Catch the Pitch of 5G FWA: EMF and Throughput Measurements of 3.5-GHz Standalone Deployment in a Baseball Stadium

The provisioning of 5G technology does not only involve mobile terminals, but also new services such as Fixed Wireless Access (FWA). The aim of this study is to examine the ElectroMagnetic Field (EMF) and throughput performance of a FWA deployment utilizing Standalone technology operating at 3.5 GHz. To address the unique characteristics of 5G FWA signals, an innovative framework has been designed based on the measurement of 5G FWA spectrum using four independent chains and an additional traffic generation chain to saturate the radio link capacity at the measurement location. Methodologies for evaluating 5G FWA exposure under conservative conditions, such as measurements of exposure during active traffic generation and maximum power extrapolations, are also introduced. Results from real measurements taken at a baseball stadium show that 5G FWA exposure is consistently low, typically below 0.4 [V/m], with an upper bound of 0.59 [V/m], while the achieved throughput is up to 250 [Mbps]. Additionally, the measured 5G exposure levels are a small fraction compared to those emitted by other technologies such as 4G. Furthermore, the values estimated by simulation from the output power counters of the base station are found to be in close agreement with the measured exposure levels.


I. INTRODUCTION
T HE DEPLOYMENT of 5G networks is currently reaching an advanced level in many countries in the world, especially when considering frequencies in the mid-band range (i.e., between 1 GHz and 6 GHz) [1]. Telecommunications operators are increasingly adopting 5G technology, by upgrading their mobile networks with StandAlone (SA) capabilities. Like previous generations, 5G technology enables ubiquitous cellular coverage that ensures service continuity for devices. However, the deployment of 5G technology is not only important for providing smartphone signal coverage, but also for supporting services that require very low or no mobility.
In this context, the implementation of Fixed Wireless Access (FWA) through 5G is gaining traction in various deployments. For example, in Italy, more than 1.5 million households currently have access to Internet through FWA [2], with a predicted increase in subscriptions in the coming years. Historically, operators have used FWA as a cost-effective solution for providing Internet connectivity in suburban and rural areas. The concept behind FWA deployment is straightforward: the last-mile connectivity is achieved through a radio link between a radio base station operated by the service provider and a Customer Premises Equipment (CPE) installed at the user's household [3]. As such, the FWA service, though it utilizes a radio network, competes with traditional wired solutions such as Fiber To The Cabinet (FTTC) and Fiber To The Home (FTTH), as well as the more recent Low Earth Orbit (LEO) satellite connectivity.
Despite the growing interest in providing household broadband Internet through 5G FWA, little research has been conducted on the levels of ElectroMagnetic Field (EMF) associated with a commercial 5G FWA service, particularly for SA deployments that realize the full potential of 5G. In general, the monitoring of EMF exposure from nextgeneration Node-B (gNB) is a central aspect at societal, environmental, technical and research levels. More concretely, extensive studies providing sound evidence of low exposure levels from base stations are needed, in order to reduce the perceived health risks at the societal level from the adopted technology [4]. At the environmental level, the monitoring of exposure from base stations (even outside the exclusion zones) is one of the main missions for the environmental protection agencies spread all over the world (see, e.g., [5], [6]) -a task that is also imposed by law to ensure EMF compliance. At the technical level, the EMF monitoring from the base station is an essential aspect that is deeply covered by the main standardization bodies in the field (i.e., International Telecommunication Union (ITU) [7], [8] and International Electrotechnical Commission (IEC) [9], [10]). At the research level, the collection of exposure measurements from base stations is instrumental for generating meaningful exposure patterns for animal-based and epidemiological-based studies [11], which are intended to study the long-term effects of lower-than-limit exposure levels.
