Measuring 5G Electric Fields Strength With Software Defined Radios

The effect of electromagnetic radiation on public health is a recurring topic in the societal and political discourse, peaking with the introduction of every new generation of cellular technology. With the introduction of 5G, promising high peak download speeds as well as high-power beams, there is a need to revisit traditional measurement approaches. ICNIRP, a.k.a the International Committee on Non-Ionising Radiation Protection, offers a useful guideline to evaluate the electromagnetic field exposure of living tissues and provides some limits to keep exposure well below the threshold where it is considered harmful. However, modern packet radio technologies such as 5G or Wi-Fi are different from old broadcasting technologies. They deliver high power in very short bursts, spread over a wide band, thus increasing the difficulty of measuring electric fields with traditional instruments, such as spectrum analyzers. In addition, 5G promises a high spatial focusing performance, which means that the field can vary significantly even in a small area. Hence, measurements with a higher spatial density than we can achieve with expensive and bulky spectrum analyzers are urgently needed. Software-defined radios (SDRs), as a size- and cost-efficient alternative, can be used to capture signals in the time domain and thus increase measurement accuracy. However, software-defined radios are not designed to be used as RF power meters. They require accurate calibration and data analysis to ensure the measured power is correct. The aim of this work is to provide a general framework to calibrate SDRs, enabling them to measure RF power and extract the corresponding electric field value. Subsequently, the influence of the SDR parameters on the accuracy of the electric field measurement is investigated. To assess the performance of the proposed calibration framework in a real-life scenario, we rely on our private 5G network with a calibrated SDR to measure the RF power from a 5G network. Our measurements show that the average electric field exposure of 5G networks is well below 1 V/m.

effects caused by the non-ionizing radiation [4], [5], [6]. Reports on the biological effect of electromagnetic waves on the human body agreed that high-frequency fields are absorbed in the skin surface; therefore, only a small portion of energy can be penetrated to the underlying tissue [7], [8]. The International Commission on Non-Ionising Radiation Protection (ICNIRP) [9] produces a series of guidelines about the maximum power level in different bands that radio sources can emit [10]. To assess the maximum power a radio source can emit, the ICNIRP considers the specific absorption rate (SAR) [9], which is a measurement unit that determines the energy absorption in tissues due to high-frequency electromagnetic fields for a given mass. The electromagnetic field pollution, known as Electrosmog, provides an estimation of the electric field in a certain area with the aim of assessing the possible harm due to electromagnetic signals [11].
Probes used for electrosmog measurements can be categorized into two groups based on the distance of the radiating source from the probe's antenna: near-field probes and farfield probes. Near-field probes are generally implemented with small loops of wire or short monopoles [12], and are used for electromagnetic compatibility (EMC) compliance testing of electronic circuits and systems. Far-field probes are either triaxial probes, or simple antennas [13]. In the farfield measurements, the incoming electromagnetic wave can be considered a planar wave, and the received power in a pure line of sight (LOS) setting, such as an anechoic chamber, can be estimated using the Friis transmission equation [14]. Conventionally, a far-field probe needs to be connected to a Spectrum Analyser. The root mean square (RMS) of the electric field is derived from the harmonic with the highest power. The assumption behind this is that the carrier frequency of a narrow-band modulated signal holds most of the power. However, this method does not provide accurate electric field measurements with modern digital signals adopted in 5G, LTE, or Wi-Fi.
The main characteristics that make the spectrum-analyzerbased method inaccurate are the varying transmit power, duty cycle signals, and the wideband signals used in modern LTE and 5G communications [15]. Spectrum analyzers work in the frequency domain: they repeatedly calculate the FFT on a slice of spectrum with a narrow filtering window. The tighter the window, the higher the frequency resolution of the spectrum analyzer, the more accurate the spectrum representation is. However, time and frequency resolutions are subject to the Heisenberg-Gabor limit [16], which says that increasing frequency resolution results in less time resolution and vice versa. Spectrum analyzers are optimized for a high frequency resolution making it virtually impossible to distinguish between two signals sharing the same band at different instants in time, which is the case for the uplink and downlink of 5G signals.
Furthermore, the directive beams used in 5G networks bring extra difficulties since the sensor needs to be in close proximity to the receiving device [17].
software-defined radios (SDRs) work in the time domain and thus have the potential to address the spectrum analyzer's limitations, offering electric field measurements with compact, portable, and relatively low-cost devices [18]. In particular, the low cost and the compact size of SDRs allow large-scale deployment over a vast geographic area for continuous monitoring. It is worth mentioning that real-time spectrum analyzers overcome the frequency limitation by being time-domain instruments, providing similar capabilities as SDRs, but their substantially high cost is still the limiting factor.
While SDRs offer solutions for a wide range of applications [19], [20], they are generally meant to decode received signals rather than measure power. They can receive different analog and digital signals using the same front-end that is not calibrated to measure voltage or power absolute values [21], [22]. In fact, SDRs' drivers typically provide either the raw sample values (e.g., 8-bit integers) or normalized sample values between -1 and 1. No indication about the voltage amplitude or the power of the signal being recorded [23], [24], [25] is generally given, focusing only on signal variations to decode information. Therefore, in order to use the SDR for actual power measurements, a thorough calibration process is required in order to link each value coming out of the analog to a digital converter (ADC) with an actual voltage value. In this paper, we propose a practical calibration framework, enabling SDRs to provide accurate electrosmog measurements for wireless networks, including the recent 5G networks, which are time division duplex (TDD)-based. In addition to the scientific impact, the proposed framework has a pivotal societal impact, offering the general public an affordable solution to conduct electrosmog measurements, which is expected to raise awareness about new technologies such as 5G networks.

