EMF Exposure in 5G Standalone mm-Wave Deployments: What Is the Impact of Downlink Traffic?

The rolling-out of 5G networks is recently including 5G Base Stations (BSs) operating on millimeter-Wave (mm-Wave) frequencies. The goal of this work is to shed light on the exposure assessment from commercial 5G mm-Wave 5G BSs, by focusing on the impact of downlink traffic on the exposure levels. To this aim, we adopt an innovative measurement framework, based on hardware and software components, able to satisfy the challenging measurement requirements of mm-Wave frequencies. In addition, we design a completely softwarized algorithm, called M-WAVE, in order to measure the mm-Wave exposure with a programmable spectrum analyzer. Results, obtained from a commercial 5G scenario, reveal that the exposure from the mm-Wave BS is directly proportional to the amount of traffic injected on the wireless link. However, the electric field is always lower than 0.08 V/m, while the downlink traffic is even larger than 800 Mbps.


I. INTRODUCTION
T HE ROLL-OUT phase of 5G networks is involving the installation of 5G Base Stations (BSs) in several countries in the world [1]. Compared to previous generations, 5G exploits a large set of frequencies, ranging from spectrum portions below 1 [GHz] and/or in the mid-band range (up to 6 [GHz]) -thus similar to the ones in use by 4G -, to innovative bands of millimeter-wave (mm-Wave) frequencies, reaching dozens of Gigahertz. Focusing on the latter, the mm-Wave domain is not a novelty in the wide communications area, as such frequencies were already employed in the past for military and radar services [2]. However, the adoption of mm-Wave spectrum for mobile communications is a point of discontinuity with respect to legacy 2G/3G/4G generations [3]. In addition, several 5G deployments are turning from Non-StandAlone (NSA) implementations to StandAlone (SA) ones [4], in which the 5G network is completely independent (from the radio access to the core) with respect to the 4G one.
5G BSs operating on mm-Wave frequencies introduce several novelties and challenges, which include (to cite a few): i) a strong impact of obstacles and buildings on the path loss [5], which tend to reduce the coverage area compared to legacy technologies and/or lower 5G bands, ii) a throughput increase [1], as mm-Wave frequencies typically exploit very large bandwidth (hundreds of MHz), which allow creating high capacity "tubes" to serve the users, iii) a strong directionality of the 5G signals [6], particularly those ones carrying traffic data, which are synthesized through efficient beamforming techniques -and thus allowing a strong spatial reuse of the radio resources over the territory, and iv) an extreme optimization of the radiated power, which is largely proportional to the amount of traffic from/to the users.
In this context, the assessment of ElectroMagnetic Field (EMF) exposure from commercial mm-Wave BSs is a fundamental step with several implications in different domains. At the societal level, in fact, part of the population is worried about the impact of mm-Wave antennas on the received exposure levels, with mixed feelings that are associated to 5G technology [6]. At a regulation level, ground-truth measurements should demonstrate that mm-Wave exposure complies with maximum limits defined by law [7]. At the research level, then, the topic is relatively in an infancy phase, as few works face the measurement of mm-Wave BS exposure in pre-commercial 5G deployments (see, e.g., [8]), and very few in commercial ones [9], [10]. In addition, the definition of EMF measurement methodologies tailored to the mm-Wave domain is of interest for both international and national exposure standardization bodies, which define the procedures to assess the exposure compliance against the maximum EMF limits [11], [12].
Given this picture, a natural question is then: Is it possible to evaluate the EMF exposure from a commercial 5G SA deployment operating in the mm-Wave domain? And, consequently, what is the impact of user traffic on the amount of exposure? The goal of this paper is to shed light on the aforementioned questions. In more detail, we focus on a commercial 5G mm-Wave BS installed in a town by a Fixed Wireless Access (FWA) operator. We then design a new framework, composed of both HardWare (HW) and SoftWare (SW) measurement tools, able to perform narrow band measurements over the mm-Wave channel and to evaluate the exposure when a synthetic downlink (DL) traffic is forced on the mm-Wave link between the BS and the User Equipment (UE). To this aim, we describe the innovative solutions that we adopted to match the level of throughput of the mm-Wave channel (i.e., in the order of Gbps). Results, obtained over different measurements sets, clearly demonstrate that the EMF from the mm-Wave BS scales with the amount of generated traffic: the more is the DL traffic injected in the communication link, the higher is the exposure (as expected). Surprisingly, the EMF is very limited (always lower than 0.08 V/m), while the achieved throughput is huge (even larger than 800 Mbps). Eventually, we analyze the configurations of the measurement devices that can easily lead to a (wrong) over-estimation of the measured exposure from the mm-Wave BS.
The rest of the paper is organized as follow. The positioning of our work with respect to the literature is analyzed in Section II. The description of the FWA service over 5G mm-Wave is summarized in Section III. Section IV highlights our innovative framework to collect EMF measurements from 5G mm-Wave BSs. Section V details the measurement scenarios. Results are reported in Section VI. Finally, Section VII concludes our work.

II. WORK POSITIONING
We discuss the positioning of our work against the related works falling in the following categories: i) BS exposure measurements from mid-band 5G deployments, and ii) BS exposure measurements from mm-Wave 5G deployments.

A. EXPOSURE FROM 5G MID-BAND DEPLOYMENTS
The assessment of exposure from 5G BSs operating up to 6 [GHz] is covered by [13], [14], [15], [16], [17], [18], [19], [20]. In more detail, Deprez et al. [13] introduce new measurement methodologies and exploit measurement equipment for collecting time-averaged exposure. In addition, the authors estimate the maximum extrapolated field exposure in different 5G deployments (located in a set of countries) operating on frequencies lower than 6 GHz. Chiaraviglio et al. [14] design and evaluate a new measurement methodology to measure exposure from 5G BSs in a commercial deployment. The authors exploit a set of measurement tools (including, e.g., Spectrum ANalyzers (SANs), EMF meters and smartphones), which are used in cascade to collect exposure data. The electric field is then measured from a commercial deployment providing 5G coverage over dedicated frequencies (up to 3.6 GHz) and frequencies licensed to legacy technologies (through the Dynamic Spectrum Sharing (DSS) functionality). Migliore et al. [15] investigate the maximum power extrapolation techniques based on the 5G frame structure, by forcing the traffic toward the BS. Colombi et al. [16] measure the actual radiated power of 5G BSs from a commercial carrier. In more detail, their exposure dataset is based on output power and actual gain that are collected through a monitoring tool managed by a network operator and installed over a set of 25 5G BSs, all of them operating up to mid-band frequencies. Aerts et al. [17] design an in-situ assessment for a set of 5G BSs operating in the mid-band range. The authors evaluate exposure by also injecting synthetic traffic on the link between the mid-band BS and the UE. Results demonstrate that the exposure from 5G BSs is in general lower than the international EMF limits, even when traffic is forced towards the UE.
Eventually, Chountala et al. [18] design and evaluate a measurement testbed for measuring EMF exposure from a commercial 5G BS operating in the mid-band. Lee et al. [19] measure the uplink power and demodulated metrics (such as the Synchronization Signals -Reference Signal Received Power (SS-RSRP)) by exploiting a set of smartphones installed on a van. The authors perform a large exposure assessment (in terms of received and transmitted power from the UE) over the city of Seoul. Again, the measured data are collected from 5G deployments operating in the mid-band. Finally, Elbasheir et al. [20] collect BS exposure-related data (in terms of received power), by employing a set of smartphones installed on a car. Their analysis, which covers also legacy pre-5G technologies, includes de-modulated signals over a 5G New Radio (NR) frequency of 2600 [MHz].