More concretely, much of the existing literature (see, e.g., [12], [13], [14], [15], [16], [17], [18], [19], [20]) focuses on the EMF assessment of exposure from 5G gNB providing mobile service to smartphones. However, the unique characteristics of 5G FWA introduce several differences compared to a traditional mobile deployment. For example, FWA users are typically located in fixed locations, while mobile users are generally more nomadic both in terms of temporal and spatial variability. As a result, the gNB antenna of an FWA deployment tends to concentrate the radiated power into a small number of locations, i.e., the ones where the CPE are located. In addition, the CPE antenna hardware is typically more advanced compared to a smartphone's, since CPE equipment is powered by the electricity grid, thus battery consumption is not an issue, and its power class is higher than that of a smartphone. Consequently, the CPE can potentially guarantee higher signal stability and larger throughput on the radio link compared to a smartphone. Therefore, the EMF exposure pattern that is radiated from a gNB towards a CPE may be more concentrated and potentially stronger than the one generated towards a smartphone.
In this scenario, several questions emerge, such as: What is the exposure level of a 5G FWA SA service operating in the mid-band frequencies? How can the exposure from a commercial 5G FWA gNB be measured? What is the impact on the EMF of user traffic generated towards the CPE? Are the measured 5G FWA exposure levels comparable with those obtained through simulation? The goal of this paper is to shed light on the aforementioned questions, in order to further our understanding of 5G FWA exposure, a topic that is relevant not only for experts in the field, but also for the general public.
More specifically, we make the following original contributions to the scientific assessment of 5G FWA exposure over mid-band frequencies. First, we conduct EMF measurements in a unique scenario, by evaluating the exposure levels in a baseball stadium hosting a commercial 3.5 GHz SA gNB that provides 5G FWA coverage. This scenario allows for extensive measurements in a controlled environment, where the measurement equipment can be flexibly positioned around the CPE location. In addition, the baseball stadium allows performing measurement in a clean setup, in which other CPEs -that could influence the exposure in the measurement location -are far from the used one. Second, we measure exposure levels using four independent measurement chains, including both narrow-band (i.e., 5G selective) and wide-band (i.e., 5G and other technologies) measurements. Each measurement chain provides unique data and enables cross-validation with the measurements taken by the other chains. Third, we design and evaluate both traffic-based and Maximum Power Extrapolation (MPE)-based measurement methodologies to characterize the 5G FWA exposure levels. In particular, we develop a traffic-level approach to evaluate the impact on EMF levels when traffic is directed towards the measurement location. Additionally, we introduce and apply an MPE approach to estimate an upper-bound on the 5G exposure levels. Fourth, we compare the collected exposure levels to the simulated ones, obtained by applying a free-space propagation model to the gNB output power counters provided by the operator.
Our results reveal that 5G FWA exposure over mid-band frequencies is consistently very low (typically lower than 0.4 V/m), with 5G making up a small proportion compared to other technologies (such as 4G), thus supporting the use of approaches based on narrow-band (i.e., selective) measurements, like the ones presented in this work. Secondly, 5G FWA exposure is highly proportional to the amount of traffic directed towards the measurement location, with EMF levels remaining low when no traffic is present. Thirdly, the Downlink (DL) throughput of the 5G FWA service demonstrates good stability over time, even when the traffic generation process automatically adjusts the traffic levels in response to the available network capacity. Fourthly, the MPE procedure, which is based on the extrapolation of exposure from the collected power of Synchronization Signal Block (SSB) and Physical Downlink Shared CHannel (PDSCH) signals, allows for the introduction of a strong upper bound, which exceeds the EMF measured with the traffic-based approach. Lastly, the results show a good alignment between the measured EMF exposure values and those derived through simulation from the gNB output power counters.
The rest of the paper is structured as follows. In Section II, we review related work. Section III highlights the main implementation aspects of FWA service over 5G mid-bands. In Section IV, we present our measurement framework, which is tailored to 5G FWA over mid-band frequencies.
The scenario description is reported in Section V. The outcomes of our traffic and EMF assessments are reported in Section VI. Finally, Section VII concludes our work.