A. RELATED WORKS
The use of SDRs in electromagnetic field (EMF) measurements has been explored in many recent studies. In [22] and in [21], the authors explored the use of an RTL-SDR as an RF power measurement instrument, highlighting the strengths and weaknesses of this specific device. The authors explain in detail how to characterize the RTL-SDR, especially in the nonlinear region close to the saturation point [21]. However, these studies focused on a very specific use case, lacking generalized calibration and measurement methods. In [26], the authors show how to use an SDR to measure electromagnetic radiations emitted by home appliances. The authors use a Hack-RF dongle, a custom-designed monopole antenna, and GNU Radio to make a sensor for frequencies in the 2.4GHz band. Another example is presented in [27], where the authors design, develop, and test an electric field strength measurement system for LTE using an Ettus USRP N310. Their system uses a hyperlog antenna from which they can gather the channel power from three different directions. The measurement setup is similar to what is described in this article, and it covers the specific case of LTE measurements.
Other important works highlighting the need for cheap and small E-field sensors are [28], [29], and [30]. In [28], the authors performed E-field strength measurements in different locations by placing an RF probe on top of a car and driving around in the interested region. In the "Future Work" section of their paper, they clearly mention the need for future large-scale measurement campaigns to evaluate the radiation emitted by 5G base stations. This work would be greatly simplified by deploying a large-scale network such as Electrosense [31] rather than driving around extensive geographic regions. Similar reasoning could be applied to [29], where the authors monitored the EMF radiation from four base stations in the city of Bern, Switzerland, and to [30], which performed a comparison of indoor versus outdoor exposure to non-ionizing radiation. Using SDR-based sensors would allow this type of research to perform longer measurement campaigns over a wider area than what is currently possible.

B. CONTRIBUTION AND STRUCTURE
In this article, we aim to generalize the methods and algorithms found in the scientific literature and to develop a common framework for calibration and deployment of SDRsbased electric field strength sensors. Finally, the calibrated sensors are used to evaluate the field strength from our private 5G base station.
The main contributions of this paper are highlighted in the following points: • Derive the power model of the electromagnetic field analytically, facilitating the estimation of the exposure to non-ionizing radiation. Our model links the classical electric field strength equation to the power calculated from I/Q samples. • Introduce a calibration framework for low-cost SDRs, enabling accurate Electrosmog measurements. The calibration framework allows us to obtain accurate power measurements and comparable results from different SDRs. Moreover, the code implementing the calibration is free and open-source and can be downloaded from our public repository. • Perform a comprehensive measurement campaign, benchmarking our proposed framework in 5G frequency bands. Thanks to the "time-domain nature" of SDR, it is possible to accurately measure the power of complex signals such as those used for 5G without the need for expensive dedicated equipment. The measurements-based results presented in this article demonstrate that using a low-cost SDR, one can achieve an EMF measurement with similar accuracy to that obtained using high-end equipment, such as the measurements conducted in [29]. In particular, our 5G results show that while the peak electric field can reach values up to 40 V/m for the UE and 2 V/m for the base station, the average electric field exposure is well below 1 V/m. The rest of this paper is structured as follows: Section II derives the power model for electric field strength from the received signal power using the properties of the Poyting vector. Section III presents our sensor implementation details using different SDRs and introduces our novel calibration framework. Section IV presents our experimental results, proving that low-cost SDRs can be used as electric field sensors and discusses their strengths and weaknesses. Finally, we conclude our work in Section V and suggest possible future research directions.

II. POWER MODEL
This section provides a power calculation model for the electric field strength from the received power and introduces the assumptions that need to be taken into account.