B. EXPOSURE FROM 5G MM-WAVE DEPLOYMENTS
Franci et al. [8] reports a set of measured data that are retrieved from a pre-commercial 5G mm-Wave BS installed in the historical center of Rome (Italy). Their analysis is mainly based on the study of the signal characteristics over the mm-Wave domain. Interestingly, the authors observe a strong increase in the signal occupancy when traffic is injected from the 5G BS. However, the evaluation of the exposure levels is left for future work.
Focusing on commercial mm-Wave deployments, very few works [9], [10] measure the EMF from operative mm-Wave BSs, mainly due to the fact that 5G mm-Wave deployments have been installed very recently -and still not pervasively in the world. Therefore, the assessment of exposure from such deployments is a novelty in the field. In more detail, Liu et al. [9] collect narrow-band EMF measurements from a mm-Wave BS operating on 28 [GHz]. The authors exploit a measurement chain composed of an SAN and a horn antenna, pointed towards the mm-Wave BS under investigation. In addition, a UE is used to force DL traffic on the link between the BS and the UE itself. The DL exposure is evaluated in different conditions, which include: i) UE powered on and generating DL traffic, ii) UE powered on and not generating any traffic, iii) UE powered off. Interestingly, a maximum field of 0.08 [V/m] is recorded during the experiments.
Wali et al. [10] measure the exposure from a mm-Wave BS, by exploiting a measurement chain composed of a network scanner, a down-converter and an omni-directional antenna. A code-selective methodology, based on the extrapolation of exposure from the power collected over decoded 5G signals (like the SS-RSRP), is applied. Interestingly, the extrapolated EMF levels are higher than the ones measured by [9], with an average electric field reaching up to 2.02 [V/m]. Moreover, the authors perform several tests with a UE, including voice call, video call, video streaming, uplink (UL) and DL synthetic traffic. Surprisingly, the exposure collected during the UL and DL synthetic traffic tests is lower compared to the case without injected traffic.
In contrast to [8], [9], [10], we focus on a mm-Wave commercial 5G BS providing the FWA service, in which a Customer Premises Equipment (CPE) (and not a smartphone) is used as a terminal. However, similar to [8], [9], [10], our measurements are based on the generation of DL traffic on the wireless link between the mm-Wave BS and the CPE. Differently from [8], [9], [10], a key focus of our work is on the design of a completely softwarized measurement methodology, based on a new EMF measurement algorithm that controls the SAN through remote commands. In addition, we directly measure the 5G channel power, and not demodulated signals like in [10]. Consequently, we do not have to apply any maximum field extrapolation formula (which may introduce uncertainties) to obtain the total electric field on the entire 5G channel. Moreover, differently from [8], [9], [10], we compare the collected EMF measurements against the exposure that is computed from the power counters recorded by the mm-Wave BS -an information that is made available by the operator. Finally, we focus on the implementation of a controlled traffic generation chain (an aspect not considered by [8], [9], [10]), which is able to saturate the huge capacity of the mm-Wave link, and consequently to evaluate the exposure under the maximum DL traffic condition towards the CPE.

III. FWA SERVICE OVER 5G MM-WAVE: A PRIMER
We provide hereafter a brief overview of the FWA service that is considered in this work -which can be useful for the non-experts in the field. First, we highlight the architecture and management characteristics of the FWA service in comparison to a mobile one. We then overview the spectrum usage of FWA, with a focus on the current frequency assignment in Italy. Finally, we detail the FWA service over mm-Wave, as well as the relevance of such knowledge to design the EMF measurement algorithm.

A. ARCHITECTURE AND MANAGEMENT
FWA aims at bringing broadband connectivity to households in white/gray areas, in which Fiber To The Home (FTTH) and Fiber To The Cabinet (FTTC) options are not available. The FWA architecture exploits the same Radio Access Network (RAN) elements of mobile operators, including 5G BSs [21]. The main difference with respect to the mobile service is represented by the terminal: FWA requires in fact a dedicated equipment, called CPE, which is installed at the customer household. Typical outdoor CPE deployments include roof and/or balcony installations [22], in which the CPE is in Line-of-Sight (LOS) channel conditions with respect to the serving BS. Obviously, a CPE has less stringent power constraints compared to a smartphone. In particular, this device is connected to an electricity plug. Therefore, the energy consumption is not so crucial as in battery-operated devices (although the total power consumption of the CPE is always rather limited). Moreover, the CPE power class -which influences the maximum radiated power -may be higher than the smartphone (depending on the model). The CPE then hosts other interfaces (e.g., Ethernet, WiFi) that provide indoor connectivity to the customer.
Unlike a smartphone, a CPE is typically not moved across the territory. Consequently, the mobility management is simplified compared to a mobile service. For example, an FWA operator may implement "soft" mobility capabilities, by, e.g., limiting the handovers only to cells/beams that can serve the CPE. By exploiting the static CPE positioning, the operator can highly optimize the radio parameters on the link between the serving BS and the CPE, as the network channel conditions (including serving BS, interference level, etc.) experience a lower dynamicity compared to mobile terminals, and therefore they can be more easily tuned to enhance performance on the wireless link.

B. SPECTRUM USAGE
Historically, the FWA operators in Italy adopted the pioneering band of 3.4-3.6 [GHz] [23]. However, the technology in use was not 5G, since it was not yet available when the 3.4-3.6 [GHz] spectrum was auctioned. Consequently, other solutions were adopted, like WiMAX, HyperLAN, and then Long Term Evolution (LTE). More recently, the rapid expansion of the Italian FWA market (which is currently the largest one in Europe [24], serving roughly 1.7 millions of FWA subscribers [25]), coupled with the need of providing a service able to compete with wired connectivity [22], has made the adoption of 5G technology a natural option for FWA operators. Currently, the Italian operators are providing FWA service in two different ways, namely: i) by exploiting 4G/5G technologies in the 3.4-3.8 [GHz] band and/or ii) by offering FWA over dedicated portions of close-to-mm-Wave spectrum in the range 26.5-27.5 [GHz]. Focusing on the former solution, different operators are multiplexing mobile and FWA subscribers over the same network. Focusing instead on the second one, the implementation of FWA over mm-Wave frequencies can potentially become a killer application for 5G [26], particularly for Enhanced Mobile Broadband (eMBB). Consequently, the number of 5G BSs providing such service is expected to rapidly increase in the near future in many countries [24].

C. MM-WAVE IMPLEMENTATION AND RELEVANCE
In this paper, we focus on the FWA service provided by Fastweb operator over the 27.1-27.3 [GHz] band. The exploitation of a mm-Wave channel is of particular interest for FWA, as this is the only (contiguous) bandwidth that allows achieving throughput comparable with fiber options, and thus offering a true Gbps broadband service. In particular, the operator has deployed a SA 5G network, which is completely independent from the 4G one. On the other hand, NSA 5G deployments frequently exploit a 4G anchor carrying control information. In addition, a dual connectivity between 4G and 5G is exploited during data transfer [27]. In our scenario, instead, both control and traffic information are carried over the mm-Wave 5G channel. Consequently, the exposure assessment of the FWA service over mm-Wave domain can be done by performing EMF measurements by solely focusing on the assigned mm-Wave 5G frequencies (and not lower ones).
From a carrier management perspective, Fastweb provides the FWA service by activating two contiguous mm-Wave carriers, each of them covering 100 [MHz] of bandwidth. The two carriers are then used in parallel to serve a CPE through the intra-band carrier aggregation functionality [28], which is also instrumental for the design of the measurement algorithm. In particular, rather than measuring the entire portion of mm-Wave spectrum altogether during the same scan, the EMF evaluation can be sequentially split over each mm-Wave carrier. Analyzing smaller portions of the spectrum is in fact beneficial for improving the quality of narrow-band measurements. In particular, the SAN sample points depend on the HW and are typically fixed in terms of maximum number. Intuitively, such points are closer in the frequency domain when the bandwidth to be analyzed is reduced. This is in turn beneficial for improving the precision of the channel power measurement over the mm-Wave spectrum. Therefore, our measurement algorithm is designed to perform sequential scans over the mm-Wave carriers used by Fastweb.