II. RELATED WORK
In the literature, we did not find any studies that are directly comparable to our research, i.e., the assessment of EMF levels that are associated with FWA over 3.5 GHz (and in general 5G mid-bands). This could be due to the fact that FWA over 5G mid-bands is a relatively new service. Therefore, in the following sections, we will compare our work to the literature in three main orthogonal categories: i) EMF assessments of 5G mobile service, ii) EMF assessments of FWA service over 5G mm-Wave bands and, iii) performance assessments of 5G SA deployments.
When looking specifically at pre-commercial 5G deployments, Franci et al. [12] evaluated the exposure levels at 3. 6 [GHz] and 27 [GHz], and found that active traffic generation towards the measurement location led to an increase in exposure compared to the case without traffic. Héliot et al. [13] measured exposure from a Multiple-Input Multiple-Output (MIMO) 5G gNB operating at 2.63 [GHz], and also took measurements from a commercial 5G gNB operating at 3.65 [GHz]. The authors concluded that exposure levels were heavily influenced by the beams directed towards active terminals.
Focusing on commercial sub-6 GHz networks, Chiaraviglio et al. [14] conducted extensive measurements of 5G exposure at 3. 6 [GHz], and found that the baseline EMF levels, collected without active traffic generation, were generally a small fraction compared to other pre-5G sources. Aerts et al. [15] conducted a comprehensive measurement campaign at different locations served by a 5G gNB operating at 3. 6 [GHz], and observed an increase in exposure when traffic was directed towards a terminal close to the measurement location. Similar findings were reported by Chountala et al. [16] in a different country. Sali et al. [17] evaluated the exposure levels for various locations served by a sub-6 GHz network using a network scanner. The authors found that the field levels were generally higher than those observed in [14], [15], [16], although it should be noted that these measurements were conducted in a country with different EMF regulations and likely different settings for the gNB output power.
Finally, we examine the exposure assessments for 5G millimeter-wave deployments. To this end, Wali et al. [18] conducted several tests in a location served by a 5G gNB operating over mm-Wave frequencies, and found that the traffic generated by a smartphone in close proximity to the measurement location had an impact on the exposure level. Colombi et al. [19] evaluated the exposure near millimeter-wave antennas operating at 28 [GHz] and 39 [GHz] frequencies, and observed very low exposure levels even when the maximum power and a single beam were directed towards the measurement location. Liu et al. [20] evaluated the exposure level from a 5G gNB operating at 28.25 [GHz], and measured a slight increase in exposure when traffic was directed towards the measurement location.
Compared to the literature mentioned above, this work focuses on a different scenario, i.e., providing CPE connectivity through a 5G SA deployment for FWA service. Furthermore, our analysis includes both wide-band and narrow-band measurements (with and without traffic), as well as EMF evaluations derived from simulation using operator data. In this way, we provide a clear and comprehensive understanding of the EMF exposure levels generated by the gNB providing the FWA service.

B. EMF ASSESSMENTS OF 5G FWA SERVICE OVER MM-WAVE
The second category of works related to our investigation deals with the assessment of 5G FWA service over mm-wave frequencies [21], [22]. Specifically, Chiaraviglio et al. [21] investigate the EMF exposure from a FWA service operating at 27.2 [GHz]. They conclude that the exposure from the mm-Wave deployment is consistently very low, even when traffic is directed towards a laptop connected to the CPE. This work is complemented by the analysis of Migliore et al. [22], in which a MPE approach tailored to 5G mm-wave is designed and evaluated.
Compared to [21], [22], our work focuses on a different frequency range, centered on 3.5 [GHz], which is currently the most widely used option for realizing 5G FWA service, thanks to its balance of coverage and capacity capabilities. Additionally, the band used at 3.5 [GHz] is lower than the one available over mm-wave frequencies. These factors necessitate the use of different measurement equipment and approaches compared to those developed in [21], [22], Furthermore, this work includes EMF measurements taken in Real-Time (RT), a task that is currently not feasible in the wide mm-wave bands, due to limitations in measurement equipment hardware. The comparison between RT and Non-Real-Time (NRT) measurements, which is specifically covered in this work, reveals a good match between the two, thus providing further insight into the understanding of FWA exposure.

