Detection Algorithm for Cellular Synchronization Signals in Airborne Applications

Cellular to air communication is critical for the booming aerial package delivery and transportation business. Detecting cellular signals in airborne applications is challenging because it requires receiving and processing waveforms that are subject to significantly more interference than those experienced in terrestrial settings. This paper highlights and tackles the complexity of 4G Long Term Evolution (LTE) signal synchronization in high altitude applications, e.g., cell access onboard an aircraft. Specifically, we design a novel cell detector that operates efficiently under high interference levels found in airborne applications, maintains a constant false alarm rate using an optimized threshold implementation for Zadoff Chu sequences, and monitors multiple towers with different time delays simultaneously. We validate our cell detector through simulation and experimentation. Lastly, the cell detector is used to estimate the interference in live waveforms taken from an aircraft at 2 to 2.5 km altitude and velocities of 200–400 km/h. Our cell detection model can be adapted to support 5G New Radio (NR) synchronization signals as NR deploys aerial support in the future. The threshold implementation to handle correlation spurs can be applied directly to other Zadoff Chu based signals such as random access signals found in both LTE and NR.


I. INTRODUCTION
Cellular signal detection and synchronization for groundbased applications have been thoroughly investigated [1], [2]. The main challenges with synchronization include line of sight limitations, co-channel interference, and Doppler effects [3], [4]. The severity of these challenges increases in higher altitude applications. In the past, cellular infrastructure has not supported non-terrestrial applications for two main reasons. First, in the United States, the FCC and FAA have historically restricted airborne access to cellular infrastructure to avoid reception of airborne transmissions by multiple base-stations, resulting in degraded communication quality and capacity for terrestrial users. Second, such access restriction has discouraged investors and driven the market for non-terrestrial cellular applications down to around less than 1% [5]. Nonetheless, it is expected that the non-terrestrial cellular market will increase with the rapidly growing interest The associate editor coordinating the review of this manuscript and approving it for publication was Yue Zhang . in unmanned aerial vehicles (UAVs), changing regulations, and improvements in the cellular standard to mitigate multicell uplink activation [6]. Therefore, optimized cellular signal detection and synchronization for airborne applications is indeed necessary.
Some airborne co-existence measures are being implemented in the cellular standard and by researchers in the short term. The third-generation partnership project Release 15, which also covers the next increment of the cellular standard referred to as NR, supports co-channel frequency reuse [6], directional antennas, beamforming, antenna steering [7], [8], and coexistence with legacy telemetry [5], [6]. Subsequently, Release 17 will bring about improvements for non-terrestrial devices including timing and acquisition augmented by ephemeris, random access cell-to-cell handover, and general physical layer and medium access layer support [6].
Though NR will improve airborne cellular support, NR is, in essence, supplementing rather than replacing the existing LTE network [9]. NR will coexist with LTE in a hierarchy to add more capabilities for advanced applications such as aerial VOLUME 9, 2021 This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/ cellular devices. Airborne NR development will be more practical once future adaptations of the standard support airborne coexistence. This paper focuses on currently deployed LTE signals, while the NR infrastructure and releases are rolling out. However, the approach in this work can act as a guideline for future work with NR by updating sequences and the physical layer receive algorithm [10].
With the existing LTE infrastructure, the majority of nonterrestrial research and testing has been conducted with UAVs at altitudes of 30 to 150 meters and velocities of 30 to 50 km/h [11]- [14]. At these speeds and low altitudes, many of the challenges in establishing and maintaining synchronization do not manifest fully as compared to those encountered at higher altitudes (e.g. 2 -2.5 km) and speeds (e.g. 200 -400 km/h). While some existing studies address airborne access to LTE, they do not attempt to optimize the synchronization process itself for an airborne application and detect multiple synchronization sources. Moreover, there is no study of cellular synchronization in aircraft at higher altitudes and faster velocities.
This paper opts to fill the technical gap by making the following key contributions: • Provide an in-depth comparison of cellular synchronization methodologies found in literature.
• Develop an optimized primary signal synchronization (PSS) algorithm for high interference scenarios with a constant false alarm rate.
• Propose a PSS threshold implementation for detecting multiple signal sources to create a ''cell detector'' instead of the traditional ''cell search'' which only considers the most detectable signal.