IV. MM-WAVE MEASUREMENT FRAMEWORK
We describe a novel framework for performing the exposure assessment from mm-Wave BSs. Our innovative contributions include: 1) the design of a traffic generation chain in order to generate and measure the large throughput available on the mm-Wave link; 2) the selection and tuning of the HW components (SAN, cables, antennas) for performing the exposure assessment over the mm-Wave channel; 3) the design of a completely softwarized algorithm to control the SAN and perform the EMF exposure assessment over multiple mm-Wave carriers; In the following, we cover in detail the following aspects: i) overview of measurement challenges and adopted solutions, ii) description of the traffic generation chain, iii) description of the EMF measurement chain in terms of selected HW components and tuning, iv) description of the softwarized measurement algorithm. Table 1 reports a summary of the main measurements challenges that we have experienced when developing our framework, as well as the high level description of the adopted solutions. In more detail, we face the following requirements: C1) Exposure assessment of the FWA service over 5G mm-Wave; therefore, we need to distinguish the exposure contribution of the mm-Wave service with respect to other ones, running on different frequencies and/or technologies; C2) EMF measurements of the exposure radiated by the mm-Wave BS in the DL direction; therefore, we need to isolate the DL contribution with respect to the UL one, which is generated by the CPE; C3) Exposure assessment over different levels of DL traffic, in order to investigate its impact on the EMF levels; C4) Traffic provisioning to (possibly) saturate the mm-Wave link under the maximum traffic conditions; C5) Iteration of the measurement over multiple intra-band contiguous mm-Wave carriers; C6) Implementation of an EMF measurement procedure that can be reproduced by the community in a mostly automatic way, and thus limiting the amount of manual configurations on the instruments; C7) Limitation of the amount of data that has to be stored in order to assess the mm-Wave exposure. To tackle challenges C1-C7, we adopt the following solutions: S1) Selection of HW and SW tools able to perform narrowband measurements, and hence monitoring the EMF contribution of 5G mm-Wave service in isolation with respect to the other ones (challenge C1); S2) Exploitation of a directive antenna (with a large front-to-back ratio), pointed towards the monitored mm-Wave BS; in this way, we can assess the mm-Wave exposure by measuring the entire time-frequency grid, without the need of evaluating the time-division duplexing (TDD) between UL and DL slots (challenge C2); S3) Exploitation of a traffic tool to synthesize and monitor the amount of traffic that is generated in the DL direction (challenge C3); S4) Installation of software agents (server and client) over dedicated machines, running the traffic tool and able to exchange huge amount of data (challenge C4); S5) Design of a brand new EMF measurement algorithm, which is run on SW and allows iterating over the different mm-Wave carriers. The high-level description of the algorithm is provided in this work, while the source code will be released upon acceptance of the paper (challenges C5-C6); S6) Evaluation of the exposure from channel power measurement done over each carrier, rather than iterating over each frequency sample, in order to reduce the amount of stored information (challenge C7). In the following sections, we provide the implementation detail of S1-S6. Fig. 1 reports a scheme of the traffic generation chain, which implements a DL traffic flow from a server agent to a client one. The server is located in the Campus network of Uniroma2 University, while the client is connected to the CPE through a Gigabit Ethernet (GE) link. Our goal is to guarantee throughput values able to (potentially) saturate the radio resources on the mm-Wave wireless link between the BS and the CPE under the maximum DL traffic conditions. In this way, we can evaluate the maximum exposure from the BS over the considered location. This condition requires that the mm-Wave link becomes the capacity bottleneck on the end-to-end path of Fig. 1. On the contrary, when the bottleneck lies on the server and/or on other network segments (e.g., the link between the server and the large Internet), the EMF evaluation is not done at the highest possible rate on the mm-Wave link, thus resulting in (possibly) lower exposure levels than the maximum one.

B. TRAFFIC GENERATION CHAIN 1) OVERVIEW AND RATIONALE
In our work, we adopt a set of solutions to maximize the probability that the capacity bottleneck is located on the mm-Wave link. More in depth, we proceed as follows: i) we install client and server agents on dedicated machines (not running other programs and not shared by other users), whose configurations are reported in Table 2, ii) we physically deploy the server close to the University backbone, which in turns provides connectivity to the large Internet (as shown in Fig. 2); iii) we configure the interface adapter of both the server and the backbone switch to run the GE protocol on the shared link, iv) we run our experiments during periods of time not falling into busy traffic hours on the University network (e.g., avoiding to overlap the generation of mm-Wave traffic with other capacity-hungry activities, like the cloud backup of the online lessons). 1 By ensuring i)-iv), we minimize the probability that the resources under our control suffer link and/or node congestion -a condition that can potentially move the capacity bottleneck away from the mm-Wave link. Clearly, we can not control all the other segments on the server-to-client path of Fig. 1 -like the link(s) between the Internet and the Fastweb network. However, we assume that the over-provisioning of those network resources is sufficiently large to avoid potential congestion issues. In any case, we point out that our framework is able to measure exposure and traffic even when the bottleneck is not located on the mm-Wave link. 2

2) TRAFFIC GENERATION: TOOL AND SETTINGS
Focusing on the SW agents, we exploit the iperf tool, which allows generating synthetic traffic between a server and a client with a large customization of both traffic and transport layer parameters. Although several iperf servers are publicly available worldwide, in this work we install a dedicated iperf agent on the server under our control (i.e., the "Uniroma2" server shown in Fig. 1), due to the following reasons: i) many public servers do not allow running parallel iperf transfers, thus impacting the availability of the servers when the transfers are simultaneously requested 1. We refer the interested reader to Appendix B for a detailed explanation, based on measured data, about the impact of our experiments on the traffic flowing on the Campus network.
2. Obviously, in this case, the collected exposure and traffic samples will be not the maximum ones. by multiple users across the world, ii) preliminary data transfer tests launched from the University 10 [Gbps] network revealed that different iperf servers did not meet the large throughput (hundreds of Mbps) that is required by our experiments (likely due to server congestion and/or network congestion on the path towards the server and/or traffic shaping policies implemented in the institutional network of the server). Table 3 reports the iperf settings for our traffic evaluation. In more detail, the parameters in the table are coded in a custom Bash script, which is run on the client and allows: i) activating the iperf transfer from the server, and ii) measuring and recording the timestamps of traffic samples. The output of the script is a timestamp-plus-measured DL rate, which is stored on an output file for further analysis. Focusing on the iperf parameters detailed in Table 3, the server interface is assigned to a public Internet Protocol (IP) address of the University (not disclosed in the table for security reasons). We then set the iperf agent to listen on port 80. In this way, the University firewall does not filter the incoming/outgoing traffic between the iperf server and a terminal outside the University network, as this configuration is equivalent to a classical Web service, which is allowed by the firewall rules. We then consider an interval pause of 1 [s] for reporting the average DL throughput. In this way, iperf outputs the DL throughput samples at a low (yet meaningful) pace. Eventually, the number of parallel transferring threads is set to one, in order to avoid capacity contention issues among iperf threads.
An important setting of Table 3 is the selection of the underlying transport layer protocol. Although different previous works exploit User Datagram Protocol (UDP) (see, e.g., [17]), we instead select Transmission Control Procotol (TCP), due to different reasons. First of all, TCP is being used by common applications [29], as this protocol provides strong end-to-end reliability guarantees, e.g., in-order delivery of application data, through different mechanisms, which include segment acknowledgments, retransmissions, flow control and congestion control [30]. Moreover, UDP-based applications typically implement many TCP-like features at the application level to provide similar guarantees [31]. Second, TCP is able to automatically adjust the throughput in case of capacity contention on the bottleneck link [32]. This event is likely to be experienced on the mm-Wave link, since we focus on a commercial 5G BS serving a set of real FWA users, whose capacity requirements compete with the data transfer that is injected towards our iperf client. Therefore, TCP is able to continuously monitor the throughput level -by eventually scaling it when needed. Consequently, we need to monitor the instantaneous amount of traffic that is delivered to the iperf client, since its evolution over time is governed by BS radio scheduler and then in turns by the TCP congestion control algorithm.
In addition, TCP introduces other side effects, which have an impact on the design of the measurement algorithm. More in depth, TCP is initially slow in terms of rate, then it ramps up, as a consequence of the TCP window increase -a behaviour generally observed in all state-of-theart TCP implementations (like TCP Cubic [33]). This issue has therefore to be carefully taken under consideration in our measurement algorithm, as, obviously, TCP does not immediately saturate the mm-Wave link capacity.
Eventually, after the initial window increase, TCP "probes" for the bandwidth. In particular, the size of inflight TCP segments is continuously adjusted. For example, the window size is abruptly reduced as a consequence of TCP timeouts and/or multiple TCP ACK duplicates [32]. The variation of the TCP window has a strong impact on the throughput levels, as obviously, the larger is the window size, the higher is the achieved throughput level (i.e., more segments traveling on the pipe). Consequently, the experienced TCP throughput strongly varies over time. This issue introduces a second aspect: the importance of correlating the EMF samples with the traffic ones, by exploiting a synchronized time reference.
Finally, the remaining settings in Table 3 include: i) the maximum target speed, which is left unbounded on purpose (in order to allow TCP probing for the bandwidth and reaching the maximum value), ii) the duration of a single test, set to 180 [s] -an amount of time that is appropriate in our case to skip the initial TCP transient and sequentially measure the EMF over the two mm-Wave carriers, and iii) the reverse option, which forces the DL traffic generation from the server to the client (while the default setting assumes traffic generation on the client-to-server direction).