C. PERFORMANCE ASSESSMENTS OF 5G SA DEPLOYMENTS
The third category of works focuses on the analysis of throughput/delay/loss parameters in 5G SA deployments [23], [24], [25]. In more detail, Rischke et al. [23] perform a wide set of DL and Uplink (UL) measurement to characterize packet delay and losses in a SA campus networks. Lackner et al. [24] measure data rate and round trip delay in a standalone testbed facility. Makino et al. [25] evaluate throughput and delay performance in a private deployment.
In principle, our work differs from [23], [24], [25] as we focus on the impact of traffic on the exposure levels, while [23], [24], [25] are mainly tailored to performance assessments. However, we recognize that the methodologies adopted by [23], [24], [25] for the performance assessments can be potentially applied also in our framework, since the CPE is able to monitor physical layer parameters (e.g., Reference Signal Received Power (RSRP)) and to run network layer tools (ping, traceroute), which have been extensively used in the analysis of [23], [24], [25]. We leave the investigation of such aspects as future work.

III. FWA SERVICE OVER 5G MID-BAND: AN INTRODUCTION
We provide a concise overview of 5G FWA service over 5G mid-band frequencies, with a focus on the Italian market. This section is useful for those who are not experts in the field, as well as for the design of the measurement methodologies that will be discussed in Section IV. Concretely, FWA service can use both dedicated frequencies (reserved for FWA) or spectrum portions shared between FWA and mobile services.
Focusing on the former case, FWA operators have been licensed a set of frequencies in the 3.4-3. 6 [GHz] range, also known as the pioneering 5G band. These frequencies are licensed on a regional basis, although there have been recent efforts to consolidate the set of FWA operators and standardize the assignment of FWA frequencies at a national level. In this work, we focus on the FWA service provided by Opnet , a wholesale 5G provider building and managing 5G 3GPP networks and the first operator in Europe to offer the FWA service over 5G SA.
Tab. 1 provides an overview of the FWA bands licensed to Opnet. In general, the 3.4-3. 6 [GHz] spectrum is divided into high and low portions, each of them further labeled with A, B, and C blocks. More specifically, a total of 4 blocks have been assigned to Opnet. Each block spans over   21 [MHz] of bandwidth, although the actual used bandwidth for 4G and 5G service is lower, typically equal to 20 [MHz] for each block, in order to align with 3GPP 4G/5G band specifications [26].
Focusing on the 5G service, Opnet has been licensed two contiguous blocks in the low portion of the band, for a total of 42 [MHz] contiguous bandwidth. Tab. 1 also highlights the allocation of 4G bandwidths at the time of our measurement (June 2022). It is noteworthy that, on January 1st, 2023, Opnet has obtained permissions to reshuffle the "B High" and "C High" blocks with the "A Low" block at 3.437-4.458 [GHz] in order to provide the legacy 4G FWA service, while the configuration of 5G blocks in Tab. 1 has been kept unchanged.
Tab. 2 provides additional information about the 5G signal adopted by Opnet's FWA service. Specifically, the nominal bandwidth for the service is 40 [MHz] of contiguous spectrum, with the remaining 2 [MHz] left unused. Interestingly, the 5G SA feature implemented by Opnet enables the complete exchange of control and traffic information over 5G channels. The subcarrier spacing is set to 30 [kHz], in accordance with 3GPP 5G specifications [26], resulting in more than 1200 useful subcarriers within the considered spectrum. Like other 5G deployments, Opnet employs a Time-Division Duplexing (TDD) scheme, with a 74.3% downlink transmission fraction (referred as F TDC in the table).
In terms of code domain information, the center frequency is set at 3478.98 [MHz], and the relative positioning of the SSB is set at 540 [kHz]. The SSB positioning, which is obtained by adding the SSB offset to the center frequency, is crucial for synchronizing equipment such as user terminals, CPEs, and Spectrum ANalyzers (SANs) with the serving sector of the gNB. The SSB transmission pattern in the time domain is set to "C" in order to match 3GPP 5G specifications [27], with a periodicity of 20 [ms]. A single SSB is used to cover the entire sector extent, with the number of active SSBs set to 1. Additionally, the adopted spatial multiplexing technique is Single User -Multiple Input Multiple Output (SU-MIMO).
Tab. 3 provides an overview of the 5G equipment features adopted by Opnet, including information about the Radio Access Network (RAN) and CPE used by the operator. Specifically, the panel providing sector coverage can be highly customized, with options for adjusting gain and orientation through the activation or deactivation of beamforming capabilities and the setting of electrical tilt. Additionally, the maximum output power for the panel is set to over 200 [W], which serves as an upper bound for power levels during antenna installation authorization processes. In actual daily usage, power levels are typically lower than this limit. On the CPE side, the equipment is designed for outdoor use and allows connectivity over both 5G and legacy 4G networks, providing a backup 4G service in areas not yet covered by 5G. The CPE's maximum output power is set to 26 [dBm], in accordance with 3GPP specifications for the device's power class [28].