• Characterize interference experienced by an airborne LTE receiver based on the PSS correlation results from both live and simulated waveforms.
The rest of the paper is organized as follows. Section II highlights the increased challenges of receiving signals from airborne platforms and the motivation for detector optimization. The various synchronization signals in LTE and common synchronization methods are compared in Section III. Section IV describes our novel design for an optimized PSS cell detector. Section V presents and processes live high altitude airborne waveforms. The proposed detector is used to characterize the interference levels found in the live airborne waveforms in Section VI. Section VII concluded the paper with a summary of the contribution and future work. A table of all used acronyms is provided in the Appendix for easy access.

II. INTERFERENCE IN AIRBORNE APPLICATIONS
The main challenges that affect a user of cellular networks on the ground are the Doppler effect [15], line of sight [16], and co-channel interference [3]. These challenges are even more impactful for airborne receivers, as illustrated in Fig. 1. First, many airborne receivers will be traveling at high speeds. A Piper PA-18, Boeing 747, and F22 Raptor have top speeds of 200, 1000, and 2400 km/h, respectfully. At these velocities, the max Doppler frequency shift at cellular frequencies is roughly 500, 2500, and 6000 Hz, respectfully. Estimating and correcting the effect of Doppler shifts improve synchronization performance and are considered essential steps [15].
Second, the base-station antennas are directional and may be tilted toward the ground which means that airborne receivers will have worse signal coverage [11]; it has been shown in [7] that approximately 90% coverage loss is observed above 50 meters. Additionally, receivers at 150 meters can be outside of the main lobe of the closest tower and instead connect to neighboring towers that would not be considered at 35 meters and below [7]. As a receiver's altitude increases, it will become even more likely to connect to these more distant towers instead of the closest one. At high altitudes, receivers also process indirect reflections of towers that do not have a direct line-of-sight (LOS), which leads to additional interference. Finally, aerial units experience more co-channel interference than ground-based devices; such an increase can be attributed to three different reasons, as seen in Fig. 2. The higher altitude increases the number of sightlines and exposes the receiver to more signals from multiple base-stations. Many of these signals can be indirect reflections off the ground, buildings, or other objects, yielding significantly degraded telemetry and reception. For ground transceivers, the tilt of base-station transmitters and the surrounding terrain limits the geographic overlap of channels operating on a single frequency carrier to only neighboring sectors, as seen in Fig. 3. Towers only overlap on the edges of cells where the different base-stations are fairly equidistant to the receiver. A higher level of co-channel interference for an airborne receiver is expected as many base-stations can overlap at different distances from the receiver on the same frequency carrier. Understandably, such channel overlap in time and frequency constitutes interference for the airborne receiver [3], [17].
Meanwhile, applying orthogonal frequency division multiple access (OFDMA) on the downlink can only support a finite delay between signals. For LTE and 5G, the guard interval is the cyclic prefix (CP); if the delay between base-station signals exceeds the CP, inter-symbol interference (ISI) will occur and symbols will interfere with subsequent symbols of other base-stations in the time domain. Additionally, the signals will become non-orthogonal to each other, which inherently breaks the basic functionality of OFDMA [18]. In OFDMA, subcarriers are designed to be tightly grouped and spaced such that their frequency response is zero at neighboring subcarriers as seen in Fig. 2. This relationship requires the symbol time to equal the inverse of the subcarrier spacing. When the delay between base-station signals at the receiver is too large, inter-carrier interference (ICI) would then cause additional interference between the subcarriers of multiple base-station signals at the receiver. The maximum difference in delay τ between time-aligned transmitting base-stations that preserves orthogonality at the receiver comes from the CP guard interval T CP and the maximum excess delay τ max of 2.5 µs [18]. T CP is based on subcarrier spacing and for this work is set to the most common case of 4.7 µs for 15 kHz subcarrier spacing. After converting to distance using the speed of light, the orthogonal path difference (OPD) between any two base-stations and the receiver is 656 meters as derived from (1).
