gap of 1.9 s — so the baseline’s 100 − 54.2 ≈ 46 % continuity shortfall is not a detection problem but a track-management one. Azimuth scatter from the four-element aperture spreads the per-CPI cross-range estimate enough that detections intermittently fall outside the association gate; the track then receives no update, its published record expires, and it must re-confirm before it reappears — the 38 identifier switches of Fig. 8 are the visible symptom. Each expire–reconfirm cycle blanks the target picture even though the filter still holds a valid posterior. We close these update gaps with a light time-driven main-

60

ground truth measured (Det. 0)

|error| (m)

50 40 2

|error| (m/s)

20

Azimuth (deg)

5 4

−2

0

−40

−20

0

20

40

UAV north coordinate y (m)

Fig. 6: UAV flat-LOS transit: the strongest detection per CPI (Det. 0) vs. ray-traced ground truth, over the UAV’s north coordinate y. The bistatic range (top) sweeps to a minimum at the y = 0 broadside crossing and back; the radial velocity (middle) passes through zero and reverses sign (approach → recede); and the azimuth (bottom) sweeps monotonically through boresight. The green curve is the signed ground truth; orange markers are the measurements.

tenance pass that, once per second, forward-extrapolates each confirmed track’s posterior along its constant-velocity model and republishes it, flagged as a coasted (predicted, not measured) estimate. Bridging is capped at 8 s: beyond that a pure prediction is no longer trustworthy, so the record is allowed to lapse and the gap is reported honestly as a loss of track rather than papered over. The pass reads filter state only — it never advances the filter — so the next associated detection updates from the clean posterior and measurement accuracy is unchanged. With coast-bridging enabled, flat-LOS track continuity rises from 54.2 ± 3.7% to 88.31 ± 0.90% (N = 5). Position accuracy, reported over measured CPIs only (coasted predictions excluded), is unchanged within run-to-run spread: range RMSE 6.97 ± 0.69 m and cross-range 4.44 ± 0.27 m. Bridging restores temporal continuity but not single-identity tracking: the transit is still covered by 3.00 ± 0.00 identifiers per run (2.6 ± 0.5 without bridging), since republishing

binned mean

10

0

−20

(a) range

15

(b) Doppler binned mean

2 0

40

|error| (deg)

Radial velocity (m/s)

Bistatic range (m)

14

20 0

(c) azimuth endfire (transit ends)

85

binned mean

90

bistatic angle β at target (deg) Fig. 7: Absolute measurement error versus bistatic angle β (angle at the target between the target–gNB and target–nrUE rays), pooled over five seeds (368 target-matched CPIs; scatter plus binned mean). Range (a) and azimuth (c) error grow toward endfire — the low-β transit ends (shaded) — with endfire/broadside ratios of 1.34× and 1.94×. Doppler (b) is the exception, degrading toward broadside where the signmirror ambiguity is strongest.

a coasted track does not merge it with the fragment that later re-confirms — consolidating the fragments would need association-level work (e.g. JPDA), left to future work. The residual 100 − 88.3 ≈ 12 % is track initiation and reconfirmation latency — the CPIs before a confirmed track first exists, which a pass operating only on already-confirmed tracks cannot fill — not detection dropouts, whose longest run (1.9 s) sits well inside the 8 s bridging horizon.

15

y (m)

(a) switch locations, seed 1001

gNB GT transit gNB nrUE ID switch (n=8)

−50

nrUE

-37 -39

50

count

broadside

5

−20

0

20

gNB −50 gNB nrUE GT UAV-0

-18 -21

0

0

nrUE

−25

+16 +14 +9 +7

x (m) (b) pooled over 5 seeds (n=38) 0

25 y (m)

40 30 20 10 0 −10 −20 −30 −40

40

switch y-location (m) [all seeds] Fig. 8: Track-ID-switch locations for the single-UAV transit, baseline tracker (coast-bridging disabled). (a) Ground-plane view (seed 1001): the ground-truth transit with gNB/nrUE, each × marking a CPI where the target’s matched track identifier changes. (b) Switch locations pooled over all five seeds (N = 38). Switches occur throughout the transit and, if anything, concentrate near broadside rather than at the endfire ends — fragmentation is driven by per-CPI detection dropouts, not a specific geometry. Coast-bridging (Section VI-E) restores continuity but not single-identity tracking: the per-run identifier count is 2.6 ± 0.5 without bridging and 3.00 ± 0.00 with it.

Two ablations. Table VI isolates the two tracker parameters that could plausibly be suspected of doing the work, re-running the same five seeds with each changed in turn. In both, the measurement rows are unchanged within run-to-run variation: both parameters live in the tracker, not in the gNB, so neither can affect what is detected. Height prior. With the prior mismatched to a low-altitude class (htgt = 15 m against the true 55 m), the range (∆x) RMSE degrades from 7.3 m to 33.7 m. The mechanism is geometric: with too low an assumed height, h(x) can only reconcile the measured slant range by placing the target at a farther ground range, biasing x̂ outward. Cross-range

0 50 x (m) EKF track-0 RMSE=5.8m EKF track-1 RMSE=3.3m EKF track-2 RMSE=2.7m

Fig. 9: Flat-LOS transit in the ground plane: EKF position estimates (solid) against the ray-traced ground-truth UAV path (dashed), with the gNB and nrUE at their scene positions. The estimates follow the south–north transit over its full extent. The transit is covered by several track identifiers because the association gate re-spawns a track through the multi-detection CPIs; the fragments all lie on the same true trajectory and are scored together, so the reported position accuracy and continuity reflect the target’s full observed track rather than a single fragment. Only states updated by a real detection are drawn (baseline tracker; the coast-bridging pass of Section VI-E, which republishes predicted states through detection gaps, is disabled here). Representative run (seed 1001).

degrades by a comparable factor (8.5 m vs 5.3 m). Scored over the target’s full track (Section VI-E) the mis-specified prior therefore degrades the estimate in both dimensions rather than biasing range alone: the outward-biased state also weakens the association of subsequent detections, so the penalty does not stay confined to the radial direction. The radial bias remains the primary mechanism — it is what h(x) can misresolve — but its cost is paid across the whole track, which is why the height prior is reported as a first-order deployment parameter rather than a tuning detail. This sensitivity is the clearest motivation for removing the prior altogether: a 3-D EKF that carries an altitude state, fed by either a vertical receive aperture or a second bistatic pair, makes the position independent of any assumed height. Sections VII and VIII realize exactly those two routes and measure both live. Range noise. Setting σR to the monostatic c/(2B) = 4.0 m — the value the corrected definition of (11) rules out — makes the filter over-trust range by a factor of two. Over the full transit this turns out not to move the position estimate significantly: ∆x RMSE is 10.1 m against 7.3 m at the correct σR , a difference well inside the run-to-run spread. The position error here is set by the height prior and by the bearing, not by how much the filter trusts range.

16

TABLE VI: Ablations, paired by seed: each column repeats the same N = 5 runs with a single parameter changed. Left, the height prior is mismatched to a low-altitude class (true altitude 55 m); right, the EKF range noise is set to the erroneous monostatic c/(2B) value. The height prior and σR both live in the tracker, downstream of the gNB measurement, so the measurement rows are identical across the three columns by construction; we report them once and vary only the tracker rows below. (The three independent seeded runs agree on the measurement to within run-to-run noise, confirming the ablated parameter does not propagate upstream.) Quantity

htgt = 15 m (mismatched)

σR = 4.0 m (monostatic c/2B)

Baseline (correct)

Measurement (gNB) — tracker-independent, shared across columns Excess bistatic range RMSE (m) 8.7 Bistatic range-rate RMSE (m/s) 0.44 Azimuth RMSE (deg) 7.0 Detection coverage (%) 93 2-D EKF position — tracker-dependent Range ∆x RMSE (m) 33.7 Cross-range ∆y RMSE (m) 8.5 Track continuity (%) 46.1