A. ELECTRIC FIELD STRENGTH
Electric field measurements are important in the context of Electrosmog and non-ionizing radiation protection as per ICNIRP guidelines [9]. Reliable power measurement can also be used for other applications such as quantifying interference and noise power or for localization. Electric field strengths cannot be directly measured with a sensor, but their value can be derived from the power of the received signal. Received power and electric field strength are linked together by the Poynting vector. The electric field root mean square value (E RMS ) can be calculated from the incoming power density which is expressed by the Poynting Vector defined as: where − − → E(t) is the electric field vector and − − → H(t) is the magnetic field's vector. The Poynting vector, in (1), expresses the power flowing into a finite area. It is expressed in W/m 2 and it is a function of time. The Poynting Vector average over time is the average power flow over a finite surface, which can written as: where T is the period over which the waveform is averaged. For a periodic signal with T = 2π f , the average power is the same for all subsequent periods of the signal. If the signal is not periodic, T needs to be chosen empirically depending on the context in which the measurement is taken. For instance, for a radio packet such as Wi-Fi or LTE, a suitable T can be chosen to be the frame duration. In the case of non-ionizing radiation protection, T is chosen as the time to raise the temperature of a human's body by 1 • C. Note that (2) can also be expressed in terms of the electric and magnetic field as follows = |E| · |H|; where η is the wave impedance which is equal to While in the general form, η is a complex tensor, it can be approximated as 120π when the medium is without memory, losses are minimal, and the medium is homogeneous. This approximation is reasonable in free space propagation scenarios such as outdoor in an open field. It is worth noting that (4) holds true as long as the assumption of the Transverse Electro-Magnetic (T.E.M.) propagation mode is true. A T.E.M. wave is characterized by the fact that the electric field, magnetic field, and propagation direction are perpendicular to each other. This assumption is valid in free space but it does not necessarily hold true in wave cavities, where stationary waves occur or waveguides. Cavities and waveguides can be either intentional (e.g., a microwave oven or a coax cable) or unintentional (e.g., an alcove in a room or a corridor). Thus, the method we propose works better outdoor rather than indoors. Now, given (5), it is possible to calculate the power received at the antenna, P r , by multiplying the average Poynting Vector, S , by the effective area of the antenna, A e : The electric field strength can then be calculated as: From (7), it is evident that an accurate measurement of the electric field can be derived from an accurate measurement of the received power. The antenna effective aperture A e can be replaced in (7) according to the relation: where λ is the wavelength, and G a is the antenna gain, which is typically provided by antenna vendors in the data sheets of each antenna. However, it is important to take into account the specific test conditions under which the gain is measured by the vendor (also noted in the datasheet) and verify that they are not too far from the actual antenna deployment conditions. Conductive elements (i.e., metallic structures, water containers, people, etc.) or other deployment specifics such as the size of the room where the antenna is placed may affect the antenna gain considerably and thus must be carefully evaluated before starting a measurement. Since it is not physically possible to understand all the effects of the surrounding environment, it is necessary to account for a certain margin of error when collecting measurements.
In communication systems, the received power is calculated by averaging the squared RF signal amplitude, V in , over time and dividing the result by the characteristic impedance of the receiver circuit, Z in , which is typically 50 or 75 .
where T I is the integration time which is the time over which the power is calculated, and α is a coefficient that takes into account losses and gains of the electrical circuit and possible conversion factors of the digital signal processing after the ADC conversion. For example, a slightly mismatched line or a long cable causes a loss of energy from the system (e.g., a typical RG58 coax cable can lose between 0.14 dB and 0.5 dB per meter depending on the frequency) while amplifiers inject energy into the system (e.g., the Electrosense extension boards provide 13dB gain in the 1500 MHz -6000 MHz range), which must be subtracted from the final result.
The integration time influences the power measurement as follows: if the time is too small, the error on the measured power will be high, especially with packet radios, as the final power will depend on the probability of not capturing all the packets or empty slots; if the time is too long, the power calculation will just slow down without any appreciable benefit to the accuracy. One practical limitation of SDRs is that the buffer size needs to be a power of 2. The buffer size is the number of consecutive samples that the SDR can collect in a single measurement. Thus, the integration time (T I ) is constrained by the buffer size, and it can be computed as: where f s is the sampling frequency and N B is the buffer size. Accordingly, once an integration time is chosen, the minimum buffer size to hold enough samples can be calculated as: Some examples of desired integration times and corresponding buffer sizes are shown in Table 1. It is important to understand that the values in Table 1 are upper bounds for the integration time, but it is possible to perform integration on a smaller amount of samples discarding the rest of the buffer. This is the case when the number of samples covering the duration of a radio packet might not fit exactly into a power of 2. For example, a 5G OFDM symbol from our base station is 35.75μs; for f s = 20MHz, the number of samples required to cover a symbol is 714, but the minimum buffer size applicable to the SDRs is 1024 samples which correspond to 51.2μs.