In the air, the line of sight isolation is not present and can cause the receiver to capture multiple downlink signals with time delay differences and corresponding path length differences between base-stations and the receiver larger than the OPD [5]. ICI occurs even in non-overlapping frequencies when the delay between two signals is large. In Fig. 4, two randomly-generated 5 MHz OFDMA signals have been mixed. The interference signal: (a) occupies only the middle resource blocks, and (b) is delayed with respect to the measured signal. The measured signal only occupies the resource blocks on the edge of the signal so that both signals do not overlap in frequency and will not interfere with one another if they are time-synchronized, i.e., at zero respective delay from one another. The respective delay for the interferer grows, as seen in Fig. 4(c). After exceeding the OPD possible between the two signals at the receiver, ICI interference can be seen in the difference between the measured signal and the interferer, averaged across each subcarrier. After this critical maximum delay, all subcarriers lose orthogonality and cause ICI to all neighboring subcarriers even in non-overlapping frequencies. In summary, the higher and more complex interference found in airborne applications is inherently difficult to characterize and degrades the ability to synchronize and detect cellular towers [19].

III. SYNCHRONIZATION SIGNALS AND METHODS
To highlight the challenges of signal localization in airborne applications, we use LTE as an example technology. The following discussion of LTE synchronization details the processing that occurs on a specific LTE frequency VOLUME 9, 2021 carrier called an E-UTRA Absolute Radio Frequency Channel Number (EARFCN) after acquisition. The acquisition process involves identifying all the center frequencies of active EARFCNs in the LTE operating band(s). Fig. 5 shows the important channel locations for synchronization within the LTE downlink time/frequency frame structure, including the primary synchronization signal (PSS), secondary synchronization signal (SSS), and master information block (MIB) [20]. The reference symbols (RS) are also shown; RS can be used for synchronization, though their intended purpose is for channel equalization and measuring channel quality [20].
A device must synchronize to an LTE base-station to allow for the decoding of messages and data. Synchronization includes time, frequency, code, and antenna alignment to the LTE downlink. Time and frequency alignment is required to correctly access resource elements on symbols and subcarriers. Cell alignment is the process of finding an LTE basestation's physical cell identity (PCID) that is a value in the range [0, 503], and is traditionally found using the PSS and SSS. This value is required to decode channels and messages. Lastly, antenna alignment is the process of finding how many transmit antennas are in use on a particular LTE cell. This information is required to determine the location of certain channels in the time/frequency frame structure and decode messages properly [20].
There are three different potential options for obtaining the required synchronization information based on processing different portions of the LTE downlink, as illustrated in Fig. 6. Discussing these options is important to understand the scope and related work built upon in our approach. Processing of various sequences are shown as correlations performed in the ''t'' time domain or ''f'' frequency domain, but any of these sequences can be processed in the time and/or frequency domain with varying levels of complexity and performance. The scores are displayed in Fig. 6 as sensitivity (S), memory cost (M), and execution time (E) based on sequence sizes, required data rates, and performance testing. Typically, memory and execution time increase and decrease simultaneously and are grouped together. Execution time can indirectly boost the detector's sensitivity through processing more diverse spectral waveforms within the same period.
The LTE standard traditionally addresses synchronization using several correlations [15] as seen in Option A in Fig. 6. This process involves establishing time alignment and determining the sector ID (SID) with a PSS correlation. Then a cyclic prefix correlation removes any fractional frequency offset to provide frequency alignment. An SSS correlation then finds the group ID (GID), which is combined with the SID to find the PCID. At this point, time, frequency, and code alignment has been achieved, allowing the MIB to be decoded to determine the number of transmit antennas for the base-station as well as the system frame number. The system frame number is important for larger scheduling decisions in the LTE super-frame, which consists of 1024 frames. Option A is predominantly used because the PSS and SSS are compact and grouped in the center of the LTE carrier, which allows detectors to run at low sampling rates. Fig. 6 also shows an alternative synchronization process (Option B) using the CP for time alignment [21] and the PSS for frequency alignment [22]. Option B also notes that the RS can be used to find the PCID as well [23]. This option removes the need for performing the SSS and could be supplementary to finding the SID from the PSS. This option requires higher processing because RS are spread across frequency and time as compared to the centrally located SSS within the LTE downlink. Using reference symbols does provide time and frequency diversity, which can improve the signal detection performance. Finally, Option C, referred to as frequency offset detection, assumes that any of these sequences can be shifted in frequency in a scan-like fashion by the receiver. Shifting each sequence at multiple frequency steps requires much more processing and memory, but allows for frequency offset correction and better sensitivity [24].