C. HW MEASUREMENT CHAIN AND SAN TUNING
The HW chain for performing our exposure assessment is composed of the following devices: i) portable SAN, able to cover the mm-Wave frequency range, ii) directional horn antenna, iii) wood tripod to hold the antenna, iv) coaxial cable to connect the horn antenna and the SAN, v) laptop to run the measurement algorithm, and vi) Ethernet cable to connect the laptop and the SAN.
More in depth, the SAN considered in this work is an Anritsu MS2090A portable analyzer, equipped with a frequency cut of 32 [GHz], 5G NR analysis module and GPS receiver. In addition, Table 4 details the features of the measurement antenna, which is characterized by a relatively high gain in the main direction and a not negligible beamwidth. It is worth noting that an horn antenna provides high level of isolation in the directions (like the rear one) not falling in the main beamwidth. In addition, the   Table 5 reports then the SAN configuration to perform the mm-Wave measurements. In more detail, the EMF measurement functionality is turned on. In this way, the instrument measures the received power, which is then converted to electric field by exploiting the Antenna Factor (AF) table of the horn antenna (which is loaded on the SAN). In addition, the measurement metric is the channel power (in V/m), meaning that the SAN automatically computes the exposure on the entire considered channel. Eventually, the auto attenuation setting is turned off, in order to avoid the wrong configuration described in Appendix C, which may result in a substantial over-estimation of the exposure. The integration bandwidth for computing the channel power is then set to the spectrum occupancy of a single carrier (i.e., 100 [MHz]). Eventually, we manually configure the SAN to perform a set of preliminary checks on the demodulated 5G signals, e.g., to verify that the 5G signals (like the SS-RSRP) are sufficiently strong in the measurement locations. This requires to set both Synchronization Signal Block (SSB) offset and numerology values (detailed in the table) to synchronize the SAN with the Fastweb signals over the two mm-Wave carriers. Finally, Resolution BandWidth (RBW), Video BandWidth (VBW) and scale/div ratio are automatically set by the SAN. Fig. 3 reports a high level overview of the considered software-defined measurement architecture. In more detail, we develop a new algorithm, called M-WAVE, running on the measurement laptop. The algorithm is coded as a MATLAB script. The SW distribution running the algorithm is the MATLAB R2017b with the Instrument Control Toolbox module. As shown in the figure, the algorithm is connected to the SAN through a MATLAB TCP-IP object, which allows reading/writing a buffer at the application layer over a TCP connection. In this way, a reliable channel is implemented at the transport layer, and therefore the command delivery from/to the SAN is always guaranteed -thus simplifying the tasks of M-WAVE. At a raw communication level, the MATLAB TCP-IP object communicates with a server agent installed on the SAN through a TCP socket and the VISA interface. Consequently, socket buffers are used to read/write application data from/to the TCP socket. Finally, the server agent on the SAN executes the remote commands on the HW (e.g., reading the channel power, and/or setting the center frequency, etc.) through the routines implemented in the Operating System (OS) of the instrument. In this way, the measurement algorithm can directly interact with the SAN through the TCP-IP object. However, it is important to consider the underlying communication channels/buffers, as those elements typically influence the delay in implementing the remote SAN commands from the algorithm as well as the buffer refresh rate at the application level.

D. EMF MEASUREMENT ALGORITHM 1) OVERVIEW
More concretely, M-WAVE is able to program the SAN by writing/reading commands that are coded with the Standard Commands for Programmable Instruments (SCPI) language. Intuitively, each SCPI command is represented by a set of human readable characters (when the ASCII option is activated), typically enclosed into a single string. We refer the interested reader to [34] for an overview of the SCPI commands that are available for the selected equipment.

2) IMPLEMENTATION
Algorithm 1 reports a high-level pseudo-code of the measurement algorithm. More in depth, M-WAVE requires a set of input parameters, whose setting is detailed in Table 6. M-WAVE then returns as output: i) the SAN identification label, ii) the SAN GPS positioning, iii) the matrix of measured EMF values (one row per frequency, one column per EMF sample), iv) the matrix of measured timestamps (again one row per frequency, one column per EMF sample).
Initially, M-WAVE creates the TCP-IP object and consequently the connection with the SAN is established (line 2). The SAN identification number and the GPS positioning are then retrieved (lines 3-4). In the following, the relevant parameters for running the measurements are implemented on the SAN through the Initialize function (line 5). Intuitively, the parameters are passed to the SAN one by one, by ensuring a delay (stored in the variable cmd_sleep) between the sending of one parameter and the following one, in order to take into account the delay of all buffers in the chain. M-WAVE algorithm then iterates over the set of mm-Wave frequency carriers to be monitored (lines 7-16). For each monitored carrier, the frequency range is set (line 8) and the continuous sweeping is activated (line 9). A pause interval, stored in the variable cmd_sleep_rav, is then enforced (line 10), in order to allow the initial computation of the channel power. In the following, the algorithm measures the timestamp-plus-EMF samples (lines [12][13][14]. In more detail, the EMF is retrieved from the SAN through a channel power query (of electric field) (line 12), while the timestamp is instead obtained from an OS callback (line 13). In particular, in order to guarantee the same time reference between the laptop running M-WAVE and the other one used to force the traffic, we run the synchronization utility to the same network time server on the two devices -before running our algorithm. Eventually, M-WAVE ensures a pause interval between consecutive channel measurements (line 14), whose value is stored in the inter_sample_time variable. The procedure ends when all the channel power samples for each considered frequency are measured. At last, M-WAVE closes FreqSetting(obj, cmd_sleep, f START ,f STOP ); //Frequency range setting 9: EnableContSweep(obj, cmd_sleep); //Activate the continuous sweeping 10: Pause(cmd_sleep_rav); //Initial pause to measure the channel power 11: for i = 1;i ≤ number_samples_chp, i + + do //Iteration over the number of samples to be acquired 12: measured_emf_matrix(f ,i)=ChpFetch(obj); //Fetching of the channel power from the SAN 13: time_matrix(f ,i)=DateTime(); //Fetching of the current time from the laptop OS 14: pause(inter_sample_time); //Temporal pause between one sample and the following one 15: end for 16