F. Reproducibility Every quantity needed to rebuild this experiment is reported in the paper: the scene geometry and trajectory, the full parameter set (Table III), the detection report format (Table II), the link budget and noise figures used to calibrate the injected AWGN (Section VI-B), and the statistical protocol below. Runs differ only in the seed of the injected thermal noise. The five flat-LOS runs use seeds 1001–1005, and the NLOS and ablation campaigns reuse the same five seeds, which makes those comparisons paired: a difference between two configurations is then attributable to the parameter changed rather than to the noise draw. The UAV kinematics and the ray-traced propagation are deterministic given the scene, so the seed is the only stochastic input. Statistics are reported as mean ± sample standard deviation over the N = 5 runs, except for latency, which is pooled over per-CPI samples and reported with percentiles; we keep the two counts distinct and label them N and n respectively. VII. E LEVATION S ENSING WITH A P LANAR A RRAY The height-prior dependence above is a direct consequence of the one-dimensional aperture. We therefore replaced the horizontal ULA with a 2 × 4 (8-element) uniform planar array (UPA) at the gNB—4 columns along the azimuth (horizontal) baseline and 2 rows along the elevation (vertical) baseline, at λ/2 spacing—and reduced the nrUE to a single SRS transmit port, so the angle estimate is formed entirely at the gNB receive aperture. A rectangular array is separable: the inter-element phase ramp of (24) applies independently along each baseline, yielding azimuth from the horizontal ramp and elevation from the vertical one at no additional estimator complexity. The tracker is extended to a three-dimensional constant-velocity state [ px , py , pz , vx , vy , vz ] with measurement [ Rbi , vbi , θaz , θel ]; the height prior htgt is removed and altitude is estimated online. Observability. On the ray-traced 8-element channel—driven from the clean per-CPI target echo, with no thermal noise, CFAR miss, or residual CFO/timing—the separable estimator recovers both angles to ≈ 0.9◦ (azimuth) and ≈ 0.9◦ (elevation)

10.1 6.9 59.5

7.3 5.3 54.2

RMSE, and the 3-D EKF—initialized with a deliberately wrong altitude—converges to the true height with an RMSE of 1.8 m (position 2.4 m, NEES ≈ 3.5). Altitude is thus observable from a single bistatic pair once a vertical aperture is present: the prior is no longer required. These two angle figures are a noiseless floor rather than an aperture-limited accuracy, and should not be read as what the short vertical baseline delivers: transposing the array to 4 × 2 exchanges the long and short baselines—which would move an aperturelimited error on each axis by their length ratio, 1.5λ against 0.5λ, a factor of three—yet leaves both essentially unchanged (azimuth 0.92◦ , elevation 0.86◦ ). What the ideal channel establishes is that elevation is estimable at all once a vertical baseline exists; what it costs in practice is the live per-CPI figure reported below, which is an order of magnitude larger. Altitude in the live pipeline. Driven end-to-end through the real gNB DSP—CFAR detection, comb-LS channel estimation, ECA and the residual CFO/timing of the SDR chain— the separable estimator is exercised end-to-end. Over N = 5 seeded transits (the same seed set and stack as the multistatic configurations of Section VIII, so the comparison in Table VII is paired), the 3-D EKF resolves altitude to a height RMSE of 5.3 ± 0.2 m and horizontal position to 3.8 m, against 9.0 m height RMSE for the same array without the vertical rows. The vertical aperture therefore improves altitude accuracy by roughly a third. Repeatability without unbiasedness. The cross-seed spread of the final altitude is 0.2 m with the vertical rows against 12.7 m without them, a collapse of about 60×. This is the observability signal — the spread, not the RMSE, is what distinguishes an observable state, because an unobservable height wanders with the noise draw — so the strict form of the claim is supported: the vertical aperture makes altitude observable in the live chain. The repeatability is not accuracy, and the two must not be conflated. All five seeds settle between 48.9 m and 49.3 m against a 55 m target: a 6.0 m bias held to 0.2 m, i.e. an estimator that is confidently slightly wrong. Because the bias is common to every seed it is not a noise or conditioning effect; it points to elevation-scale calibration in the estimator itself. The

absolute angle error (deg)

17

40

azimuth broadsideelevation

30 20 10 0

−20

0

20

40

target position along transit, py (m) Fig. 10: Per-CPI angle error along the transit (one representative seed of N = 5). Elevation is accurate only where the geometry gives the two-row aperture leverage on the vertical: ≈ 1.2◦ near endfire against ≈ 15.1◦ at broadside. Azimuth is comparatively flat. The whole-transit averages are dominated by broadside samples and represent neither regime; the filtered altitude of 5.3 ± 0.2 m is obtained by integrating these measurements, not by any of them individually. two-transmitter configuration of Section VIII, which reaches the same spread from range diversity instead of a vertical baseline, does not exhibit it — which localizes the bias to the elevation path rather than to the filter, the geometry or the alignment, all of which the two configurations share. Role of the filter in delivering altitude. The accuracy comes from the filter integrating many measurements, not from the per-CPI angles, and the two are easily conflated. Measured against ray-traced truth over the same N = 5 transits, individual angle estimates are far from the ideal-channel bound: azimuth 3.9◦ ± 1.2◦ and elevation 11.5◦ ± 2.0◦ RMSE per CPI. A single such elevation sample, converted geometrically, would place the target tens of meters off in height. The meterlevel altitude above is therefore not per-measurement accuracy but the product of the filter integrating excess range, range rate and many noisy bearings across the transit, and why the observability claim rests on the cross-seed spread rather than on any single CPI. Geometry dependence of elevation accuracy. The per-CPI elevation error is not uniform along the transit: it is 1.2◦ RMSE near endfire, where the vertical cut through the target is most favorable, and degrades to 15.1◦ at broadside, where the tworow aperture has least leverage on the vertical angle — an order of magnitude between the two regimes (Fig. 10). The whole-transit figure quoted above is dominated by the broadside samples and understates what the array achieves where the geometry suits it. Azimuth, by contrast, is comparatively flat across the transit (1.9◦ to 3.9◦ ) and remains comparable to the four-element azimuth-only ULA (8◦ ): adding the vertical rows does not cost azimuth. Altitude is therefore sensed, not assumed, on a commodity eight-element gNB—but the geometry under which it is sensed matters.

Robustness and scope. The array response stays coherent across the transit (a ground-truth-free inter-row phase-ramp coherence ≥ 0.946 on every detection), so no per-detection angle down-weighting is required. Accuracy degrades only when the target is stationary at the scene boundary—where the near-zero Doppler and the finite scene edge corrupt the snapshot—a regime outside the moving transit these figures characterize. That the estimator itself is sound is confirmed independently on a vertically climbing target (true elevation swept 15.7◦ –33◦ ), which the offline estimator tracks to 1.4◦ RMSE (correlation 0.98). The campaign covers one array shape (2 × 4) and one transit geometry; an aperture-shape and placement sweep is the natural next consolidation. Elevation is therefore observable in principle (the idealchannel result) and usable in practice (the live moving-transit result) from a single bistatic pair with a commodity eightelement gNB UPA. The remaining single-gNB limitation is cross-range: azimuth precision is bound to the receive aperture and is not improved by the UPA’s vertical rows. The multistatic geometry of Section VIII adds a second bistatic pair, giving redundant altitude observability through range diversity and filling the near-baseline/Doppler blind zones—complementary to, not a replacement for, the UPA elevation cut. VIII. M ULTISTATIC G EOMETRY: A LTITUDE FROM A S ECOND B ISTATIC PAIR The planar array of Section VII makes altitude observable by adding a vertical aperture at the receiver. A second, geometrically independent way to the same end is to add a second bistatic pair. A single gNB receiver served by two spatially separated nrUE transmitters (Fig. 11) observes the target over two distinct bistatic ellipsoids; where one pair constrains the target to an iso-range surface, the intersection of two such surfaces — together with the gNB-side azimuth — pins the target in three dimensions. Altitude then becomes observable even when the gNB array is the plain one-dimensional azimuth-only array, with no vertical aperture at all. This is attractive because it needs no change to the radio unit: a second commodity UE, not a wider array. A. Platform Extension Carrying a second pair end-to-end touches every layer of the testbed, which was otherwise wired for a single transmit/receive pair. The changes are additive and reduce to the single-pair path byte-for-byte when the second pair is disabled: • Channel and emulator. The ray-traced channel exports one propagation link per transmitter; the emulator serves each link its own channel, and the rfsim server superposes them at the gNB, so the received signal is the true sum of both pairs’ echoes. • Waveform orthogonality. The two UEs are assigned different SRS comb offsets, so their soundings are orthogonal in frequency and the gNB accumulates each pair’s coherent processing interval independently rather than blending them. • Detection transport. Each detection carries a bistatic-pair identifier from the gNB PHY through the E2/redis transport to the xApp, so the tracker knows which transmitter

18

TABLE VII: Altitude observability across sensing configurations, N = 5 independent live transits per configuration (same seed set, identical stack; only the receive array and the number of transmitters change). ULA = the azimuth-only 4-element line array; UPA = the 2 × 4 planar array of Section VII; the two-transmitter rows are the geometry of this section. The observability signal is the cross-seed standard deviation of the final altitude estimate, not the RMSE: an unobservable height wanders with the noise draw, an observable one does not. The azimuth-only baseline scatters by 12.7 m across seeds, while both upgraded configurations hold 0.2 m — a factor of about 60. Note that only the two-transmitter row is also unbiased: the planar array is equally repeatable but settles 6.0 m low, so its spread must not be read as accuracy. True altitude 55 m. Rows differ only in the receive array (4-element azimuth-only line array vs. the 2×4 planar array) and the number of transmitters; the waveform, seeds, stack and trace family are identical, and all rows come from a single build on a single host.