Each of these synchronization strategies chooses the topmost detection for every stage of alignment and creates a ''cell search'' as only the topmost cell is found and monitored. Instead, in this paper, we seek to monitor multiple cells, which are likely to be reachable in airborne applications. Each step in the synchronization process needs to monitor multiple cells to create a ''cell detector''. We focus on the creation of a cell detector using the PSS sequence, as it is the first step in all three synchronization options presented above. The objective is to design a detector with a low sampling rate and complexity. Unlike the CP [15], the detector should recognize the presence of multiple towers simultaneously. The next section describes our proposed PSS cell detector.

IV. OPTIMIZED PSS DETECTOR FOR AIRBORNE APPLICATIONS
In this section, we present our PSS detector that tackles the aforementioned challenges of airborne applications. We first discuss the design challenges and trade-offs.

A. DESIGN CHALLENGES
To create an optimized PSS cell detector we first consider the sequence type and properties inherent to PSS correlations. The PSS is one of three Zadoff Chu sequences with different roots. Zadoff Chu sequences have strong correlation properties that assist with the synchronization process [20]. The traditional time-domain PSS correlation process is summarized in Fig. 7, where all three Zadoff Chu sequences are cross-correlated with an incoming signal.
Commonly, as in [25], [26], only the maximum PSS correlation from all three sequences and a single time alignment are considered in a cell search. This is typical when looking for just a single cellular sector. To create a cell detector, a threshold is required to determine if multiple PSS correlations on the three Zadoff Chu sequences and at different time offsets are valid. Most PSS detectors that use a threshold skip the development entirely by saying that it is predetermined [27]. Commonly as in [23], [28], a detector uses a threshold based on the mean of the correlation results. However, this does not account for spurious correlations found when doing correlations with Zadoff Chu sequences [20], [29] that are amplified in the presence of carrier frequency offsets (CFO). CFO manifests because of the Doppler effects and oscillator drift [30].
Furthermore, CFO causes the spurious correlations to grow with increasing frequency shift and is expected in airborne applications. To illustrate the CFO effect on correlation spurs, we have simulated an LTE signal with PSS (sequence 0), SSS, RS, and MIB at different frequency offsets. The simulation is conducted using the LTE and signal processing toolboxes from Matlab 2020b to develop a platform for signal creation and interference testing. Fig. 8(a) shows the correlation result of the time domain for the known Zadoff Chu sequence of zero and without a frequency shift. The true correlation peak that will align the detector to the tower is shown with four spurious correlation peaks. In Fig. 8(b) the true peak and four spurious correlations are tracked with frequency shifts to simulate a CFO. Increasing frequency shifts increase the corresponding spurious peaks in the correlation. While the mean of the other time samples (or non-peaks) remains relatively low. This further demonstrates the need for our optimized cell detector in airborne applications where spurious peaks are expected to increase under Doppler's effect and are present at even small frequency shifts within a subcarrier.

B. AIRBORNE CELL DETECTOR
To support airborne applications, our PSS detector combines multiple existing performance-enhancing digital signal processing elements. A block diagram description of our proposed detector is shown in Fig. 9 in an airborne scenario. Fig. 9 captures the flow and detailed steps of our approach. Our signal detection scheme considers spurious correlations inherent to Zadoff Chu sequences to create a constant false alarm rate over other approaches and allows for the detection of multiple towers. Our resulting correlation to noise ratio (CNR) can then be used to estimate the interference on the PSS sequence itself. Our detector can correct for large frequency shifts by repeating the design in Fig. 9 at multiple frequency steps as shown in the ''scanning'' method in Fig. 6. These improvements to the cell search type detector shown in Fig. 7 allow for detection and characterization in airborne applications.