B. POWER MEASUREMENTS WITH SDRS
To measure electric fields using SDRs, it is necessary to calculate the received power from the digital samples collected by our sensors. SDRs are digital systems that only provide signal samples, typically either between −1 and 1 or between 0 and 2 N b − 1, with N b the resolution in bits of the ADC (e.g., 8 for RTL-SDR, 12 for Pluto-SDR and USRPs). The relation between the amplitude of the quantized input voltage, V q and the digital sample value of V in (t) is: where V in (nT s ) is the value in Volts of each sample at a sampling period of T s with n as the sampling index, V q is the integer sample value at the output of the ADC represented by an integer value, e q is the quantization error and V is the conversion range in Volts of the ADC. For instance, if the voltage range of the analog front-end of the SDR is between −1V and 1V and the ADC provides 8bit samples, 1V will correspond to the value of 127 and −1V to the value -128. Some SDRs require the user to perform the conversion to Volts manually while others, such as the Pluto-SDR [23], provide this conversion within the software drivers. In general, the received power for an SDR is written as Now, let G a be the antenna gain, G be the SDR gain, and L c be the cable losses, as summarized in Fig. 1, one can define the power at the antenna as or equivalently in dB:

III. SYSTEM IMPLEMENTATION
In this section, we detail the hardware architecture and introduce our calibration framework.

A. SENSOR ARCHITECTURE
The sensor has four major components, consisting of an antenna, an SDR, an Embedded PC, and a software stack.
In the following, we detail each of these components.

1) ANTENNA
The sensing element is an important component as it is the interface between the electromagnetic wave and the electronic circuitry. The sensing element can be an EM probe, a small loop, a short monopole, or any other kind of antenna. From now on, we will refer to the sensing element as the antenna.
Many EMF sensors use so-called tri-axial probes [32] to eliminate the problem of unknown polarization of the transmitting antenna.

2) SOFTWARE DEFINED RADIO
An SDR is a radio device where a wide-band analog RF front-end is combined with a fast ADC and a digital signal processor. All the base-band signal processing is performed in software on the sampled signal, while the analog hardware is kept as simple as possible. The analog front-end is responsible only for amplification, frequency conversion, and some basic filtering. The SDRs we selected for our experimental campaign are the RTL-SDR, which is a low-cost SDR and widely used by radio amateurs and hobbyists, and the Pluto-SDR, which is a learning platform by Analog Devices and is used in many universities and research institutions, and the Ettus E312, which is a professional grade SDR.
• RTL-SDR: The RTL-SDR is a DVA-T/DVB-T receiver that can be easily re-purposed to act as a digital receiver bypassing the decoding stage. The chipset on the RTL-SDR consists of Rafael Micro R820T2 as RF tuner and the Realtek RTL2832U, which is a DVB-T OFDM demodulator that integrates a USB 2.0 interface. The receiver provides filtering, a programmable gain amplifier with fixed gain settings, and an 8-bit ADC. In order to extend the frequency range of the RTL-SDR, we developed a frequency extension board [19] which contains an upconverter for frequencies below 30MHz, a straight path for frequencies between 30MHz and 1500MHz, and a downconverter for frequencies above 1500MHz. • Pluto-SDR: The main components of the Pluto-SDR are the AD9361 mixed-signal RF analog front-end by Analog Devices and a Zynq 7000 SoC (FPGA+ARM core) for digital signal processing. The frequency range of the Pluto-SDR is from 325MHz to 3.8GHz, and the maximum bandwidth is 20MHz. However, the frequency range can be extended to 70MHz -6000MHz via software. • Ettus E312: The Ettus E312 is a high end SDR from National Instruments. This device uses the same analog front-end as the Pluto-SDR (AD9361), but in contrast with the Pluto-SDR, the Ettus E312 mounts bigger FPGAs (Zynq 7020). The Ettus E312 uses all of the four channels (two input and two output) of the AD9361 but the full frequency range, 70MHz to 6GHz, is enabled out of the box. The total bandwidth is extended to 56MHz. The Ettus E312 can run on a battery without a host computer and uses an SD card as writable mass storage [24].

3) EMBEDDED PC
The control computer is the platform where the software stack runs. The main purpose of the control computer is controlling the SDR, data storage interface, communication with other systems, and data visualization.