produced each measurement. A build-time size assertion guards the shared detection structure against silent layout drift when the field is added. • Tracker. The xApp fuses detections from both pairs in a three-dimensional constant-velocity EKF. Each pair contributes its own nonlinear measurement model — excess bistatic range, range-rate and (for the gNB-side pair) azimuth — evaluated against that pair’s known transmitter geometry, and the height prior is dropped. B. Fusion and Observability We evaluate the geometry at two levels of fidelity. Fusion proof (ray-traced channel model). An offline harness that mirrors the production EKF fuses two analytic bistatic pairs over 30 noise realizations. A single 3-D pair without a vertical aperture leaves height unobservable (the altitude state diverges); fusing a second, well-separated pair recovers it to 3.6 m RMSE. Combining the two upgrades — a second pair and the planar array of Section VII — is decisively the best configuration, giving position RMSE 5.6 m and height RMSE 2.2 m at a consistent filter (NEES ≈ 4.3), and it is robust to where the second UE is placed. Table VII and Fig. 12 report both routes to altitude — a second transmitter and a vertical aperture — against the baseline on the same seed set, build and host. Altitude observability and the two routes.: The claim this section supports is not the RMSE but the cross-seed spread of the final altitude: an unobservable height wanders with the noise draw, an observable one does not. The baseline wanders

Height RMSE (m)

Configuration ULA, 1 UE (baseline) ULA, 2 UE UPA, 1 UE UPA, 2 UE (hybrid)

Final altitude estimate (m)

Fig. 11: Two-transmitter geometry. A single gNB receiver is served by two spatially separated nrUEs, giving two bistatic paths (gNB→UAV→UEi) and therefore two iso-range surfaces through the target. UE2 sits on the opposite side of the gNB from UE1, so the two surfaces intersect the vertical steeply — the strong-GDOP placement the measurements use. A near-colinear UE2 dilutes that conditioning and degrades height accuracy by roughly 5× (Section VIII-C).

80

Pos. RMSE (m)

Final alt. (m)

Cont. (%)

9.0 18.5 55.9 ± 12.7 97 2.2 5.6 55.3 ± 0.2 100 5.3 3.8 49.0 ± 0.2 100 not measured — see the Limitation

σ=12.7 m

σ=0.2 m

σ=0.2 m

70 60

true altitude 55 m

50 40 ULA 1 UE (baseline)

UPA 1 UE

ULA 2 UE

Fig. 12: Final altitude estimate for every seed, by sensing configuration (azimuth-only four-element ULA vs. the 2 × 4 planar UPA; one or two transmitters). Each mark is one independent transit; the bar spans ±1σ across seeds. Observability is the clustering, not the distance to truth. The azimuth-only baseline does not cluster — its five seeds span 36.9 m to 71.0 m about a 55 m target, a spread of 12.7 m — while both upgraded configurations collapse to 0.2 m. Reading clustering and distance separately is what distinguishes them: the twotransmitter marks cluster on truth, the planar array clusters 6.0 m below it. The baseline’s near-correct mean is an artifact of averaging symmetric errors, not evidence of an observable state.

19

by 12.7 m — its five seeds span 36.9 m to 71.0 m about a 55 m target — and both upgrades collapse that to 0.2 m, a factor of about 60. Altitude is therefore observable live from either route, which is what the ray-traced fusion proof predicts. The two routes differ in a way the spread alone does not show. Range diversity from a second transmitter is both pinned and unbiased, settling at 55.3 m against a 55 m truth, and it gives the lowest height RMSE of the three configurations (2.2 m). The vertical aperture is equally repeatable but sits 6.0 m low (49.0 m); what it buys instead is horizontal accuracy (3.8 m against 5.6 m and 18.5 m). So the planar array should be read as an upgrade to position accuracy and to the conditioning of the altitude estimate, not as the more accurate altitude sensor. A residual elevation bias of this size is consistent with the calibration limits discussed in Section VII and is not explained by geometry, seeds or alignment, all of which are shared with the two-transmitter row. Corroboration against the offline reference.: The live figures above are consistent with the fusion proof of Section VIII-C, which drives the same estimator and filter from a ray-traced channel model with no software-defined radio, no sample transport and no real-time deadline: a single pair leaves height unobservable while a second, well-separated pair recovers it to 3.6 m RMSE. Altitude observability from range diversity is therefore established both in the signal-processing chain and end to end through the live stack, and the live campaign’s 0.2 m cross-seed spread at a 55.3 m mean is what that prediction looks like when it is realized on a real PHY. Two-transmitter configuration.: All five two-UE runs in this campaign clear both criteria: median azimuth alignment residual 0.9◦ to 1.2◦ (against 1.6◦ to 2.1◦ for the singletransmitter rows), both pairs contributing throughout, full transit replayed, 100 % track continuity and association. This is now the best-conditioned configuration we measure — lowest height RMSE, unbiased final altitude, and the tightest crossseed spread jointly with the planar array. C. Geometry Dilution and the Range Gate Altitude observability from range diversity is strongly geometry-dependent. The vertical conditioning is best when the second UE is well separated from the first — on the opposite side of the gNB, so the two bistatic ellipsoids intersect the vertical steeply; a near-colinear second UE dilutes the geometry and the height RMSE degrades by roughly 5× (from 3.6 m to ≈19 m in the fusion proof). This creates a tension with detection gating: a well-separated second UE sits on a longer bistatic path, so admitting its detections requires opening the range gate from the canonical 85 m to ≈200 m. A gate-compatible near-side placement, by contrast, has vertical conditioning too weak to survive the residual range bias of the ray-traced echo. Elevation observability from multistatic range diversity is therefore a joint choice of transmitter placement and range-gate width, not a free by-product of adding a transmitter. When the planar array of Section VII is also present, the hybrid tolerates any second-UE placement, because the vertical aperture supplies the conditioning the geometry alone may lack.

Maturity. The fusion proof uses an analytic channel over 30 seeds; the live result is now an N = 5-seed campaign on one geometry (UAV RCS scaled to 0 dBsm, small-UAV). A transmitter-placement / range-gate sweep is the natural next consolidation. Limitation — live UPA+multistatic hybrid. The offline fusion proof shows the hybrid — a second bistatic pair and the planar array of Section VII — is the strongest configuration, and it is the one row of Table VII we cannot measure. The failure is specific and reproducible: with eight receive antennas and two transmitters, the gNB misses its random-access response deadline about 58 times per coherent processing interval, against zero in every other configuration. Its impact on this paper is narrow: the hybrid is an additive configuration, both of whose ingredients are measured independently and at N = 5 here, and each makes altitude observable on its own. Its absence therefore removes an expected improvement, not a claim. IX. D ISCUSSION The integration of UL-SRS-based sensing within the OAI gNB PHY and O-RAN Near-RT RIC xApp demonstrates the feasibility of repurposing existing NR uplink signals for UAV surveillance without spectrum or waveform changes. Key design insights are: PHY vs. xApp split: Placing clutter cancellation, the Range-Doppler transforms, CFAR and AoA estimation inside the gNB PHY gives them access to calibrated per-port channel estimates, while the xApp handles only association and EKF tracking, keeping the Near-RT RIC interface insensitive to the heavy signal processing. The cost, however, is real: the PHY stage runs in 113.0 ± 5.7 ms per CPI (Table XI), not sub-millisecond. It fits inside the 640 ms CPI accumulation window, but it is dominated by the 4096 × 128 zero-padded transforms across four ports and is not optimized for speed. Architecturally, this split — heavy processing inside the gNB PHY, detection results lifted to the xApp via E2 — mirrors the dApp model [33], [34], where inference microservices run at the O-DU with direct IQ access and report compact outputs upward. The difference is lifecycle: the current implementation is a static OAI PHY patch; a production-grade sensing dApp would be a containerized service with a standardized IQ ingestion interface (Open Fronthaul or E3) deployable across O-DU vendors. Three senses of “real time”. These three senses are easily conflated and are separated here. (i) Radio time: the pipeline consumes SRS at the rate the air interface delivers it, and every rate in this paper is computed against radio time. (ii) In-CPI deadline: each stage completes within one CPI accumulation window, which is the property that makes the pipeline nonaccumulating. (iii) Wall-clock real time: this we do not claim. The evaluation host runs the ray-traced channel emulator, the full NR stack and the RIC concurrently, and the emulator is the bottleneck, so a 640 ms CPI of simulated time takes substantially longer than 640 ms of wall-clock time to produce. Senses (i) and (ii) are properties of the sensing pipeline and carry over to a hardware deployment; sense (iii) is a property