First, cross-correlation is performed between incoming received waveform (y) and known conjugated PSS sequences (x * µ ) for each PSS SID (µ) zero, one, and two, which correspond to Zadoff Chu roots 25, 29, and 34. The received signal (y) is separated into sections (γ ) whose size is flexible. Equation (2) shows the cross-correlation operations and power delay profile of the received sequences as: For LTE, the known sequence (x * µ ) contains the 63 length PSS sequence padded to the DFT size of 128 reference elements (N P ) at the lowest rate of 1.92 MS/s. x * µ is then padded with (N FFT −N P ) zeros to match the length of the received segment (N FFT ). To utilize the DFT the cross-correlation is performed in the frequency domain as follows: Each cross-correlation with receive segment (γ ) must have the last N P samples removed from the result because the DFT creates a circular cross-correlation. N FFT can be set to any value that is larger than N P . This flexibility and optimization is an important distinction from fixed-sized DFT approaches in other works [15], [31]. A similar approach is applicable with any synchronization signal, including 5G NR, by modifying sequence values, lengths, and sampling rate. Such an LTE/5G signaling feature allows for the optimization of the DFT correlation size on a particular receiving system where the optimal DFT size can vary based on the hardware. Executing the cross-correlation with the DFT and optimizing the DFT size is not only important for execution time but also indirectly increases the detector's sensitivity by allowing more diverse waveforms to be processed. Next, we combine a series of conditioning steps in Fig. 9 to improve the traditional PSS cell search found in Fig. 7. Each receive segment is appended to previous segments and averaged non-coherently over 160 ms for maximum sensitivity in high interference, as recommended by [32]. This creates an output correlation result with a length of the PSS period (half a frame) represented from hereafter by z. A moving average takes oversampled input waveforms by a factor of two or the smallest rate, which is 1.92 MS/s for LTE and 3.84 MS/s for 5G. Using a moving average helps in accounting for phase misalignment. By incorporating digital processing elements to expedite the execution, our detector can better sense signals under high interference found in airborne applications.
The maximum of each PSS sequence is found with respect to the time sample offset , as seen in (5).
A threshold factor (T ) can be created using the desired false alarm probability and cumulative distribution function as described by [28]. The threshold, however, assumes that additive white Gaussian noise (AWGN) variance is one and in practice must be adjusted with a modifying factor m to create the detection threshold T det , as seen in (6).
Typically the modifying factor only targets the noise level by finding the mean of the correlation, as shown in (7). This has been done for Zadoff Chu [15], [28] as well as other sequences [23].
However, to account for false detection from PSS spurs we adapt the modifying factor to primarily target correlation spurs and secondarily target the noise envelope.

C. DETECTION THRESHOLD
In our design, we create a threshold that targets the inherent Zadoff Chu correlation spurs. To better understand these correlations spurs we investigate their effects. Fig. 10 shows the correlation of a high and low signal-to-noise ratio (SNR) for each PSS sequence against a known baseline (Sequence 0) normalized between zero and one. The correlation peak for high SNR occurs at around 88% and the correlation peak for the low SNR occurs at around 36%. Spurious false correlations occur in the duration of a symbol around the true PSS correlation peak. These spurious correlations occur as the known PSS is swept across the transmitted PSS and even occur in PSS sequences that do not match. The spurious correlations are the highest in sequence 2, with a maximum peak at around 12.5% for the high SNR and around 7.5% for the low SNR signals. The spurious correlations diminish with added noise so they occur most prominently in high SNR or high CFO. Our detector targets the correlation spurs when creating a threshold to maintain performance under high and low SNR.
To create the spur-based modifying factor m s , first, the correlation output is sorted, ← z = sort(z), in descending order, and then an adaptable range is set to target the correlation spurs in (8). To allow for multiple true peaks within a single PSS sequence the modifiable range can be set based on the number of true peaks P # , and size of peaks p in samples. Then, the same range covers the spurs by averaging over a range considering the number of spurs S # , and size of spurs s in samples. For our simulations, p was set to three, P # was set to two, s was set to two, and S # was set to three based on approximation of spur sizes seen in Fig. 10.
Then, the updated threshold is compared with the correlation for every (µ) sequence as seen in (9).
z(l, µ) ≥ T · m s (µ), thus, the tower is detected at location l z(l, µ) < T · m s (µ), thus, no detections The correlation can be scaled to create an CNR and corresponding threshold CNR T that can be modified to fit a probability of false alarm, as shown in (10). The CNR represents the peak height of the PSS correlation peak over the new modifying factor expressed in decibels.