3) INPUT PARAMETERS
In the following, we provide more insights about the setting of the measurement parameters reported in Table 6. Both size and timeout of the TCP-IP buffer are tuned by considering the impairments introduced by the socket buffer and the SAN agent implementation of the commands. In more detail, we set a buffer size equal to 6000 [bytes] to (potentially) store multiple SCPI commands, each of them occupying dozens/hundreds of bytes. In addition, we select a buffer timeout value of 200 [ms] to introduce an upper bound on the total Round Trip Time (RTT) that is experienced on the end-to-end M-WAVE-SAN communication path. The cmd_sleep is then used to set the delay of 100 [ms] between two consecutive operations on the buffer. The table then reports the number of channel power samples that we consider for each frequency (equal to 120), as well as the delay between two consecutive channel power samples (set to 500 [ms]). In this way, a EMF measurement over a single frequency is run over a time of around 120×500 [ms]= 60 [s]. Clearly, this time can be highly customized, depending on the measurement goals. In our case, we set it to a relatively small value, as we are interested in observing the exposure over intervals lower than the total data transfer time (set to 180 [s]), due to the fact that multiple carriers have to be sequentially evaluated.
Focusing on the remaining parameters of Table 6, the measurement unit is set to electric field. In addition, the input attenuation is set to a low value (10 [dB]) and the power amplifier is turned on. In this way, we avoid the exposure over-estimation detailed in Appendix C. The trace detector is then set to Root Mean Square (RMS) (a common setting with other previous work, e.g., [13]). The channel power is then computed as a rolling average computed over the past 100 channel power measurements (it is worth noting that the SAN is able to measure the channel power with a low delay-equal to few ms per sweep). The format of the exchanged data between the algorithm and the SAN is then set to ASCII. Eventually, center frequencies and ranges match the Fastweb carrier assignment over the mm-Wave spectrum. Moreover, the cmd_sleep_rav setting allows imposing a large interval before extracting the first channel power sample from the SAN (and therefore ensuring convergence in the computation). Finally, the reference level, stored in the ref_level variable, is set to a large value (equal to 6 [V/m]), as the signal dynamicity is not known in advance.

4) COMPLEXITY
Focusing on the time complexity, M-WAVE requires to iterate over the set of mm-Wave frequency carriers F. For each frequency carrier, the algorithm then further iterates over the set of samples, whose size is stored in the number_samples_chp variable. Therefore, the total time complexity is in the order of

O(|F|×number_samples_chp).
Focusing on the space complexity, the algorithm mainly requires two matrices for the EMF-plus-timestamp values, each of them requiring |F|×number_samples_chp elements. Therefore, we can conclude that both time and space complexity are very limited, and in any case highly customizable (through the number_samples_chp variable), depending on the measurement goals.

V. MEASUREMENT SCENARIOS
We consider a roof-top 5G BS installation located in Guidonia, a medium-sized town in the neighborhood of Rome (Italy). As shown in Fig. 4(a), the site hosts multiple operators, with different poles hosting BS antennas and backhaul bridges. Focusing on the Fastweb operator, the mm-Wave service is provided through dedicated antennas realizing three distinct sectors, whose horizontal orientation is provided in Fig. 4(b). The figure also highlights the positioning of the measurement location, which is in LOS conditions, at a distance of around 90 [m] from the serving sector, and falling inside the main lobe of the antenna radiation pattern. 3 In this way, we consider a measurement point that can potentially receive a not-negligible amount of exposure from the mm-Wave sector. Table 7 then reports the main features and settings of the BS sector and CPE (kindly provided by the operator). Focusing on the BS equipment, the adopted frequencies/carriers (obviously) match the current assignment of Fastweb operator. In addition, the maximum antenna gain is consistently higher than pre-5G equipment, due to a better exploitation of beam directionality for managing the radiated power. Moreover, the sector is solely subject to a mechanical horizontal tilting (to realize the sector orientation), while all the other tilting values (both mechanical and electrical ones) are set to zero. Finally, the operator provided the antenna diagrams in terms of MSI file for both the azimuth and elevation domains. This last information is instrumental to numerically evaluate the exposure and compare it against the measured one.
Focusing then on the CPE features and settings, the antenna is placed on a self pole at an height of 1.38 [m] from ground level. The selection of the height is constrained by the positioning of the EMF measurement antenna, which we remind is placed at a height of 1.59 [m] above ground. In particular, in order to make sure to capture the power radiated towards the CPE by the mm-Wave BS, it is essential to place CPE and EMF antenna in close proximity to each other. Obviously, the CPE mechanical tilting is set in such a way to be oriented towards the serving sector. Eventually, Table 7 reports the CPE maximum output power, which is comparable to the maximum output power of handheld UE, e.g., a smartphone [28]. Finally, the table reports the peak 3. The point is just few degrees away from the main sector orientation. This angle is sufficiently low to consider the location inside the main lobe of the antenna radiation pattern. DL/UL throughput that is supported by the CPE (whose values have been retrieved by the operator from measurements in a controlled laboratory environment). Interestingly, the peak DL throughput is huge -almost close to one Gbps of capacity -, thus truly equivalent to a wired FTTH connection.

A. TESTS BREAKDOWN AND METRICS
We divide the tests performed in the measurement location in the following categories: i) assessment of baseline exposure without injected traffic, and ii) evaluation of exposure with injected traffic. Focusing on i), Fig. 5(a) reports the rear view of the EMF measurement chain. Obviously, the CPE is not installed in this case, as our goal is to measure the amount of exposure that the mm-Wave BS naturally radiates over the measurement location. In more detail, the portable SAN and the control laptop are placed on a desk, while the horn antenna is positioned in front of the desk and directly pointing towards the mm-Wave sector.
Focusing on ii), Fig. 5(b) and Fig. 5(c) show the rear and side views of the installed equipment, respectively. In this case, our aim is to evaluate the exposure when traffic is injected. Consequently, we add the CPE and the laptop running the client agent of the traffic generation chain. The CPE is placed in the rear of the horn antenna, at a distance of around 1 [m]. In this way, the horn antenna measures the radiation from the mm-Wave BS (and not from the CPE).
We then run the following tests: repeating the tests in T-B) after an interval of one hour. For each evaluation, we define a set of metrics that are instrumental for our analysis. Let us denote with E 5G-CAR (t, f ) the instantaneous 5G exposure over frequency carrier f at time slot t. 4 In addition, let us denote with T 5G-DL (t) the instantaneous DL throughput at time slot t. 5 In the following step, we introduce the instantaneous 5G EMF exposure E 5G (t), which is computed as the root sum square of the exposure over the carriers: The linear average 5G EMF exposure E 5G over the set of time slots is then expressed as: where T denotes the set of time slots during which exposure has been evaluated for the current test (e.g., after the initial TCP ramp-up transient).
Eq. (1) and Eq. (2) can be computed only when for each time slot t the exposure is simultaneously measured over the two carriers. Obviously, this is not possible in our case, as we need to sequentially measure the exposure over a given carrier before measuring the other one. To overcome this issue, we first compute the linear average exposure over each carrier, formally denoted as: 4. This metric is built from the measured_emf_matrix and time_matrix matrices that are produced as output by M-WAVE.
5. This information is retrieved from the output of the Bash script of the traffic generation chain. where T (f ) is the set of time slots during which exposure has been evaluated for carrier f in the current test.
Consequently, the average 5G EMF exposure E 5G over the carriers is computed as: In addition, we introduce the average 5G traffic T 5G-DL as: where T = f T (f ) is the union of the set of time slots during which the exposure evaluation has been performed for each carrier of the current test.