B. CALIBRATION FRAMEWORK
The goal of the calibration is to obtain a relation between the RMS value of the digital samples and the RMS Voltage of the received signal and to find an optimal calibration gain value, G cal , that minimizes the error in the power computation. To this end, the automatic gain control functionality, which is inherently available in SDRs, must be turned off to perform accurate power measurements. The source code of the calibration framework is open source and available on our public repository [33]. The SDR's analog front-end is ultimately just the circuitry that brings the input signal in the optimal range of the analog to digital converter. Fig. 2 illustrates the relation between output power, P out , and input power, P in and the three regions in which the curve can be divided. Let us denote G as the SDR gain and G cal as the targeted calibration gain. When the input power, P in level is below the sensitivity threshold of the device, we set G cal < G, compensating for the high out power value. Consequently, the amplifier efficiency is reduced and the signal covers only a few bits of the ADC range. In this situation, the quantization noise is prevalent over the signal, and the error on the received power is high. To overcome this, the gain settings need to be adapted to ensure the amplified signal is situated in the linear region, where we set G cal = G. If P in increases further, we end up in the saturation zone, where we choose G cal > G, compensating for the low out power value, as shown in Fig. 2. For example, the RTL-SDR accepts input power levels between -50 dBm and 0 dBm. However, its linear region lies between -45 dBm and -20 dBm for most frequencies.
It is worth noting that, before starting the calibration procedure, the SDR must be turned on for some time (typically 10-15 minutes), until it reaches a steady temperature as many of the analog components in the radio front end (mainly amplifiers, mixers and crystal oscillators) are temperature sensitive. Special care should be taken in selecting the coax FIGURE 2. Output power vs Input power: when the input power is lower than the sensitivity threshold or higher than the saturation threshold, the amplifier is less efficient and the signal only covers a few bits of the ADC, so the quantization noise is suffocating it. The optimal gain setting is the one that brings the signal power within the linear region. However, G cal can only compensate to a certain point. If the signal amplitude is too low or too high, changing G cal is not sufficient anymore. Thus, the measurement setup might need to include some external circuitry such as the Electrosense converter board [19].

Algorithm 1 Data Collection for the Calibration Procedure
1: Input: f start , f stop , P start , P stop , G start , G stop 2: Output: A list of (f c , G, P) Signal generator frequency ← f c 6: SDR ← f c 7: for P out ∈ [P start , P stop ], P out ← P out + P step do 8: Signal generator power ← P out 9: for G ∈ [G start , G stop ], G ← G + G step do 10: SDR ← G 11: P r ← SDR received power 12: P = P out − P r

13:
Result.append((f c , G, P)) 14: end for 15: end for 16: end for cables used for calibration and, where possible, cable losses should be taken into account in the final power calculation to determine the correct gain.
The data collection of the calibration framework is detailed in Algorithm 1. A signal generator is used to generate a sinusoidal signal with different frequencies and amplitudes. For each frequency and amplitude in the calibration set, the device under test is configured with all possible gain settings, ranging from G start to G stop . At each step, the calibration software calculates the power of the received signal, P r , according to (13) and converts it to dBm. The Algorithm scrolls over the frequency of both the SDR and the signal generator bounded by f start and f stop . Subsequently, it scrolls over the power, P out , of the signal generator and the gain, G of the SDR. For each frequency, power, and gain setting, we measure the SDR received power, and calculate P, which is the difference between the output of the signal generator, P out and the received power, P r . When all the possible combinations are tested, the result is searched for the optimal calibration gain, G cal .
In order to find the optimal calibration gain for each frequency, the results from the data collection procedure are arranged into couples, ( P, G), where G is the gain setting of the SDR. The optimal gain is the value associated with the smallest P. This is performed for every P out value resulting in a list of gains.
The gain will be ideally the same for all the amplitude values in the middle of the linear region. For values below the sensitivity threshold, the gain will be lower than the gain in the middle. For values above the saturation threshold, the gain will be higher than the gain in the middle. The extreme values are then discarded and the average gain among the remaining values is selected as the optimal calibration gain, G cal .

C. SOFTWARE IMPLEMENTATION
The control software for the electric field sensors follows an object-oriented approach and it is structured on a three layers stack: • Layer 0: hardware interface and file system management; • Layer 1: middleware components such as data models, hardware abstraction objects, and basic utilities such as math functions, data serialization, and visualization; • Layer 2: application components such as the Sensor object and the Calibration object, which contain executable code. The Calibration application is used to generate a list of gain and correction values for each specific SDR according to the calibration framework. The Sensor application takes as input the gain configuration files for the used SDR and a measurement configuration file in JSON format and outputs a result file, also in JSON format with the measurement results. The code is responsible for acquiring signals and calculating the average power for each data chunk. Multiple chunks can be combined together to provide longer integration times. All the code is provided with GPL V3 License on a public repository [33].

IV. EXPERIMENTS
The experimental campaign has been designed to investigate the effective use of SDRs as EMF sensors. In this measurement campaign, we focus on 5G cellular bands, as the reference bands to benchmark the power measurements. In this section, we first introduce the calibration results of the three SDRs mentioned in Section III. Subsequently, we define the calibration parameters (see Table 2) and evaluate their impact on the measurements. Finally, the power measurements obtained on our own 5G private base station are presented and discussed.