20

of this simulation host and does not. A quantitative real-time budget — host utilization, missed-deadline count and framedrop rate against a wall-clock reference — is not reported here and is left as verification work alongside the hardware evaluation (Section X). The dashboard’s polling interval is a display-side refresh and is excluded from every latency figure in Table XI, which measures only the sensing and E2 path. Per-detection SNR. Each detection reports the rangeDoppler cell SNR — the echo power at the detected cell over the local CFAR noise estimate — which is a per-target radar SNR (median 23.1 dB at the operating point) and is the quantity against which detection probability is characterized in Appendix A. This is distinct from the wideband SRS channelestimate SNR (10 log10 (Psignal /Pnoise ) over the received SRS samples, ≈ 46–51 dB), which measures the nrUE↔gNB direct-link reception quality common to all detections in a CPI; we retain that quantity only as a link-quality diagnostic (the loaded-link comparison of Appendix C). The raw echo sits below the per-sample noise floor and is lifted into the cell by the ∼ 50 dB coherent processing gain of the 640 ms CPI (Section VI-B). Detection-to-track association. The association needs further work, though the time-driven coast-bridging already improves track continuity. Extending the per-CPI optimal (Hungarian) assignment to multiple simultaneous UAVs is a natural next step once the single-target geometry limits above are addressed. Coverage and range. The evaluated geometry is a compact bistatic triangle — gNB–target and target–UE legs of about 111 and 60 m across a 130 m baseline. What sets the detection range there is the echo-cell SNR, not the strong direct link: a realistic small-UAV return (∼−15 dBsm) is received at about 27 dB of range-Doppler cell SNR, only a few decibels above the 23.1 dB needed for PD = 0.9. Because the bistatic cell SNR falls as the fourth power of range, that few-decibel echo margin lets a single pair reach only modestly beyond the tested legs for a small target; materially larger coverage follows from a larger target RCS, a shorter baseline, longer coherent integration, or — most effectively — a second bistatic pair that both widens the range-product envelope and fills the Doppler blind angles (the multistatic direction of Section X). The gNB’s four-element array is used for angle estimation rather than receive beamforming, so this budget already reflects the true, non-beamformed receive aperture rather than an idealized array gain. Three effects other than raw SNR further bound the envelope: a near-baseline clutter dead zone of a few tens of meters (the direct-path skirt the range gate rejects); a bistatic Doppler ambiguity of ±λ PRF/2 ≈ 4.5 m/s at the 10 ms SRS period (the speed sweep confirms robust detection to the tested 5 m/s, but faster targets alias unless the period is shortened, at the cost of coherent-integration gain); and the bistatic-angle projection vbi ∝ cos(β/2), which hides targets crossing the baseline bisector until a second pair views them from another angle. UL-SRS power budget. The wideband sounding that sets the range resolution is not free in uplink power. Sounding all 106 PRBs at 30 kHz SCS drives the UE power amplifier (PA) essentially continuously through the SRS symbol, and at the

23 dBm UE maximum, repeating that every 10 ms leaves little headroom — most acutely for a cell-edge target already powerlimited by path loss. Several standard mechanisms trade this budget against sensing performance without new hardware. Aperiodic (type-1) SRS, triggered by radio resource control (RRC) only when the gNB needs an update, removes the standing duty cycle at the cost of a downlink control information (DCI) order latency of about one uplink slot (∼5 ms); adaptive periodicity that relaxes the SRS period from 10 ms to 40 ms to 80 ms while no target is tracked cuts the duty cycle 4–8× at a proportional drop in update rate. Partial-band SRS that hops N sub-bands over successive CPIs and stitches them in the Doppler domain recovers the full-aperture resolution over N TSRS while cutting per-CPI power by 1/N . On a multiantenna UE, precoded SRS beamformed toward the gNB raises the effective isotropic radiated power (EIRP) by 3–6 dB for the same PA power, and standard NR open-loop power control,
PSRS = min Pmax , P0 + α PL + 10 log10 MSRS + f , can lower P0 for a close-range target to spare budget for a distant one. Our testbed runs the fixed 10 ms full-band operating point; selecting among these per deployment — by range, target dynamics, and UE capability — is a practical extension for the hardware phase. X. F UTURE W ORK Detector characterization. Appendix A calibrates the realized PFA to its nominal value and reports PD against the measured echo-cell SNR and bistatic range; what remains is threefold. First, the single flat transit spans only a narrow band of bistatic angles, so the angular dependence of PD needs multigeometry campaigns to separate it from range. Second, at echo levels well above the modeled UAV RCS the per-CPI detection breaks down and PD settles onto a floor (Appendix A); this whole-CPI dropout is deflation-rank-independent (higher deflation rank makes it worse, not better), so the fix is an upstream diagnosis of the CFO/deflation/CFAR-reference interaction under echo over-drive rather than a deflationrank change. Third, the tracking results here still run on the empirical below-noise operating point; folding the calibrated threshold into the end-to-end pipeline, and confirming the tracking metrics hold at a controlled PFA , is the natural consolidation. Tracking. A single visible target should sustain one identifier. The time-driven coast-bridging pass (Section VI-E) already closes most of the gap between near-complete detection coverage and track continuity, raising the latter from 54.2 ± 3.7% to 88.31 ± 0.90%; the residual 100 − 88.3 ≈ 12 % is track initiation and re-confirmation latency — the CPIs before a confirmed track first exists, which a pass operating only on already-confirmed tracks cannot fill — and not detection dropouts, whose longest run (1.9 s) sits well inside the 8 s bridging horizon. It does not, however, improve identity: the per-run identifier count is 2.6 ± 0.5 without bridging and 3.00 ± 0.00 with it, because a republished coasted track is never merged with the fragment that later re-confirms. What remains is collapsing the transit onto a single identifier — better peak grouping, a wider association gate informed by the predicted

21

track, and track management that absorbs a multi-detection CPI without re-spawning (e.g. JPDA) — and shortening the dropouts themselves through the detection layer. Geometry. Removing the height prior was the single largest structural improvement available, and this paper realizes it two ways and measures both live at N = 5: a planar receive array adding a vertical aperture (Section VII) and a two-user multistatic geometry (Section VIII). The multistatic route is the stronger of the two on altitude — pinned and unbiased — while the planar array wins horizontal position; neither subsumes the other, and a hybrid combining both is the configuration the offline analysis favors but that we cannot yet measure (Section VIII). What remains on this axis is resolving the 6.0 m elevation bias in the vertical-aperture route and improving single-gNB cross-range precision — which stays bound to the eight-antenna receive aperture, with a wider radio unit or a multi-gNB deployment being the routes. Scenario coverage. The evaluation uses one deterministic trajectory under five noise realizations. Multiple trajectories, speeds, UAV altitudes and gNB mounting heights (with a visibility heatmap over the two), and RCS values — and more than one simultaneous target, exercising the Hungarian assignment that is presently trivial — are needed before the tracking claim generalizes. Channel realism and hardware. A richer multipath rendering (more static taps, and the UAV as an extended scatterer rather than a single collapsed echo) would tighten the NLOS bound, and rotor micro-Doppler is absent altogether. Hardware-in-the-loop validation with USRP radios and a physical UAV remains the decisive test. Standardization. An ASN.1-specified, interoperabilitytested E2SM-SENS is a natural follow-on, extending the payload prototype of Table II from an illustration of what a sensing E2SM must carry into a standards-track proposal. Packaging the PHY sensing stage as a formal dApp [33], [42] — with standardized IQ access via Open Fronthaul metadata and a lifecycle managed by the O-RAN Service Management and Orchestration framework — is the natural productization path, and the sensing dApp architecture of [34] provides a directly compatible reference design. Command-and-control integration. The pipeline presently terminates at a visualization dashboard; an operational counterUAS or urban-air-mobility (UAM) deployment would instead consume the tracks over a standard sensor-to-C2 interface. Emitting the EKF output in an open format — for example the Dstl SAPIENT autonomous-sensor-to-C2 standard, or an ASTERIX/UTM (unmanned traffic management) airspace feed — would let the O-RAN sensing plane drive thirdparty command-and-control and traffic de-confliction without bespoke integration, and is a natural step from this digital twin toward an operational counter-UAS or UTM trial. XI. C ONCLUSION We have presented an end-to-end O-RAN testbed for 5G ISAC-based UAV detection and tracking using UL-SRS. The testbed integrates OAI gNB (with ISAC PHY sensing patch), FlexRIC Near-RT RIC (EKF xApp), Sionna RT channel emu-