IV. 5G FWA MEASUREMENT FRAMEWORK
With an understanding of the key characteristics and unique aspects of the 5G FWA service provided by Opnet, we have developed an innovative framework to analyze the EMF and performance of this service. It is worth noting that our framework can also be applied to other operators providing 5G FWA service over the mid-bands. In the following subsections, we first outline the measurement objectives. We then detail the equipment and measurement chains used in this study. Finally, we describe the measurement methodologies implemented in the measurement chains to achieve the measurement objectives.

A. MEASUREMENT GOALS
Tab. 4 provides an overview of the measurement goals (labeled G1-G6), the adopted measurement chains (labeled T, C1-C4), and the measurement methodologies used in our framework (labeled as AT, MPE). Focusing on the goals, we aim to distinguish the 5G FWA exposure from other sources and technologies that may also be radiating at the measurement location. This is accomplished by using selective narrow-band measurements. However, it is also important to monitor the total exposure at the measurement location. To achieve this, we will also perform wide-band monitoring. Both these tasks are pursued in goal G1.
Additionally, we aim to monitor the 5G FWA spectrum over time, to understand any changes in the signal. This is goal G2, which also requires collecting EMF samples over the entire bandwidth used by the operator and computing refined metrics such as channel power to measure the integral of power and exposure over the entire 5G channel.
Goal G3 involves the use of techniques in the code domain to gain a deeper understanding of the 5G FWA service, such as exposure levels on specific control channels (like the SSB), signal characteristics, and information about the SA network architecture. This can be achieved by synchronizing the measurement equipment with the serving gNB, and requires specialized hardware to accomplish this task. Furthermore, information about control channel exposure is crucial for determining the maximum exposure levels across the entire 5G channel.
As the fourth goal, we aim to develop a tool to control the amount of traffic directed towards the measurement location (goal G4). Previous research on 5G exposure in mobile networks indicates a direct proportionality between increased traffic and increased exposure [15], [16], [20], [21]. This relationship must be verified and evaluated in the context of 5G FWA service over mid-bands, and thus, a specialized chain tailored to the generation and assessment of 5G FWA traffic must be designed.
Goal G5 involves collecting exposure samples using measurement tools. Specifically, the measurement equipment can collect exposure samples in RT or NRT. For example, using a SAN, RT features allow for continuous collection of samples across the entire 5G FWA bandwidth, without losing any sample between consecutive sweeps. However, this process is costly in terms of the size of the measurement traces, which can quickly grow with the measurement time. On the other hand, NRT measurements are lighter in terms of data size but may result in sample loss. Since the 5G FWA signal can be highly variable in time and frequency domains, it is necessary to compare RT and NRT traces.
The final goal, G6, entails comparing the measured EMF exposure levels to those simulated through the use of closedform formulas. This step is crucial in determining the accuracy of the 5G FWA measurement methods, as it allows for an assessment of the effectiveness of the measurements against the simulated upper-bound exposure levels.

B. EQUIPMENT CHAINS
In order to achieve the measurement goals outlined above, we utilize the following equipment chains: i) Traffic generation chain (T), ii) Portable SAN chain (C1), iii) Rack-mounted SAN chain (C2), iv) Network scanner chain (C3), and v) Wideband monitoring chain (C4). The allocation of these chains to the measurement goals is outlined in Tab. 4 (central column). Below, we provide more information about each chain.