A. CALIBRATION RESULTS
In this subsection, we present the calibration of the three different SDRs. In the calibration phase, the bandwidth, sampling frequency, and buffer size settings are the same for the three SDRs. The same signal generator and the same SMA/coaxial cable are used in all the measurements. Since the RTL-SDR has a limited frequency range compared to the Pluto-SDR and Ettus E312, the Electrosense extension board [19] has been used to extend its frequency range.
The results of the gain calibration are shown in Fig. 3. As the figure demonstrates, the Ettus E312 requires a much higher gain compared to the other two SDRs to provide the correct results. The reasons behind this are the electrical connector, which requires an adapter to SMA and does not provide a stable rigid connection to the cable, and the complex analog front-end, which provides more filtering compared with the other two SDRs. Above 1500MHz, the extension board of the RTL-SDR provides a fixed gain of 13dB. The gain of the RTL-SDR needs then to be set to 0 and 13dB needs to be subtracted by the software from the final measured power. Furthermore, Fig. 3 shows a pronounced distinction between the Pluto-SDR and the Ettus E312, even though the same RF chip AD9361 as in the Ettus E312 is used. The difference in gain between the Pluto-SDR and the Ettus E312 is attributed to the different circuitry in the analog front-ends of the two SDRs. The Pluto-SDR does not have any filtering or amplification in front of the RF front-end IC in order to keep the cost of the system as low as possible.
In order to validate our calibration procedure, we have conducted measurements in the anechoic room and compared them with a reference system. The measurement setup is shown in Fig. 4. Inside the anechoic room, there is a reference transmitter with a horn antenna and support for the reference receiver antenna or a device under test (DUT). The transmitting antenna is driven with a vector signal generator and a variable gain amplifier. The receiver antenna is placed on a wooden support. The reference receiver system uses a horn antenna and a spectrum analyzer. The antenna gain is fully known. The whole anechoic room setup, composed of a reference transmitter and receiver, antennas, and RF absorbers, is periodically recalibrated to know the electric field at the receiver. Compared to the reference system shown in Fig. 4, the RTL-SDR measures on average 6.6dB less power. The main factors that can affect this measurement are the level of approximation of the antenna gain, the polarisation mismatch between the transmitting and receiving antenna, and the long cable connecting the RTL-SDR setup, placed outside the room. The long coaxial cable is needed to avoid putting the laptop inside the anechoic room, as it would have affected the measurement. The Pluto-SDR can instead be placed inside the anechoic room and connected to the PC with a long USB cable. With the latter set up the power difference between the reference system and the SDR is less than 1dB.

1) IMPACT OF INTEGRATION TIME
In this section, we experimentally investigate the impact of the integration time, given in (10), aiming to find the best average time over which to compute the RMS power.   5 shows the difference between the input power to the SDR and the power measured by our software. The signal is modulated with 64QAM at 5MHz bandwidth and it is sampled at 20MHz on a Pluto-SDR. In the case of continuous transmission, the integration time has typically no impact on the measured power as long as multiple signals are captured (a 5 MHz symbol has a duration of 0.2μs). However, in the case of the most common sporadic transmissions (e.g., packet radio), a larger integration time gives a higher chance to catch transmission events and thus compute the correct average power. Our results show no direct correlation between the integration time and the measured power for both sinusoidal signals and complex modulations. However, the input bandwidth, set by changing the sampling rate, has an effect on the power reading as higher bandwidth measurements measure also more noise power.

2) IMPACT OF SIGNAL BANDWIDTH
In this section, we investigate the influence of the ratio of the signal and measurement bandwidth on sensor accuracy. The SDR bandwidth is the same as the sampling frequency because of I/Q sampling. When the signal bandwidth is wider than the SDR bandwidth, the SDR makes a frequency sweep and averages the power of the different slices of spectrum measured. This is the same method that spectrum analyzers use [34]. Each slice of spectrum for the SDR corresponds to the resolution bandwidth of the spectrum analyzer. The resulting power measurements may vary depending on the usage of a channel (continuous transmission vs sporadic transmissions). Fig. 5 shows the difference between the measured power and the expected power. Increasing the buffer size, the difference is reduced, especially for lower power levels. When the signal power is low, its amplitude cannot bandwidth. The sampling rate of the Pluto-SDR is varied between 1.25MHz and 20MHz and the buffer size is fixed at N B = 2 19 . For sampling rates that are below 5MHz, the SDR is sweeping in frequency, jumping over 4 hops for 1.25MHz and 2 hops for 2.5MHz. For sampling rates above 5MHz, the power is measured in a single pass.
cover the full ADC range and thus the quantization noise is higher.
The impact of the sampling rate on the power measurement is presented in Fig. 6. The signal used is a continuous 64QAM signal with 5MHz bandwidth. The buffer size is fixed at N B = 2 19 which corresponds to T I ≈ 10 −1 sec. For lower sampling frequency, the measurement error is minimal in the case of frequency sweeps (1.25MHz and 2.5MHz sampling rates) and it is basically nonexistent for the maximum sampling rate which is 20MHz. The figure shows that the sampling rate does not have an influence on the power gain, which is the slope of the curve, but rather it introduces a constant error represented by the gap between the curves shown in Fig. 6.
Following the results from Fig. 5 and Fig. 6 it can be concluded that the power of the channels used for continuous broadcasts, such as TV or radio stations can be measured without any appreciable difference either by sweeping in frequency or capturing the full bandwidth at once. However, as presented in [35] channels showing a more sporadic transmission behavior make power measurements more complicated because the chance of missing a transmission is quite high when frequency sweeping. In order to get a more exact measurement of power, either a real-time spectrum analyzer or a fast sampling SDR is needed.
The results we showed so far considered ideal constant signals. However, there are more complex protocol effects that should be considered when dealing with modern packet radio systems. In the next section, we focus our efforts in evaluating the electric field of 5G cellular signals.