The CNR weighs each potential PSS peak over the expected spurious correlations foremost and then the varying noise envelope. Our cell detector is seen in Fig. 9 can then prevent false positives from correlation spurs while maintaining high sensitivity, create a fixed threshold on the CNR that represents the confidence of each PSS peak, and allows for multiple sequences and time offset detections expected in airborne applications. The CNR can be used to estimate the channel conditions based on the PSS, instead of the traditional RS based channel estimation, which requires time and frequency averaging that cannot be done on the PSS. RS channel estimation generally requires larger sampling rates leading to increased detector complexity [15]; such shortcoming is avoided by our approach. Lastly, in airborne scenarios, the cell detector can operate over a frequency correction scanning range and step sizes, and consequently our design has to account for CFO. As discussed in Section III and shown in Fig. 8, correlation spurs increase with increased CFO. Our threshold accounts for these spurs and reduces the dependency on CFO correction. However, the cost of CFO estimation and correction may be worthwhile depending on the degradation of the PSS sequence under the expected Doppler shift. Multiple algorithms address CFO detection and correction to handle Doppler effects and frequency mismatch between the transmitter and receiver. The fractional frequency offset (FFO) refers to the CFO that occurs within a subcarrier, +/− 7.5 kHz where the integer frequency offset (IFO) denotes CFO that is greater than a subcarrier. To compensate for the Doppler effects, the CP is typically used [22]. This is possible because the CP auto-correlation compares a known piece of an LTE/NR symbol with the copied portion at the beginning of the symbol. The angle between these correlations can be used to find the FFO that can then be compensated for to improve the rest of the synchronization process. Additionally, the PSS itself can also be used to compensate for the Doppler effects [33], because the PSS repeats the same sequence in both the time and frequency domain. The partial PSS sequence is time-reversed when it repeats and provides a repeated signal that can be used to measure the change in phase and estimate the FFO as well. Moreover, IFO can be handled using the scanning detector, as described in Option C from Section III. How necessary and over what frequency range to scan depends on the expected velocity of the aircraft; the degradation of the PSS sequence and expected variations in correlation spurs. Regardless, our threshold approach increases the detection performance when spurs occur in CFO estimation and correction. The results in Fig. 10 use the same simulated waveforms as Fig. 8 with added noise to create different SNR as described in the next section.
The cell detector described in this section overcomes inference and correlation spurs found in airborne applications. Any LTE RF receiver and processor on board an aerial system can run the detector as seen in Fig. 9. This includes both manned and unmanned aircrafts such as UAVs. The detector could be adapted to other applications involving fast moving objects such as satellite and high speed trains where interference is severe.

V. SIMULATION-BASED VALIDATION
In this section, we validate our PSS cell detector through simulation and compare its sensitivity under poor SNR, VOLUME 9, 2021 thresholding approach, and CFO correction to alternative techniques. Simulated waveform, y, has been created using (11) by modulating an LTE signal (ψ) containing RS, PSS, SSS, MIB, user data including control channels, and mixing in AWGN with noise gain, η, and randomized vector, r. The simulated model included varying network loads, yet such variations did not cause meaningful changes in the validation or comparison. Multiple different PCID have been tested showing similar results; however, only signal processing for Zadoff Chu sequence PSS group ID zero is illustrated.
The noise gain as shown in (12) is added before OFDM demodulation and must be scaled to normalize the SNR at the receiver, where snr is a linear SNR. To scale the noise gain, the square root of the FFT size (N FFT ), the number of transmit antennas (α), and the average modulation magnitude (1 sqrt (2)) must be used. Fig. 11 shows the receiver operating curve for our optimized PSS algorithm using simulation-produced signaling waveforms at different SNR levels. Signal detection is only deemed successful if both the PSS sequence and location in time are detected correctly. Any signal with an SNR of −9 dB or higher had perfect detection performance. The performance began to deteriorate between SNR values of −10 dB to −13 dB with almost no signal detectability at −18 dB and below. Such performance of our PSS cell detector is comparable to other highly sensitive PSS cell search algorithms [25], [34]. However, our design enables detecting multiple towers at different time offsets down to this sensitivity and not just a single tower and time offset. Using a mean correlation threshold [15], [23], [28], [35] does not account for the spurious correlation peaks from Zadoff Chu sequences. The probability of false alarm changes with varying SNR values of the incoming signal as seen in Fig. 12(a) and can also lead to improper detection. For example, to maintain a low probability of false alarm the threshold has to be set up at 20 dB CNR based on Fig. 12(a). This limits the region of operation for a high probability of  detection to −7 dB. These spurious correlations create an opportunity and a challenge in setting a detection threshold. Our threshold implementation is targeting the spurious correlations as seen in Fig. 12(b), which creates a flatter probability of false alarm. A lower probability of false alarm can be maintained by setting the threshold mostly based on the spurious correlations foremost while factoring in the top portion of the correlation noise secondarily. Once noise correlations are higher than the spurious correlations the threshold will be determined by the correlation noise instead of the spurs. Using the spurious correlation aware threshold allows for a lower CNR threshold of around 7 dB, extends the high probability of detection to lower SNR by about 4 dB.