lation, and a real-time live dashboard into a single containerized platform built on open-source components. The UL-SRS sensing pipeline achieves 8.0 m bistatic range resolution and 0.14 m s−1 Doppler resolution over a 37.4 MHz SRS aperture with a 640 ms CPI, validated end-to-end in simulation. Over N = 5 independent seeded runs of a UAV performing a line-of-sight transit through the bistatic footprint, the pipeline detects the target in every observable CPI, measuring its excess bistatic range to 8.7 m RMSE — slightly above one bistatic resolution cell, the error set by the endfire geometry — its bistatic range rate to 0.44 m/s (recovering the sign reversal through the crossing), and its azimuth to 7.0◦ . The bistatic EKF tracks the target to 7.3 m in range and 5.3 m in crossrange. Because a single bistatic pair leaves elevation unobservable, we additionally establish altitude observability two ways — a planar receive array supplying a vertical aperture, and a two-transmitter multistatic geometry (two UEs, one gNB) — the latter achieving a fully pinned 3-D track with no height prior. Detections reach the tracker as RIC INDICATIONs over an E2 sensing service model, at a transport cost of 5.8 ± 2.9 ms — negligible against the 640 ms CPI, and the actual sensing pipeline processing. And the sensing is not obtained on an idle carrier: with the same link concurrently serving a 10 Mbit s−1 uplink flow (5.8 ± 0.1 mean MCS over the full 106 PRBs), detection coverage is unaffected — the SRS occupies its own comb, so user traffic does not displace the sounding signal (Appendix C). Future work will therefore extend to multi-static (multi-cell) cooperative sensing together with NLOS-robust detection (adaptive clutter-subspace rank and reflection-aware ranking) and richer multipath modeling, alongside multi-UAV tracking, hardware-in-the-loop USRP validation, and AI-based UAV classification xApps for realtime low-altitude air surveillance such as for C-UAS and UAM applications. ACKNOWLEDGEMENTS The authors would like to thank the OpenAirInterface Software Alliance (OSA), the FlexRIC, and NVIDIA Sionna RT teams for the open-source projects. Note that AI tools (Anthropic Claude and Code, OpenAI ChatGPT) were used to assist in the preparation of this work, including platform building, testing and data postprocessing, as well as writing assistance, language editing, and manuscript refinement. A PPENDIX A D ETECTOR C HARACTERIZATION Section III-D noted that the order-statistic threshold is set empirically and that the 10−4 design figure is not, on its own, a calibrated false-alarm rate. This subsection closes that gap in two steps: it measures the realized PFA on target-absent data, and it reports the detection probability PD as a function of the echo-cell SNR actually presented to the detector and of the target’s bistatic range. Both are measured on the calibrated detector (OS-CFAR with the closed-form αOS of Section III-D plus a single scene-independent offset), so a single operating point underlies both the false-alarm and the detection results.

PD

1) Realized false-alarm rate: We drive the pipeline with a target-absent replay of the flat scene — static clutter and the emulator’s thermal noise, no UAV echo — and accumulate the per-cell CFAR margin (test-cell power minus local threshold) over 6.2 × 105 cell tests across 1 noise seeds. The realized PFA at any design value is then the fraction of cells whose margin is positive at that design threshold, read directly off the accumulated histogram. The empirical threshold the tracking results use sits far below the noise reference, so essentially every tested cell crosses it: its realized PFA is 0.98, four orders of magnitude above the nominal 10−4 . False-alarm control in that configuration is delegated entirely to the downstream selectivity (Doppler and range gates, the keep-strongest cap, single-peak non-maximum suppression, and the detection cap), not to the CFAR probability. Substituting the correct orderstatistic multiplier αOS moves the realized rate to 4.9 × 10−4 at a nominal 10−4 ; the residual factor is the gap between the single-look exponential assumption behind the closed form and the 4-port non-coherently combined range-Doppler cells, which are approximately χ2 with a higher degree count. A single scene-independent offset of 1.2 dB, obtained once from the target-absent margin histogram, removes that residual and attains 8.9 × 10−5 — the nominal rate, now calibrated rather than nominal. 2) Detection probability versus echo SNR: To trace PD across the detector’s operating range we replay the same transit with the UAV echo scaled by a constant factor g, which scales the received echo power by g 2 and is equivalent to scaling the target RCS by g 2 while leaving the static clutter and injected noise untouched. Each level is solved so that its absolute mean bistatic RCS lands on a requested value in dBsm (by inverting the bistatic radar equation on the rendered echo), so the sweep is parameterized by target size rather than by a bare amplitude factor, and the curve is binned by that physical quantity. Fig. 13 reports PD over 5 RCS levels spanning 40 dB, 3 seed each (237 observable CPIs per level), with Wilson score intervals. PD rises monotonically with target RCS across the whole ladder, from 0.73 at −20 dBsm to 0.95 at +20 dBsm. The canonical operating point — the unscaled transit — detects in 0.90 of observable CPIs. Why RCS and not measured echo-cell SNR: Earlier versions binned this curve by the measured echo-cell SNR. That axis is not well posed for this detector. The rank-one clutter-subspace deflation of Section V-B is data-adaptive, so it captures a growing share of the target as the echo strengthens: across the 40 dB of RCS spanned here the median measured echo-cell SNR moves by only 0.8 dB, and it is not even monotonic in RCS. A rank sweep of the unscaled transit makes the mechanism explicit — echo-cell SNR falls from 32 to 17 to 15 dB at deflation rank 0, 1 and 2, with rank ≥ 2 overcanceling the target, which is why the single-target operating choice is Kc = 1. Binning by an axis that compresses 40 dB of physical variation into 0.8 dB, and reorders it, produced a curve that appeared to saturate and then floor. We therefore report PD against absolute bistatic RCS, which is monotone and physically interpretable, and retain the measured echo-cell SNR only as a per-level diagnostic (23.1 dB at the operating point) with this compression noted.

PD

22

1.0 0.8 0.6 0.4 0.2 0.0

1.0 0.8 0.6 0.4 0.2 0.0

(a) vs target RCS

small-UAV band

−20

−10

0

10

Absolute bistatic RCS (dBsm) (b) vs excess range

20

operating point (+0 dBsm)

50

55

60

65

Excess bistatic range (m)

70

Fig. 13: Detector characterization on the flat-LOS transit, calibrated OS-CFAR (5 RCS levels spanning 40 dB, over 3 noise seeds, 237 observable CPIs per level; error bars are Wilson score intervals). (a) PD versus absolute bistatic RCS, rising monotonically from 0.73 at −20 dBsm to 0.95 at +20 dBsm; the shaded band marks the realistic small-UAV regime (−20 to −10 dBsm). RCS is used as the abscissa rather than the measured echo-cell SNR because rank-one deflation compresses 40 dB of RCS into 0.8 dB of measured SNR and reorders it (text). (b) PD versus excess bistatic range at the operating point (+0 dBsm); the far-range falloff is an SNR effect, not a geometric blind zone. The transit spans only ∼40– 80 m of excess range, so this covers a correspondingly narrow span.

3) Detection probability versus range: At the operating point (Fig. 13b) PD falls from 0.87 at a 40 − −60 m excess bistatic range to 1.00 beyond 60 m, as the target recedes from the broadside crossing toward the ends of the transit. This falloff is an SNR effect, not a geometric blind zone: pooling the reliably-detected (higher echo-SNR) levels, where SNR is not the limiting factor, PD is flat at 1.00 across the same range span, so the operating-point drop is the 1/(RT RR ) bistatic power law weakening the echo at the transit extremes

23

1.0

1.0

0.8

0.8 0.6

0.4

PD

PD

0.6 0.2 0.0

CFAR

0.4

CA OS

0.2

2

3

4

UAV speed vy (m/s)

5

Fig. 14: Detection probability versus UAV crossing speed vy over 4 speeds (N = 5 seeds each, calibrated OS-CFAR at the operating echo level; error bars are Wilson score intervals). PD is essentially flat, rising slightly from the slowest vy toward 5 m/s as the larger bistatic Doppler separates the target more cleanly from the clutter ridge. rather than a loss of detectability at longer range. The single flat transit spans only a narrow band of bistatic angles, so a bistatic-angle dependence is not separable here and is left to the multi-geometry campaigns of Section X. 4) Detection probability versus speed: To probe sensitivity to target dynamics we repeat the operating transit at four crossing speeds, vy ∈ {1.5, 2, 3, 5} m/s, regenerating the raytraced channel at each speed (3 m sphere, operating echo level, N = 5 seeds) and sizing each run to a full transit. Fig. 14 reports PD against vy . Detection is essentially flat across the span and, if anything, improves slightly with speed: PD = 0.91 at the slowest 1.5 m/s and 0.91 at the vy = 2 m/s operating point, rising to 0.94 at 3 and 5 m/s. The trend is mild but in the expected direction: a faster crossing carries a larger bistatic Doppler, which separates the moving target more cleanly from the near-zero-Doppler clutter ridge, so the slowest transit — not the fastest — is the hardest. Even at 5 m/s the perCPI Doppler migration stays within the coherent-integration window of the 640 ms CPI, so there is no high-speed roll-off. Across the 1.5–5 m/s span the detector holds PD ≥ 0.91, so within the low-altitude UAV regime of interest the sensing is not speed-limited. 5) Comparison of CFAR estimators: The characterization so far uses the order-statistic (OS) CFAR that the pipeline operates. To justify that choice we replay both the target-absent calibration and the target-present operating transit under three reference estimators — cell-averaging (CA), order-statistic (OS), and greatest-of (GO) — holding every other stage fixed and sweeping a common threshold offset to trace each one’s receiver operating characteristic (ROC) (Fig. 15) and its realized false-alarm calibration (Table VIII), over the same 395 observable operating-transit CPIs. The two estimators separate on calibration, not on detection. On the realized PFA delivered at a designed nominal the ordering is OS ≺ GO ≺ CA: at a nominal 10−4 the CA mean reference, contaminated by target and clutter energy