B. EXPOSURE ASSESSMENT 1) SPECTRUM ANALYSIS
We initially compare the spectrum occupancy for one test in T-A) and another one in T-B). Fig. 6 reports the screenshots from the SAN over the two mm-Wave carriers, with and without injected traffic. Several considerations hold by analyzing the figure. First, the mm-Wave signal of test T-A) is easily detectable in both carriers ( Fig. 6(a)-6(b)). Second, the positioning of the SSB burst carrying control information can not be easily identified by observing Fig. 6(a)-6(b). This is an important indicator, suggesting that the spectrum is used to provide data traffic to users (whose signal strength tends to overcome the relatively low power of the control signals). Third, the received power (in [dBm]) notably increases when traffic is injected (Fig. 6(c)-6(d)), for both carriers. This is again an important outcome, which demonstrates on one side the exploitation of the carrier aggregation functionality by the operator and on the other one the effectiveness of our chain in generating a large amount of traffic over both carriers. Fourth, the spectrum with traffic (Fig. 6(c)-6(d)) is flatter compared to the one without traffic (Fig. 6(a)-6(b)), thus further revealing that the BS has assigned radio resources spanning over each entire spectrum of the carrier to satisfy the large data transfer that is injected by our chain.

2) TEMPORAL VARIATION OF EXPOSURE AND TRAFFIC
We consider the variation of exposure and DL traffic vs. time, shown in Fig. 7. More in depth, Fig. 7(a) reports the instantaneous DL throughput T 5G-DL (t) for the tests in T-B) test ID (subfigures best viewed in colors).

FIGURE 8. DL Throughput and 5G mm-Wave EMF measurements vs. time for a given test.
and T-C). Interestingly, large T 5G-DL (t) values, higher than 800 [Mbps], are collected in different tests. However, the throughput exhibits strong variations in several tests, e.g., by alternating periods of high traffic with low traffic ones.
Obviously, this is an expected behavior, as we remind that TCP automatically tunes the segment window (and consequently the data rate) in accordance to the congestion level that is sensed on the server-to-client path. In particular, the observed variations of T 5G-DL (t) are (likely) due to other CPEs, serving commercial users, which compete on the amount of radio resources that are assigned to the CPE under our control. Further evidence of the presence of other FWA users during our experiments is discussed in Appendix D.
Eventually, the variations of T 5G-DL (t) do not exhibit any cyclic pattern over the different tests. Consequently, the importance of performing several tests when evaluating the exposure with injected traffic clearly emerges. We then move our attention to the instantaneous exposure per carrier E 5G-CAR (t, f ) in T-B) and T-C), shown in Fig. 7(b). Interestingly, the exposure is always very low, i.e., typically lower than 0.07 [V/m]. For each test, the exposure does not substantially change when passing from one carrier to another one (left to right of the figure). Again, this is an important message, suggesting that the injected traffic is (likely) equally split among the two carriers. Eventually, we can clearly note that the exposure of set T-B) tends to be higher than the one of T-C) (bottom to top of the figure). This is another important indicator, suggesting that the mm-Wave BS is (likely) implementing an active power control policy, able to tune the amount of radiated power over the CPE, by also considering the other ones that are deployed over the territory, and whose traffic requirements generally vary over time.
To give more insight, Fig. 8 shows E 5G-CAR (t, f ) and T 5G-DL (t) for a given test. The figure reports exposure and traffic units on the left and on the right, respectively. Interestingly, both traffic and exposure tend to follow similar trends. In particular, when the DL traffic is decreased, the exposure is reduced (see, e.g., the left part of the figure). On the contrary, when the traffic is increased, the exposure tends to rise. However, this effect has to be better analyzed, as discussed in the following section.

3) EXPOSURE VS. TRAFFIC ANALYSIS
We then face the core question of our work: What is the impact of DL traffic on the mm-Wave exposure? To answer this question, Fig. 9 reports the average exposure E 5G vs.  (in accordance to Table 7), and with an horizontal line the noise level (i.e., the total exposure that is measured over the two carriers in a shielded room without any mobile signal on the mm-Wave carriers). Each test is then represented with a point in the figure. In particular, the positioning of the point is determined by the values of E 5G and T 5G-DL measured during the test. Moreover, the error bars represent the 95% confidence intervals for both exposure and traffic  of the considered test. The set of points in (T-A,T-B) and in (T-A,T-C) is then fitted in MATLAB software through a double exponential fitting in the form of p 1 · x 2 + p 2 · x + p 3 , whose coefficients are reported in Table 8. To this aim, Fig. 9 reports with continuous lines the fitted models, while with dashed lines the prediction bounds (computed with 95% of confidence levels). Several considerations hold by observing Fig. 9. First, the figure reveals that the mm-Wave exposure greatly scales with the amount of injected traffic. In particular, when no DL traffic is generated, the exposure measured from the mm-Wave BS is almost negligible (i.e., slightly higher than the minimum noise level). On the contrary, when traffic is injected, the exposure tends to increase, reaching the highest values when the traffic is close to maximum. Second, the points in T-C) are subject to a lower exposure compared to the ones in T-B), (possibly) due to an active power control policy implemented by the BS -an aspect already emerged when analyzing the single carrier exposure. Third, the exposure confidence intervals are always very low -typically smaller in size compared to the throughput ones. Fourth, the double exponential is a good fitting of the points in T-B and in T-C. This outcome is also important, as the definition of fitting models capturing the exposure-traffic relationship may pave the way to innovative measurement campaigns, based on the idea of collecting throughput data from the CPE and then estimate the exposure from such information. Fifth, the total mm-Wave exposure is always very low, typically lower than 0.08 [V/m], even when the amount of DL traffic is huge, i.e., higher than 800 [Mbps].
To better substantiate the exposure-traffic dependence, Table 9 reports the correlation coefficients and p-values computed for the following set of metrics: i) instantaneous carrier exposure E 5G-CAR (t, f ) vs. instantaneous traffic T 5G-DL (t), and ii) average total exposure E 5G vs. average traffic T 5G-DL .
For i) and ii), we consider the tests in T-B and T-C. In both cases, a positive correlation and a low p-value are observed, thus confirming that mm-Wave exposure is strongly proportional to the amount of DL traffic. In addition, the correlation of the average metrics of i) is larger than the instantaneous ones of ii), thus suggesting that the average traffic is a better proxy of the exposure than the instantaneous one.