3) IMPACT OF TEMPERATURE
The calibration procedure has been performed on the Pluto SDR at different ambient temperatures using a climatic chamber. The temperature range is between −20 • C and Below 0 • C, the sensitivity at lower frequency is reduced compared to positive temperature. Because of this reduction, a higher gain is needed to obtain the correct power output. 40 • C in steps of 10 • C (see Fig. 7). Below 0 • C, the Pluto SDR loses sensitivity, especially in the low frequency range (i.e., freq. < 300MHz). However, the gain peak between 3500 MHz and 4000 MHz disappears at −20 • C. Above 0 • C, no significant difference is observable in the calibrated gain settings. This confirms what Analog Devices declares in the datasheet of the AD9363 which is the analog front-end IC of the Pluto SDR. The chip is in fact rated for 300 MHz to 3500 MHz and for temperatures between 0 and 45 • C.

B. THE FIELD STRENGTH OF 5G
The main difference between 5G and the previous generation of cellular systems is the use of a time-division duplex instead of having two dedicated bands for uplink and downlink. The 5G standard defines radio frames of 10ms which are divided into subframes of 1ms each. Each subframe is further divided into slots, the duration of which is determined by the settings of the base station and the available bandwidth. For our base station, the configuration follows numerology 1 from [36], which means: • 2 slots per subframe • Slot duration 500μs; • Symbol duration 35.71μs. The slot structure is summarised in Fig. 8. The frame starts with downlink symbols, followed by a mix of flexible, uplink, and again downlink symbols. The number of symbols allocated to each function varies but the amount of possible combinations, called slot formats in the standard, is fixed at 61. The base station can change the slot format depending on the actual load conditions. For example, if users are downloading big files, the base stations allocate more symbols to the downlink than to the uplink. In contrast, if users require more uplink capacity, the base station can allocate more symbols to uplink than to downlink. The base station is also able to dynamically split the available  resources between different users depending on the requested traffic (a.k.a. Load Balancing).
The gNB constituting the base station is a Nokia AirScale micro AWHQE, mounted at 30m altitude. It uses Type I -codebook beamforming with a 4x4 MIMO antenna configuration. The max output power is 10W per antenna port for a total of 40W. The maximum antenna gain is 8.5dBi.
The setup used for our 5G measurements is shown in Fig. 9. In this measurement, we used a Pluto-SDR, which is placed next to a cell phone (Nokia XR20). The exact location has been taken with a GPS receiver connected to the laptop.
The power calculation is performed on the whole band of the gNB, which is approximately 20MHz, instead of on a single channel. The antenna gain in the measurement band is 3dBi, and it has been taken into account in the equivalent electric field calculation.
The uplink and downlink traffic are generated in three ways: (1) watching a youtube video; (2) downloading a big file from the Internet; (3) uploading a big file to google drive.
An approximate map of the measurement points is shown in Fig. 10. The measurement points are all in line of sight of the base station. In this setup, our aim is to distinguish between uplink and downlink signals, tackling the big difference in power between them.
The received power from the cell phone, user equipment (UE), is, in fact, much higher than the power received from the gNB base station because of the UE's close proximity to the SDR. However, the transmit power of the UE can vary depending on the strength of the reference signal received power (RSRP). If the RSRP is high, the UE will reduce its transmit power and vice versa. In different conditions, there is a possibility that the received power from the base station is higher than the power received from the UE. It is thus of paramount importance to perform preliminary measurements to correctly assess the expected power from the base station and to identify the beginning of a frame. This situation can become even more difficult to deal with, in the case of dynamic environments (i.e., moving objects in between the UE and the gNB or adverse meteorological conditions). In this case, the transmit power of both UE and gNB can vary quickly enough that determining the detection threshold becomes a difficult task. A possible solution to this problem is to choose shorter measurement intervals and perform a periodic recalibration of the threshold.