GO 0.0

10−3

10−2 realised PFA

10−1

Fig. 15: CFAR estimator comparison on the operating transit: detection probability versus realized false-alarm probability for cell-averaging (CA), order-statistic (OS), and greatestof (GO) references, sweeping a common threshold offset over 395 observable CPIs. Markers denote nominal PFA ∈ {10−2 , 10−3 , 10−4 }. At the operating echo level the three references are indistinguishable in PD (≈ 0.77, curves overlapping), since detection there is dropout- rather than CFARlimited; they separate only on calibration (Table VIII), where OS holds the nominal rate to 6× versus 76× for CA.

leaking into its training cells, over-delivers by 76×, GO by 50×, and OS by only 6×. On detection at a matched realized PFA = 10−4 (the ROC), by contrast, the three nearly coincide: over the 395 observable CPIs they reach PD = 0.72 (CA), 0.77 (OS), and 0.71 (GO) — a spread of a few percentage points. At the deployed echo level the target sits far enough above threshold that detection is limited by whole-CPI dropout, not by the CFAR reference, so the choice of estimator barely moves PD . (This ROC PD is the dropout-free efficiency at a matched false-alarm rate, and so runs higher than the operating-point PD = 0.90 of Appendix A, which is measured from the reported detections at the calibrated threshold and therefore includes the whole-CPI dropouts; the two describe the same target through different apertures.) The operating choice is therefore settled by calibration alone. A sensing detector must hold a designed false-alarm rate, and OS is the only one of the three that does — to within 6× of nominal, against 50× (GO) and 76× (CA) — while costing nothing in detection at the operating point. OSCFAR is retained. A PPENDIX B S TREET-C ANYON O CCLUSION S TRESS T EST To bound how far the flat-LOS result carries into an obstructed environment, we repeat the identical run — same trajectory, same altitude, same pipeline configuration and the same htgt = 55 m prior — with the six buildings of the streetcanyon scene restored (Fig. 4b), so the only change is the propagation environment. Table IX compares the two.

24

TABLE VIII: CFAR estimators at matched realized PFA : the realized-to-nominal PFA ratio (calibration, lower is better) and PD at three operating points, over 395 CPIs. OS is the tightestcalibrated; GO is dominated by OS. CFAR

realized PFA

mode

at nom. 10−4

10−2

PD at realized PFA 10−3

10−4

CA OS GO

76× 6× 50×

0.92 0.87 0.91

0.80 0.83 0.79

0.72 0.77 0.71

TABLE IX: Flat-LOS vs. street-canyon (NLOS). Identical trajectory, pipeline configuration and height prior, and the same N = 5 noise seeds — only the buildings differ, so the comparison is paired. Dominant track per run for the position rows. Quantity

Flat-LOS

Street-canyon

UAV line-of-sight visibility (%) Detection coverage, visible CPIs (%) Excess bistatic range RMSE (m) Single-detection CPIs (%) Range ∆x RMSE (m) Cross-range ∆y RMSE (m) Track continuity (%)

100.0 ± 0.0 93 8.7 88 7.3 5.3 54.2

29.1 ± 0.0 64 7.5 55 19.3 13.9 17.0

Two distinct mechanisms degrade the result, and they act on different quantities. First, occlusion: the UAV passes behind the buildings for much of the transit, and the ray tracer returns no UAV echo at all in more than half of the CPIs — a missed detection there is not a signal-processing failure but a geometric impossibility. We therefore separate the two questions the single word “coverage” would otherwise blur: visibility is the fraction of CPIs in which an echo exists to be found (29.1 ± 0.0% here), while detection coverage is the fraction of those CPIs in which the pipeline found it (64%). The pipeline does not miss visible targets; it is simply denied a signal for most of the transit. Notably the occlusion is driven by the gNB height rather than the UAV’s: with the gNB at 10 m and buildings up to 51 m, the shallow gNB→target ray is intercepted even for an above-rooftop target, so raising the UAV does not recover visibility. This is a siting observation from a single tested geometry: in this scene it is the gNB mounting height, not the flight ceiling, that governs coverage. A gNB-height×UAV-altitude sweep (Section X) is needed before generalizing it into a placement rule. Second, building reflections: the surviving specular paths produce clutter that a rank-1 deflation — tuned for a scene whose only strong static return is the direct path — does not remove, so CFAR reports several detections per CPI instead of one and the singledetection rate collapses (Table IX). The strongest detection is then frequently a reflection rather than the target, which is what propagates into the position and continuity rows. Where the target is visible the measurement itself remains usable, so the sensing front end degrades gracefully; it is the selection of the target among reflections that fails. These figures are a lower bound on the true NLOS penalty. The ray-traced channel retained here keeps only the two strongest static (non-UAV) taps per CPI and collapses the

UAV’s own multi-bounce return into a single echo tap. A richer multipath rendering would add further reflected clutter and further degrade detection selection. A full NLOS characterization — together with NLOS-robust countermeasures (an adaptive or higher deflation rank matched to the scene’s clutter subspace, reflection-aware detection ranking, and rooftop gNB siting to reduce occlusion) — is left as future work (Section IX). A PPENDIX C S ENSING ON A L OADED L INK The results above establish the sensing (“S”) of ISAC but not the communication (“C”): a sensing result obtained on an otherwise idle carrier would be a weak basis for claiming integration, since SRS is a reference signal, and with no userplane traffic the scheduler leaves the uplink at its minimum grant, so the sensing stage would be observing a link that is doing nothing else. We therefore repeat the flat-LOS evaluation with the same UE simultaneously carrying a 10 Mbit s−1 uplink data flow through its protocol data unit (PDU) session — real user-plane traffic, traversing the same PHY whose SRS the sensing stage taps. Fig. 16 shows the effect on the communication link. Idle, the scheduler sits at MCS 0 on a minimum grant, with throughput at the kbit s−1 level: nothing but signaling. Loaded, it allocates the full 106 PRBs, drives the MCS to a mean of ∼5.8 ± 0.1, and carries the offered load. The sensing stage is running throughout. Table X reports what the load does to the sensing. Detection coverage is not reduced by the load, and structurally one should not expect it to be: the SRS occupies its own comb and its own symbols, so physical uplink shared channel (PUSCH) data never overlaps the sounding resource. The load competes with the sensing for the scheduler’s resources, not for the sounding signal itself. An earlier version of this experiment appeared to show accuracy that was better under load. That effect was an artifact of the emulator’s output stage rather than a benefit of ISAC — a trap inherent to any fixed-point channel emulator, and recorded here so it can be avoided. The emulator applies a headroom-safe automatic gain before quantizing to the wire’s 16-bit format, and that gain is capped by a running estimate of the signal peak. With the uplink carrying only signaling the waveform is weak and a large gain is applied; loaded, the waveform is stronger and the gain is correspondingly smaller. The loaded arm therefore sat at a more favorable point in the quantizer’s range and its channel estimate saw a higher effective SNR — an advantage conferred by the arithmetic, not by the air interface. Both arms of Table X are re-run with the emulator’s uplink output gain pinned to the same fixed value, so the quantizer operating point is identical whether or not the link carries data; the two arms use the same scene, the same seeds and the same pipeline, and differ only in the presence of the user-plane flow. We confirm that neither arm clips, so the pinned gain is not itself distorting either case. Under this control the apparent advantage disappears: excess range RMSE is 8.4 m idle versus

UL throughput (Mbit/s)

20

UL MCS

25

20

loaded idle (signalling only)

10 0

NPRB

110 105

10

Quantity

UL BLER

0 0.2 0.1 0.0

TABLE X: Sensing accuracy with and without a concurrent 10 Mbit s−1 uplink data flow, under identical fixed-point scaling. Same scene, same seeds (N = 5), same pipeline, and the emulator’s uplink output gain pinned to the same value in both arms, so the quantizer operating point cannot differ between them; only the user-plane load differs. Neither arm clips. Every sensing difference here is smaller than the seedto-seed spread: load neither improves nor degrades accuracy. Detection coverage — measured on the detections, upstream of the tracker and independent of the output gain — is not reduced by the load, because PUSCH does not displace the SRS resource.