4) MEASURED EXPOSURE VS. NUMERICAL SIMULATION
In the following step, we compare the values of measured exposure against the numerical ones obtained by simulation. In more detail, the operator has made available the power counters for each carrier of the considered sector, which include: i) the average radiated power computed over periods of 60 [min], and i) the maximum radiated power over the same periods. Given this information (detailed in Appendix D), we compute the simulated electric field over the location, by adopting the procedure reported in Appendix E. We refer the interested reader to the Appendix for further details, while here we provide the main intuitions.
In brief, we proceed as follows: i) we compute the numerical value of received power for each carrier, by applying either the Friis model with free space propagation loss [35] or a link budget computation based on the 3rd Generation Partnership Project (3GPP) Rural Macro (RMa) model [36], ii) we divide the received power by the effective area of the measurement antenna, in order to compute the power density, iii) we extract the electric field per carrier from the power density (by assuming far-field conditions), iv) we compute the total mm-Wave electric field by applying the root sum square on iii). Several considerations hold by analyzing the figure. First, the numerical exposure extracted from the maximum power is higher than the one computed from the average power (as expected). Second, the outcomes of Friis model and the ones obtained from the 3GPP RMa model are mostly overlapping in terms of exposure. This result confirms that the measurement location is in very good channel conditions, with a path loss almost equivalent to a free-space propagation loss.
Interestingly, the measured EMF exposure is around one order of magnitude lower than the simulated one, even when

FIGURE 11. ECDF of the instantaneous DL Throughput (T-B) and T-C) tests.
traffic is injected. This outcome may be explained by the following reasons. First, the antenna radiation diagrams provided by the operator are derived from the envelope of traffic and control beams, thus largely over-estimating the actual gain that is experienced on the measurement location. This increase of gain may (partially) explain the high exposure level. Second, the antenna counters reveal that our traffic assessments have been done in parallel to other connections from commercial FWA users served by the same sector (details in Appendix D). Since the operator is recording the total power that is radiated to serve multiple connections, assuming that all BS power is radiated towards the measurement location leads again to a large over-estimation of exposure.

C. PERFORMANCE ASSESSMENT
In the final part of our work, we analyze the performance in terms of achieved throughput. To this aim, Fig. 11 reports the Empirical Cumulative Distribution Function (ECDF) of the instantaneous DL throughput T 5G-DL (t), collected during the tests in T-B) and T-C). Interestingly, we can note that more than 20% of the samples achieve huge throughput values (larger than 800 [Mbps]). This outcome further demonstrates the effectiveness of the mm-Wave channel for providing the broadband service. However, the majority of the samples lies in the zone with lower throughput values (i.e., between 300 and 800 [Mbps]). In addition, a subset of samples (around 20% for T-C) experience throughput values lower than 300 [Mbps]. We believe that such throughput variations are inherently an effect of the channel sharing between the considered CPE and other users in the same coverage region of the sector. Therefore, although large throughput values are achievable, the capacity provided by the mm-Wave BS naturally varies over time -one of the main differences compared a fiber link. Consequently, the importance of adopting a reliable transfer protocol, able to tune the data rate based on the available bandwidth, clearly emerges.

VII. SUMMARY AND FUTURE WORK
We tackle the problem of assessing the EMF exposure in a commercial mm-Wave deployment providing the FWA service. Since the exposure from the mm-Wave BS is influenced by the amount of traffic transferred towards the CPE, we design a traffic generation chain to precisely control and monitor the amount of DL throughput on the mm-Wave link. Moreover, we adopt a set of measurement tools to evaluate the EMF exposure. Differently from other competing solutions, we design and evaluate a completely softwarized measurement algorithm, called M-WAVE, to sequentially scan the carriers and perform narrow-band measurement over the mm-Wave channel. Results, obtained from different sets of measurements taken in a LOS location, reveals that the EMF exposure from mm-Wave BS is mostly negligible when no traffic is injected towards the considered CPE. On the contrary, the exposure tends to increase proportionally with the amount of throughput that is realized on the mm-Wave link. However, the maximum exposure level is always lower than 0.08 [V/m], while the throughput is huge, i.e., higher than 800 [Mbps]. Further analysis shows that the measured exposure levels are at least one order of magnitude lower than the simulated ones, thus motivating the adoption of measurement-based approaches for the assessment of mm-Wave exposure. Finally, we demonstrate that very large throughput levels are achieved by 20% of measurements.
As future work, we plan to extend our work in multiple directions. First of all, the evaluation of the CPE exposure is a natural evolution. However, we need to keep in mind that outdoor CPEs (like to one used in this work) are normally placed in zones not easily accessible by users (e.g., roofs and balconies), and therefore the exposure assessment from such devices should be done at a large distance from the CPE (e.g., at the street level or inside the house, while keeping the CPE on the roof), in order to consider realistic settings. Second, the extension of our measurement algorithm to a mm-Wave mobile service is another avenue of research. Third, the exploitation of club-use policies on the same site allows a single operator using up to 1000 [Mhz] of mm-Wave bandwidth. The update of M-WAVE to monitor such very large portion of bandwidth (possibly performing a sequential scanning over a large set of carriers) is an interesting point. Fourth, we plan to compare the EMF assessment done with M-WAVE with a solution performing the real-time spectrum monitoring (which clearly increases the amount of samples that have to be stored in order to evaluate the exposure). Table 10 reports the list of acronyms used in our work.

APPENDIX B IMPACT OF MM-WAVE TRAFFIC GENERATION
In this Appendix, we provide further insights about the impact of traffic generation to meet the large capacity provided on the mm-Wave link. In more detail, we focus on the network traffic that is observed over the Campus network towards the Internet. Monitoring the utilization of the network resources in the University is in fact a key task, in order to avoid that our experiments have a negative impact on the Quality of Service (QoS) of other connections that share the same Campus infrastructure. To this aim, Fig. 12(a) reports the inbound and outbound total traffic on the link connecting the University to the large Internet, recorded during a typical working day. The traffic samples are collected by the GARR consortium, a non profit organization that provides connectivity to the Italian universities and research centers. The "input" label in the figure refers to the traffic flowing from the University to the GARR backbone, while the "output" label marks the opposite direction, i.e., from the GARR backbone to the University. The link capacity is equal to 10 Gbps, a value able to meet the typical traffic requirements of the University. Similarly, the University backbone links, connecting the main buildings of the Campus, provide the same capacity value.
Focusing in more detail on the traffic trends shown in Fig. 12(a), the "output" traffic (i.e., from the GARR network to the University) exhibits a typical day-night trend, thus matching the requests for services done by clients outside the University to servers inside the Campus domain. In addition, this trend is affected by DL traffic generated by servers over the Internet in reply to requests done by clients inside the University. Interestingly, the total traffic rarely exceeds the 1.5 [Gbps] value, and therefore the link utilization is very low (at most equal to 1.8 [Gbps]/10 [Gbps]=18%). Under this condition, the link is far from a congestion level and users experience very good QoS (in terms of delay and throughput).
On the contrary, the traffic in the opposite direction ("input" label) exhibits a completely different trend. In more detail, the cloud backup of the online lessons, done during night and early morning hours, has a huge impact on the link utilization, which is greater compared to the traffic experienced in the opposite direction. When the cloud backup is terminated, the traffic trend starts exhibiting a clear day-night periodicity: higher during late morning and early afternoon, lower during late afternoon and early night. During such interval, the measured traffic values are lower compared to the cloud backup hours. In more detail, the link utilization is at most equal to 24% during backup time, while only 6% during the central hours of the day.
The "input" trend is particularly relevant in this work, as the DL traffic generated by our experiments lies on this direction (i.e., from the University network to the GARR backbone). Having understood that the generation of our traffic may introduce a not negligible throughput in the "input" direction, we have explicitly avoided to run our experiments during cloud backup hours, which have a huge impact on the link utilization. Therefore, we started running our experiments after the termination of the cloud backup activities. To this aim, Fig. 12(b) reports the traffic measured on the same link during the day of our experiments. As expected, the traffic generated in DL direction during the tests is visible in the figure, as two separate spikes (corresponding to the T-B and T-C tests) clearly emerge on the "input" area. On the contrary, the mm-Wave traffic does not substantially  affect the "output" trend. This outcome is expected, as the traffic in the opposite direction (UL in our experiments) is mainly made up of "light" TCP acknowledgments (which can cumulatively confirm multiple DL segments), (almost) not carrying any payload data. Overall, these results prove that the generation of the mm-Wave traffic is a feasible task for the Campus network, thus avoiding any QoS issue to the other users/services of University.