To address the close proximity of UE to the SDR, the gain of the SDR must be chosen in a way that the signals from the gNB are clearly received without having the front-end saturated by the signals from the UE. The selection has been performed starting from the gain value obtained from the calibration procedure described in Section III-B. A first measurement has been performed using the calibrated gain, and then the gain has been progressively reduced until the SDR was just below the saturation point. The difference between the calibrated gain and the gain used for the final measurements is 3.5 dB (i.e., 33.5 dB from calibration versus 30 dB for the final measurements). The difference in gain was added offline while analyzing the data. Reducing the gain by 3.5 dB causes a slight loss of resolution for the weakest signal but not enough to compromise the measurement.  In the proposed framework, we rely on the difference in amplitude between uplink and downlink signals to determine a threshold, distinguishing between OFDM symbols coming from the UE or the gNB. In order to set this threshold, a measurement has been taken with no cell phone connected to the gNB. Subsequently, with the cell phone on, multiple measurements have been performed on intervals of approximately 100ms corresponding to N B = 2 21 at a sampling rate of 20 MHz. This buffer size, N B , is enough to capture ten full frames. Each frame is composed of ten sub-frames, each one of the sub-frames contains two slots, i.e., twenty-eight symbols. Since the data flow between the UE and the gNB is based on the UE demand and not continuous, some symbols will be empty, resulting in periods of silence, as illustrated in Fig. 11. In order to calculate the power of each group of symbols, the beginning and length of each group should be determined. To this end, we calculate the correlation between the array containing the magnitude of the samples and a rectangular window of variable size. The whole procedure is illustrated in the block diagram in Fig. 14.
The procedure to get the beginning and the length of each group is summarized in Algorithm 2. The size of this rectangular window is set between 1 symbol, corresponding to 714 samples, up to 14 symbols, corresponding to 9996 samples, which is the size of a slot. By this correlation process, we cover all possible lengths of the group of symbols that constructs the 5G slots [36]. This results in 14 arrays, each one containing the outcome of a correlation process from Step 9 in Algorithm 2. Now, by adding the outcome of the S g ← S g +correlations[i] 12: end for 13: GroupStartIndex ← index of each maxima in S g 14: for each group g in groups do 15: for i ∈ [1,14] do 16: if correlations[i][g] has the minimum amount of peaks then 17: L g ← i 18: end if 19: end for 20: end for correlation from the 14 possible symbol sizes, we obtain an array of samples that peaks at the beginning of each transmission, GroupStartIndex, as depicted in Fig. 12. The length of each group, L g is determined from the results of each different correlation. As shown in Fig. 12, when the size of the rectangular window corresponds to the length of a group of symbols, it results in a triangular shape with a sharp tip.
where L g ∈ [1,14] is the length of the group and N g ∈ [1,10] is the number of groups. Once we distinguish the beginning and the length of the groups received from the UE and the groups received from the gNB, the equivalent electric field can be calculated using (7). The result for the segment used in Fig. 11 is presented in Fig. 13. Finally, the same procedure is applied to all measurements, and the electric field is averaged over time for each position.
The electric field calculation based on our 5G measurements is presented in Table 3. As expected, the electric field is stronger in positions 1 and 6 from Fig. 10, which are next to the UE. In all other positions, the electric fields are considerably lower. The average electric field values are never above 0.6 V/m. However, the electric field for a single transmission from the UE can peak at 40.82 V/m when measured with a near-field probe. Peaks from the base station, on the other hand, never surpassed 2.084 V/m. Measurements performed with two devices do not show any significant change in the electric field value generated by the base station, which is the focus of this research work. One important outcome of this measurement is that, while the regulator is focused on limiting the power of downlink transmission, the greatest contribution to RF exposure on people comes from the UE itself, similarly to what was found in [37]. Another important aspect to consider is that our results are in line with what was measured in [29]. This means that a low-cost SDR based system can be effectively employed for this kind of measurement.

V. CONCLUSION AND FUTURE WORK
From our results, it is possible to use Software Defined Radios as portable electric field sensors. Due to their programmable and flexible nature, SDRs allow to make intelligent sensing and apply signal processing techniques while costing less than a real-time spectrum analyzer. This paper provides an in-depth explanation of how to calibrate different devices and how to successfully measure electric fields at different frequencies and with different bandwidths. It also shows how the strengths of SDRs can be exploited to measure the field of complex systems such as 5G, improving on the current spectrum analyzer-based methods. However, the next step is to integrate the electrosmog sensing in a distributed network such as Electrosense [31], which will allow monitoring of the electric field generated by a multitude of wireless devices on a wide area.