0

20

40

Radio time (s)

Idle link

Loaded link

Communication UL throughput (Mbit/s) UL MCS (mean)

≈0 0

4.8 ± 0.0 5.8 ± 0.1

Sensing Detection coverage (%) Excess bistatic range RMSE (m) Bistatic range-rate RMSE (m/s) Azimuth RMSE (deg) Single-detection CPIs (%)

97 8.4 0.46 7.1 81

97 8.3 0.34 7.0 82

60

Fig. 16: Communication-link KPIs while the sensing pipeline runs, against radio time. Loaded (solid), the scheduler allocates the full 106 PRBs and raises the MCS to carry a 10 Mbit s−1 uplink flow; idle (dashed), it never leaves MCS 0 and the link carries only signaling. Rates are computed against radio time rather than wall-clock time, since the simulator runs slower than real time and a wall-clock denominator would understate the rate the air interface actually carried. 8.3 m loaded, range-rate RMSE 0.46versus 0.34 m/s, and azimuth RMSE 7.1versus 7.0 degrees — differences smaller than the seed-to-seed spread in every case. Loading the link neither improves nor degrades sensing accuracy. Uplink load therefore does not reduce detection coverage, because PUSCH traffic does not displace the sounding resource. Coverage is 97% idle and 97% loaded while the link carries 4.8 ± 0.0 Mbit/s at a mean MCS of 5.8 ± 0.1. Because coverage is measured on the detections themselves, upstream of the tracker and independent of the output gain, it is unaffected by the artifact described above. This is the sense in which the testbed is integrated rather than merely co-located: one carrier, one PHY, carrying user data and producing UAV detections at the same time. A PPENDIX D E ND - TO -E ND L ATENCY All latency figures reported here were measured on the host machine actually running the testbed: an Apple MacBook Air (M5 chip, 16 GB RAM), with the full container stack running locally. The chain from UL-SRS reception to dashboard display is: (1) gNB PHY accumulation, TCPI = 640 ms (deterministic, by construction); (2) the sensing pipeline;

(3) transport of the detection report to the xApp; (4) EKF update and track write; (5) dashboard poll, ≤ 1 s (a fixed polling period, not a processing delay). Stages (2)–(4) are measured per CPI and reported in Table XI and illustrated in Fig. 17. Cost of the E2 path. Because both transports of Section IV-C carry the same gNB-side timestamp, stage (3) is directly comparable between them. The direct in-memory queue is not free: it too incurs 5.3 ± 4.0 ms (p95 12.1, max 12.1 ms; n = 44), most of it timestamping and report serialization common to both paths. The E2 service model’s marginal cost is therefore small — in a both-transport reference run the same detections cost 6.9 ± 3.8 ms via E2 against 5.3 ± 4.0 ms via the queue, a difference of under 2 ms for E2AP encoding, the Stream Control Transmission Protocol (SCTP) hop to the RIC, and decoding at the xApp, and consistent with the loadedlink E2 latency of 5.8 ± 2.9 ms in Table XI. Set against the 640 ms CPI that must elapse before a detection exists at all, that overhead is negligible: routing sensing data through a standard E2AP-based service model rather than a private sidechannel costs well under one percent of the sensing latency budget. Worst-case bounds. We do not infer a worst case from the means. The means and standard deviations in Table XI describe the typical case; the maximum and the 95th/99th percentiles, reported alongside them, are the observed tail. Taking the measured maxima of stages (2)–(4) together with the deterministic TCPI and the 1 s polling period gives an observed end-to-end worst case; because the polling period alone contributes up to 1 s and the CPI another 640 ms, an alert latency below 2 s is not guaranteed by these measurements, and any deployment needing a hard bound should shorten the polling period (or replace polling with a push) rather than rely on the processing stages, which are not the dominant term. The sensing pipeline dominates the processing chain and sits

26

in-CPI wall-clock budget

radio time (deterministic)

(1) UL-SRS accumulation

deflation·RD·CFAR·AoA

(3) E2 / SM-SENS transport

(4) EKF update + track write

(5) dashboard poll

TCPI = 640 ms

113.0 ± 5.7 ms

5.8 ± 2.9 ms

2.1 ± 2.1 ms

≤ 1s

(2) gNB PHY

Fig. 17: End-to-end timing of the sensing chain, from UL-SRS reception to dashboard display. Stage (1) is deterministic radio time — the 640 ms CPI that must elapse before a detection exists. Stages (2)–(4) are the per-CPI wall-clock processing budget measured in Table XI: the gNB PHY pipeline (113.0 ± 5.7 ms), E2/SM-SENS transport (5.8 ± 2.9 ms), and EKF update (2.1 ± 2.1 ms). Stage (5), the dashboard poll (≤ 1 s), is a fixed display period, not a processing delay, and is excluded from the budget. TABLE XI: End-to-end latency by stage, flat-LOS scene with the link loaded. Statistics are over pooled per-CPI samples from the N = 5 seeded runs; n is the number of pooled perCPI samples entering each statistic — a sample count, not a run count. The max column is an observed worst case, not an inferred bound. The E2 row is the loaded-link measurement; the direct-queue row is a companion reference measured in a separate both-transport flat-LOS run (same pipeline and code), where both transports carried the same detections. The pipeline row is populated only on CPIs whose report carried the gNB’s processing duration, which the sensing service model does not convey; its n is therefore a subset of the E2AP transport samples, which is why the two rows differ by roughly an order of magnitude. Mean ± std (ms) p95

Stage

p99 Max

n

113.0 ± 5.7

121.7 129.8 172.9 470

Detection transport, gNB → xApp via E2 / SM-SENS 5.8 ± 2.9 via direct queue 5.3 ± 4.0

10.4 12.0 14.9 3655 12.1 12.1 12.1 44

Sensing pipeline (gNB PHY)

EKF update + track write

2.1 ± 2.1

6.7

10.2 11.8 3655

inside the deterministic 640 ms CPI accumulation window, so the pipeline keeps pace with the SRS stream. Both transports and the EKF update are sub-15 ms even at their maxima — together they are a rounding error against the CPI, which is what makes the choice of transport a design question rather than a performance one. R EFERENCES [1] 3GPP, “Feasibility Study on Integrated Sensing and Communication,” 3rd Generation Partnership Project (3GPP), Technical Report (Study Item) TR 22.837, 2024, v19.4.0; study report, not a normative specification. [2] ——, “Study on Channel Model for NR Integrated Sensing and Communication,” 3rd Generation Partnership Project (3GPP), Technical Report TR 38.867, 2025, release-19 study item; study report, not a normative specification. [3] O-RAN Alliance, “O-RAN Architecture Description,” O-RAN Alliance, Technical Specification O-RAN.WG1.O-RAN-ArchitectureDescription-v07.00, 2022. [4] ——, “O-RAN E2 Application Protocol (E2AP),” O-RAN Alliance, Technical Specification O-RAN.WG3.E2AP-R003, 2024, defines the RIC subscription/indication procedures an E2 service model must comply with. [5] F. Liu, C. Masouros, A. P. Petropulu, H. Griffiths, and L. Hanzo, “Joint Radar and Communication Design: Applications, State-of-the-Art, and the Road Ahead,” IEEE Trans. Commun., vol. 68, no. 6, pp. 3834–3862, 2020.