APPENDIX C IMPACT OF SAN SETTINGS
The goal of this section is to discuss the impact of SAN settings on the EMF measurements, with a focus on the configurations that can easily lead to an incorrect evaluation of exposure. In more detail, we preliminary perform our tests in a LOS location close to the mm-Wave BS and shown in Fig. 13. We then run M-WAVE with the following SAN configurations: C-1) pre-amplifier turned off and auto attenuation coupling enabled; C-2) pre-amplifier turned on, auto attenuation coupling disabled, attenuation set to 10 [dB].
The rest of the settings are the ones reported in Table 5 and  Table 6.
Fig. 14 reports the total field E 5G (t) vs. time t. Interestingly, when configuration C-1) is enforced, the SAN automatically sets a huge attenuation of 50 [dB], (likely) due to the large variation in the expected signal range. On the contrary, when C-2) is applied, the attenuation that is set is consistently lower, being equal to only 10 [dB]. The different attenuation settings results in a strong impact on the measured EMF levels, as clearly shown in the figure. In more detail, C-1) leads to a huge exposure over-estimation, being the measured values consistently larger than 5 [V/m]. On the other hand, the EMF measured with C-2) drops to less than 0.02 [V/m]. Therefore, a natural question is: Why is there such a huge difference between C-1) and C-2)? The answer is that the high attenuation of C-1) leads, in fact, to a large uncertainty level in the measurement. Intuitively, the measured field is first attenuated, and then, in a postprocessing step, converted back to the de-attenuated value. This step is particularly critical when the "true" EMF level is already very low, as it normally happens with mm-Wave signals, due to precision errors that can easily arise before and after the applied attenuation. On the other hand, C-2) appears to be a wise choice, since the mm-Wave signal is normally very low (hence it is meaningful to activate the pre-amplifier), while the signal attenuation can be kept to low value, in order to deal with (possible) peaks induced by traffic signals. Consequently, in our measurement evaluation we decided to adopt setting C-2, in order to prevent the over-estimation exposure issues.

APPENDIX D MM-WAVE OUTPUT POWER AND NUMBER OF USERS
In this part, we shed light on power and user counters made available by the operator through the management monitoring tool of the considered mm-Wave 5G sector. In more detail, we consider the following metrics: • average output power vs. time; • maximum output power vs. time; • average number of users vs. time; • maximum number of users vs. time. The previous metrics are available for each carrier of the sector under investigation, with a time granularity equal to one hour. In addition, the maximum number of users is computed by adding both active and inactive CPEs, i.e., terminals that are associated with the sector but idle in terms of traffic data. On the contrary, the average number of users is computed from the CPEs that actively exchange traffic data during the measurement window. Moreover, the CPEto-carrier association is governed by a round robin scheduler. Obviously, a CPE that is associated to a given mm-Wave carrier can always exploit the carrier aggregation over the whole set of carriers licensed to the operator. Fig. 15(a) reports the trend of the output power for the day that included our tests. Interestingly, the maximum transmission power does not substantially change during our experiments with respect to other periods of time. On the contrary, an increase of average power is observed -however lower than 3 [dB] -during the tests window. Therefore, we can conclude that the impact of the conducted experiments on the sector output power is rather limited. Fig. 15(b) reports instead average and maximum number of users vs. time. Interestingly, both maximum and average trends are overlapping for the 27.25 [GHz] frequency, meaning that two CPEs are associated on such carrier and they are actively used for data transfer by FWA users. Similarly, the maximum and average curve are overlapping also for the 27.15 [GHz] frequency until our tests takes place, suggesting that also this carrier is exploited by other FWA users. However, a different behavior is observed when our CPE is activated. In particular, the device is first initialized, and then actively used to exchange traffic only when the T-B) tests are run. Interestingly, the figure perfectly follows such steps, as the maximum is higher than the average as soon as the CPE is associated with the sector (without exchanging traffic). Then, when the CPE starts transfering data, the average number of users becomes equal to the maximum one (as expected). Overall, Fig. 15(b) demonstrates that a total of 6 different CPEs are served by the sector under investigation during our traffic experiments.

APPENDIX E NUMERICAL EVALUATION OF EXPOSURE
We describe hereafter the steps to extract the simulated exposure over the considered location. In particular, we first compute the power P RX that is received in the considered location from the output power of Fig. 15(a). More formally, we adopt two distinct models for computing P RX , namely i) the Friis model [35], based on the free space propagation loss, and ii) the 3GPP RMa model [36], based on a more sophisticated path loss computation.
More in depth, the received power with the Friis model is expressed as: where P TX and G TX are the output power and the antenna gain of the considered sector (respectively), G RX is the gain of the receiver antenna, L TX are the transmitted losses, λ is the considered wavelength, d m is the transmitter-to-receiver 3D distance. Table 11 reports an overview of the parameter settings, which are done in accordance to the scenario considered in this work. Obviously, λ = c/f , where c is the propagation speed, and f is the mm-Wave carrier frequency. Moreover, the value of L TX is directly read on the antenna diagrams of the mm-Wave panel (made available by the operator), by considering the orientation angles of the location w.r.t. the sector panel.
Focusing on the 3GPP RMa model, we preliminary compute the break-even distance d BR m between LOS and Non-Line of Sight (NLOS) regime as: where h TX m is the height above ground of the mm-Wave antenna panel and h RX m is the height at which we install the EMF measurement antenna.
With our settings (detailed in Fig. 11), the break-even distance from LOS to NLOS regime turns out to be very huge, i.e., larger than 10 [km]. Consequently, we apply the LOS regime to compute the path loss PL, which is formally expressed as: The received power with the 3GPP RMa model is then expressed as: where SF denotes the shadow fading, which is computed by adhering to the 3GPP guidelines [36]. In more detail, the dB values of SF [dB] are extracted from a Gaussian distribution with SF STD = 4 [dB] (as in [36] -holding for the LOS regime). Therefore, the linear values of SF follow a lognormal distribution.
Given the values of P RX across the two models, we compute the power density ρ as: where A RX is the effective area of the received antenna, formally expressed as: In the next step, we assume to operate in the far-field condition to compute the electric field: where Z = 377 [ ] is the free-space wave impedance. Finally, it is worth noting that in our scenario we consider a set of 1000 extractions from the Gaussian distribution of Eq. (10). For each sample, we then compute the corresponding P RX value. Finally, we take the average over the 1000 samples of received power when computing the power density of Eq. (11).
LUCA CHIARAVIGLIO (Senior Member, IEEE) received the Ph.D. degree in telecommunication and electronics engineering from the Politecnico di Torino, Italy. He is currently an Associate Professor with the University of Rome "Tor Vergata", Italy. He has coauthored more than 150 articles published in international journals, books, and conferences. His current research topics cover 5G networks, optimization applied to telecommunication networks, electromagnetic fields, and health risks assessment of 5G communications. He received the Best Paper Award at the IEEE Vehicular Technology Conference (VTC)-Spring 2020 and the IEEE VTC-Spring 2016 and the Conference on Innovation in Clouds, Internet, and Networks 2018, all of them appearing as the first author. Some of his papers are listed as the Best Readings on Green Communications by the IEEE. Moreover, he has been recognized as an Author in the Top 1% Most Highly Cited Papers in the Information and Communication Technology field worldwide and top 2% world scientists according to the 2021 update of the science-wide author databases of standardized citation indicators.
CHIARA LODOVISI received the Ph.D. degree in engineering electronics from the University of Rome Tor Vergata, Italy. She is a Researcher with CNIT, Italy, and also with the University of Rome Tor Vergata. She worked for five years as an RF Engineer consultant for H3G mobile operator. For five years, she worked on optical communications, study, and implementation of submarine and satellite optical links and radio over fiber. Her research topics concern 5G networks, health risk assessment of 5G communications, interoperability over fiber between TETRA/LTE systems, and 5G networks.