To determine to what extent frequency offset correction is required in our PSS cell detector we look at how the PSS algorithm performs under simulated Doppler effect for varying velocities. Fig. 13 shows the change in PSS CNR from our cell detector with different known frequency shifts for each  Fig. 13 illustrates that Doppler and frequency offsets do have some impact on the performance of the PSS detector, but not enough to be considered for the cruising speed of commercial aircraft (Piper PA-18). The frequency correction methods previously described can account for larger frequency shifts if operating at higher velocities. Determining the need for frequency correction helps limit the complexity and cost of the algorithm. Next, we look at how the PSS algorithm performs in a live airborne experiment and estimate the levels of SNR that are found within that scenario.

VI. EXPERIMENTAL RESULTS
We have evaluated the performance of the cell detector by estimating the level of interference in waveforms collected from an aircraft during flight over a suburban and rural area in Frederick County, Maryland, USA, that is served by multiple LTE towers. This tests against physical constraints found in live airborne waveforms that are difficult to capture in simulated data.

A. EXPERIMENT DETAILS
An airborne trial was performed in a low-speed aircraft similar to the Piper PA-18 with an omnidirectional antenna operating over a suburban to rural region. The IQ sampling rate of the receiving system was set to 100 MS/s and recorded at 1950 MHz which is a mixed cellular band. The test was performed at altitudes between 2 and 2.5 km, which is much higher than what is found in the literature. At these altitudes, receiving and synchronizing to LTE are challenging as explained in Section II. Fig. 14 displays the power spectrum density (PSD) of the trial waveforms. A null carrier found in the center of LTE signals can be used to determine what frequency carriers are for LTE. There are two LTE frequency carriers visible in Fig. 14, at 1940 MHz and 1955 MHz. The PSD averages power so the envelope for both of these signals has a higher power level than at a given instant in time.
To estimate the SNR of the signal, we consider both frequency carriers individually and the average power, as seen in the DFT plots in Fig. 15. The SNR is measured from the average inband power to the guard band power while considering only the top portion of the inband power as not all carriers have to be populated in LTE. The estimated SNR of the frequency carriers centered at 1940 MHz and 1955 MHz are found to be approximately 20 dB and 14 dB, respectfully. Overall, Fig. 15 suggests that the power envelope of LTE signals is high and that there is little concern for the ability of the receiver to detect the channels within these signals.

B. CELL DETECTOR OUTPUT
We determine the success of our cell detector by measuring how many towers are detected versus the standard cell search. We also compare our threshold performance to those done for low SNR ground [23], aerial navigation [15], and satellite-based applications [28], and calculate the difference in distance between the detected towers as an indication of the complex interference scenarios discussed in Section II. Fig. 16(a) and (b) show the results of our PSS cell detector for VOLUME 9, 2021 the experimental airborne waveform collection. As a baseline for comparison, we also show results from the simulation in Fig. 16(c) from Section V, which reflects the detector output under ideal conditions (SNR: 30 dB). In the simulation results found in Fig. 16(c), the threshold for both constant false alarms 0.2% and 2.0% are shown and the true sequence (PSS 0) is the only sequence of the three PSS sequences to pass the threshold.
Using the cell detector, the airborne trial LTE signal ''A'' from Fig. 16(a) centered at 1940 MHz has only one detection from sequence 1, which is above both the 0.2% and 2% probability of false alarm thresholds. This result indicates that at least one tower is detected. More interestingly, LTE signal ''B'' in Fig. 16(b) centered at 1955 MHz has all three sequences pass the thresholds and at different time stamps. Such a result implies that at least three sectors are present on this carrier frequency. Alternatively, a cell search was only able to detect sequence zero in signal B and missed sequences one and two. Additionally, using the mean based thresholds for low SNR ground [23], aerial navigation [15] and satellite-based applications [28] applications results in no tower detection for signal A and detection of only sequence zero in signal B using a probability of false alarm of 2%. Assuming the towers are time-aligned at the source of transmission, the time difference between sequence zero and sequence one in signal B indicates a path length difference of 15 km, which is much larger than the maximum OPD and the expected path length found in ground applications (a few hundred meters). This path length difference is almost the maximum cell size of 20 km, and thus strongly indicates reception of non-neighboring towers at the same time at the airborne receiver. Additionally, as stated earlier, there is no guarantee that the strongest signal is the closest. All detected correlations in the airborne waveforms have low CNR compared to the simulated waveforms in Fig. 16(c) indicating that there is high interference.