[6] F. Liu, L. Zheng, Y. Cui, C. Masouros, A. P. Petropulu, H. Griffiths, and Y. C. Eldar, “Integrated Sensing and Communications: Towards Dual-Functional Radar-Communication Systems,” IEEE J. Sel. Areas Commun., vol. 40, no. 6, pp. 1728–1747, 2022. [7] T. Iye, M. Sakamoto, S. Takaya, E. Sato, Y. Susukida, Y. Nagaoka, K. Maruta, and J. Nakazato, “Open Wireless Digital Twin: End-to-End 5G Mobility Emulation With OpenAirInterface and Ray Tracing,” IEEE Access, vol. 13, pp. 175 109–175 122, 2025. [8] M. Polese, L. Bonati, S. D’Oro, P. Johari, D. Villa, S. Velumani, R. Gangula, M. Tsampazi, C. P. Robinson, G. Gemmi, A. Lacava, S. Maxenti, H. Cheng, and T. Melodia, “Colosseum: The Open RAN Digital Twin,” arXiv preprint, 2024. [Online]. Available: https://arxiv.org/abs/2404.17317 [9] P. Testolina, M. Polese, P. Johari, and T. Melodia, “Boston Twin: The Boston Digital Twin for Ray-Tracing in 6G Networks,” in Proc. 15th ACM Multimedia Systems Conference (MMSys), 2024, pp. 441–447. [10] D. Villa, I. Khan, F. Kaltenberger, N. Hedberg, R. S. D. Silva, A. Kelkar, C. Dick, S. Basagni, J. M. Jornet, T. Melodia, M. Polese, and D. Koutsonikolas, “An Open, Programmable, Multi-Vendor 5G O-RAN Testbed with NVIDIA ARC and OpenAirInterface,” in IEEE INFOCOM 2024 – IEEE Conf. Comput. Commun. Workshops (INFOCOM WKSHPS), 2024, pp. 1–6. [11] NVIDIA, “Sionna Research Kit: A GPU-Accelerated Research Platform for AI-RAN,” arXiv preprint arXiv:2505.15848, 2025. [12] B. Kumar, I. K. Jain, and V. K. Shah, “CellSense: A Sub-6 GHz Cellular ISAC System for Clutter-Robust Passive Sensing,” arXiv preprint arXiv:2606.07900, 2026. [13] B. Nuss, L. Sit, M. Fengler, J. Bhatt, and T. Zwick, “Frequency Comb OFDM Radar System with High Range and Velocity Resolution,” in Proc. IEEE Radar Conf. (RadarConf), 2017, pp. 0015–0020. [14] P. Falcone, F. Colone, A. Macera, and P. Lombardo, “Two-Dimensional Location of Moving Targets within Local Woods Using DVB-T Based Passive Radar,” IET Radar Sonar Navig., vol. 6, no. 8, pp. 744–754, 2012. [15] W. Zhang, C. Shi, F. Wang, S. Salous, and J. Zhou, “Micro-Doppler Signature Extraction and Analysis of Drone Using LTE Signals,” IEEE Access, vol. 8, pp. 172 986–172 995, 2020. [16] J. A. Zhang, M. L. Rahman, K. Wu, X. Huang, Y. J. Guo, S. Chen, and J. Yuan, “Enabling Joint Communication and Radar Sensing in Mobile Networks – A Survey,” IEEE Commun. Surv. Tutor., vol. 24, no. 1, pp. 306–345, 2022. [17] X. Mu, Y. Liu, L. Guo, J. Lin, and R. Schober, “Integrated Sensing and Communication-Enabled Predictive Beamforming with Deep Learning in Vehicular Networks,” IEEE Commun. Lett., vol. 25, no. 10, pp. 3301– 3305, 2021. [18] F. Liu, C. Masouros, A. Li, H. Sun, and L. Hanzo, “MU-MIMO Communications with MIMO Radar: From Co-Existence to Joint Transmission,” IEEE Trans. Wireless Commun., vol. 17, no. 4, pp. 2755–2770, 2018. [19] C. Sturm and W. Wiesbeck, “Waveform Design and Signal Processing Aspects for Fusion of Wireless Communications and Radar Sensing,” Proc. IEEE, vol. 99, no. 7, pp. 1236–1259, 2011. [20] M. Braun, C. Sturm, and F. K. Jondral, “Maximum Likelihood Speed and Distance Estimation for OFDM Radar,” in Proc. IEEE Radar Conf., 2010, pp. 256–261. [21] W. Khawaja, I. Guvenc, D. W. Matolak, U.-C. Fiebig, and N. Schneckenburger, “A Survey of Air-to-Ground Propagation Channel Modeling for Unmanned Aerial Vehicles,” IEEE Commun. Surv. Tutor., vol. 21, no. 3, pp. 2361–2391, 2019.

27

[22] S. Rahman and D. A. Robertson, “Millimeter Wave Micro-Doppler Measurements of Small UAVs,” vol. 10188, 2017. [23] V. C. Chen, “Micro-Doppler Effect in Radar: Phenomenon, Model and Simulation Study,” IEEE Trans. Aerosp. Electron. Syst., vol. 42, no. 1, pp. 2–21, 2006. [24] F. Kaltenberger, A. Khodakarami, C. D. Vleeschouwer, L. S. Cardoso, and R. Knopp, “OpenAirInterface: An Open-Source Software Radio Platform for 5G Research,” in Proc. IETF/IRTF Open Networking Summit, 2020. [25] R. Schmidt, S. Shariat, A. Karimzadeh, F. Kaltenberger, A. Clemente, and N. Nikaein, “FlexRIC: An SDK for Next-Generation Disaggregated and Programmable RANs,” in Proc. ACM CoNEXT, 2021. [26] M. Polese, L. Bonati, S. D’Oro, S. Basagni, and T. Melodia, “ColORAN: Developing Machine Learning-Based xApps for Open RAN Closed-Loop Control on Programmable Experimental Platforms,” in IEEE Trans. Mobile Comput., vol. 22, no. 10, 2023, pp. 5787–5800. [27] ——, “Understanding O-RAN: Architecture, Interfaces, Algorithms, Security, and Research Challenges,” vol. 25, no. 2, 2023, pp. 1376– 1411. [28] L. Bonati, S. D’Oro, M. Polese, S. Basagni, and T. Melodia, “Intelligence and Learning in O-RAN for Data-Driven NextG Cellular Networks,” IEEE Commun. Mag., vol. 59, no. 10, pp. 21–27, 2021. [29] A. Alkhateeb, “DeepMIMO: A Generic Deep Learning Dataset for Millimeter Wave and Massive MIMO Applications,” 2019. [30] J. Hoydis, S. Cammerer, F. A. Aoudia, A. Vem, N. Binder, G. Marcus, and A. Keller, “Sionna: An Open-Source Library for Next-Generation Physical Layer Research,” arXiv preprint, 2022. [Online]. Available: https://arxiv.org/abs/2203.11854 [31] J. Hoydis, F. A. Aoudia, S. Cammerer, M. Nimier-David, N. Binder, G. Marcus, and A. Keller, “Sionna RT: Differentiable Ray Tracing for Radio Propagation Modeling,” arXiv preprint, 2023. [Online]. Available: https://arxiv.org/abs/2303.11103 [32] L. U. Khan, Z. Han, W. Saad, E. Hossain, M. Guizani, and C. S. Hong, “Digital Twin of Wireless Systems: Overview, Taxonomy, Challenges, and Opportunities,” IEEE Commun. Surv. Tutor., vol. 24, no. 4, pp. 2230– 2254, 2022. [33] M. Polese, L. Bonati, S. D’Oro, S. Basagni, and T. Melodia, “dApps: Distributed applications for real-time inference and control in O-RAN,” arXiv preprint arXiv:2203.02370, 2022. [34] E. Baena, R. Krishnan, M. Vu, G. Zussman, and D. Koutsonikolas, “Toward native ISAC support in O-RAN architectures for 6G,” arXiv preprint arXiv:2603.03607, 2026. [35] 3GPP, “NR; Physical Channels and Modulation,” 3rd Generation Partnership Project (3GPP), Technical Specification TS 38.211, 2025, release-18; see Clause 6.4.1.4 (SRS). [36] M. I. Skolnik, Radar Handbook, 3rd ed. McGraw-Hill, 2008. [37] B. R. Mahafza, Radar Systems Analysis and Design Using MATLAB, 3rd ed. CRC Press, 2013. [38] H. Rohling, “Radar CFAR thresholding in clutter and multiple target situations,” IEEE Trans. Aerosp. Electron. Syst., vol. AES-19, no. 4, pp. 608–621, 1983. [39] Y. Bar-Shalom, X. R. Li, and T. Kirubarajan, Estimation with Applications to Tracking and Navigation: Theory, Algorithms and Software. Wiley-Interscience, 2001. [40] F. Colone, D. W. O’Hagan, P. Lombardo, and C. J. Baker, “A Multistage Processing Algorithm for Disturbance Removal and Target Detection in Passive Bistatic Radar,” IEEE Trans. Aerosp. Electron. Syst., vol. 45, no. 2, pp. 698–722, 2009. [41] R. Roy and T. Kailath, “ESPRIT – estimation of signal parameters via rotational invariance techniques,” IEEE Trans. Acoust., Speech, Signal Process., vol. 37, no. 7, pp. 984–995, 1989. [42] O-RAN Alliance nGRG, “dApp use cases and requirements,” O-RAN Alliance, Tech. Rep. nGRG-RR-2024-10, 2024.

Related documents

• Beyond RSRP Coverage: UAV Serviceability in Interference-Limited Urban 5G NR Networks#1037332
• Synchronized UAV multi-angle inversion of canopy structure parameters in wheat breeding materials.#330895
• Impact of announced wait time information on emergency department overcrowding mitigation: a simulation study.#221114
• HEAL: health-enhanced adaptive LoRaWAN for AI-based real-time soldier monitoring and status prediction.#193431
• Get into Teaching on Campus Events - Con_31995 — Department for Education — BAM Agency LTD#608080