As expected and previously discussed in Section II, the airborne experimental waveforms are difficult to characterize because there are so many different possible types of interference. However, our cell detector has a constant false alarm rate and can operate over varying CFO and signal to interference plus noise (SINR). SINR conveys the unknown level of interference in the experimental waveforms and is used for the rest of the paper in place of SNR. Moreover, the threshold used by our approach prevents spurs from creating false alarms and gives higher sensitivity and credibility to peaks found over the threshold.

C. CHARACTERIZATION
To better understand the level of interference within the LTE frequency carrier, signals A and B in the collected airborne signals we have characterized them by comparison with simulated waveforms generated in Section V, whose SINR is known. Fig. 17 shows the PSS correlation result for each simulation-created SNR. The PSS correlation results are then mapped from the live airborne waveforms to the simulated waveforms to approximate and compare the interference seen on the PSS sequences between simulated and experimental results. Fig. 17 shows PSS correlation results in the range of 9 to 11 dB; these results map to the simulated waveforms at around −10 dB SINR. This allows us to estimate the interference on the PSS sequences in the airborne signals as an estimate SINR as seen in Table 1. Table 1 shows that even though the received signals' power envelope is 15 to 20 dB for these LTE signals, the interference within the signal on the PSS yields an effective SINR of −9 to −7 dB. The power envelope to SINR difference and the number of PSS sequences seen at different time offsets indicates this high level of interference is most likely from co-channel interference as described in Section II and that there were likely multiple indirect propagation paths from towers to the aircraft. Thus, our approach avoids the need to use an additional RS estimation of the channel by creating a PSS CNR that can characterize the channel. The spur and envelope threshold-based CNR enable useful characterization for varying SINR. Additionally, by creating a cell detector over a cell search we can detect multiple towers at different time lags with high sensitivity.

VII. CONCLUSION AND FUTURE WORK
In this paper, we have designed a PSS cell detector that combines multiple digital signal processes to combat high interference expected in airborne applications. Also, we have defined a threshold and CNR for our detector based on Zadoff Chu correlation spurs to provide a stable false alarm rate and allow for multiple diverse cell detections. We have defined a cell detector to find multiple towers at different time offsets, unlike a cell search, which only requires the maximum correlation. We have also devised guidelines for CFO correction based on the velocities of the airborne objects and have demonstrated how correlation spurs depend on the frequency offset. Lastly, we have used this approach to estimate inference in waveforms taken by a propeller plane at 2 to 2.5 km in altitude, which is much higher than conditions addressed in literature. Using our approach, the PSS has been successfully detected for multiple towers on a single LTE carrier frequency and at different time lags within the airborne waveforms. The PSS interference has been further characterized by comparing PSS CNR values observed in the collected waveforms with PSS CNR for simulated LTE waveforms as a function of SNR.
The comparison has shown that though the PSD envelopes of the LTE carriers appeared high in the experiment, co-channel interference within the channel resulted in interference levels of between 20 to 25 dB on the PSS sequence.
The DSP elements in our cell detector are directly applicable to other synchronization sequences found in LTE and NR. The threshold and CNR implementation are directly applicable to other Zadoff Chu sequences such as the random access procedures found in LTE and NR. The threshold implementation can be updated to support other sequences such as gold codes and m-sequences found in LTE and NR. As the cellular infrastructure improves aerial coexistence in upcoming releases, further investigations on inference improvements will be critical for optimizing cell detectors for NR. For future live airborne cellular tests, a direction antenna could help isolate specific towers and reduce co-channel interference by placing angularly distributed cells into side lobes. At higher altitudes, signal levels could become a problem and a directional antenna at the receiver could improve the receiver's gain. Additionally, tracking the cellular base-stations could be implemented with known location data and compared.