1) TRAFFIC CHAIN -T
The traffic chain T plays a crucial role in our framework, supporting goals G1-G6. Fig. 1 provides an overview of the high-level functional design. Essentially, the T chain consists of end-systems (a server and a client), which we have full control over, and network elements, which are either managed by third parties and/or the Opnet operator. The traffic generated between the server and client in the DL travels through the network elements, passing through the 5G FWA radio link established between the Opnet gNB and the Opnet CPE.
To generate large traffic volumes on the 5G FWA link, we employ the following strategies: i) Both the server and client are run on dedicated machines and use the iPerf utility [29] to exchange data; ii) We monitor the traffic on the path between the server and the client to ensure that the bottleneck capacity is always on the 5G FWA link; iii) We direct DL traffic from the iPerf server to the iPerf client using a Transmission Control Protocol (TCP) data transfer and a single connection. This allows us to control the amount of traffic traversing the 5G FWA link and potentially saturate it with large traffic volumes -a condition instrumental to assess the exposure in the measurement location under conservative settings.
In addition to generating traffic, chain T also includes logging capabilities that allow for the collection of timestamp and data information about the achieved throughput levels during data transfers. The collected information is extracted from the output of the iPerf utility.   In more detail, C1 is composed of a receiving antenna that covers the frequencies used by Opnet in the mid-bands, a portable SAN, and a laptop that controls the SAN through the use of Standard Commands for Programmable Instruments (SCPI) commands. The antenna is connected to the SAN via a low-loss cable, and the laptop and the SAN are connected through a high-quality Ethernet cable. This configuration allows for the measurement activity to be fully controlled by software running on the laptop through the exchange of SCPI commands between the laptop and the SAN. 1 In this case, the SCPI commands are implemented in a MATLAB script and the Instrument Control Toolbox is utilized to establish communications with the SAN.
Tab. 5 presents the set of portable SAN features that are relevant for 5G FWA assessments. In more detail, the operation modes range from a spectrum analyzer (useful for performing selective and spectrum measurements of goals G1 and G2, respectively) to a RT spectrum analyzer (which is essential for goal G5). The frequency range covers the 3.4-3. 6 [GHz] band that is used by Opnet. Additionally, the number of sweep points is reduced when transitioning from NRT to RT in order to ensure the RT feature.
When the operation mode is NRT, the detector type used is a classical Root Mean Square (RMS). Conversely, the RMS is not available in RT mode due to hardware limitations, and a simpler detector such as the peak detector must be used. The RT feature also has an impact on the measurement type. In NRT mode, a rolling average can be used to compute the measured values, while in RT mode, a standard clear/write measurement is available, in which the current measurement does not involve any averaging with past samples.
The output of the SAN also differs between RT and NRT. In particular, the total channel power is retrieved when the SAN operates in NRT by providing the SAN with the antenna 1. SCPI-based interfaces currently represent the de-facto solutions to remotely control spectrum analyzers with non-proprietary programs.  factors of the receiving antenna, allowing the instrument to express the total channel power in terms of exposure (e.g., electric field or power density). In RT mode, however, the channel power function is not available, and the exposure must be computed in a post-processing phase starting from the values of measured power over the frequency samples. Finally, the logging of the collected traces is provided as output through SCPI commands when the instrument operates in NRT, whereas the measurements are locally saved on the SAN with CSV files when operating in RT mode.

3) RACK SAN CHAIN -C2
The SAN, shown in Fig. 3, is the second chain to perform EMF measurements. It complements C1 by providing selective (G1), code selective (G3), traffic-based (G5), and measured data (G6). The measurement chain is based on a Rohde & Schwarz FSVA 3030 Spectrum Analyzer working in 10 Hz -30 GHz frequency range completed with 5G signal decoding software. Consequently, the system is able to decode the 5G frame providing the power vs. symbol per carrier grid. This feature has been used to obtain an in-deep knowledge of the frame structure of the signals, and allowed a direct measurements of the received power per Resource Element (RE).

4) NETWORK SCANNER CHAIN -C3
As illustrated in Fig. 4, the C3 chain comprises a control laptop, a network scanner, and an omnidirectional receiving antenna that spans the range of frequencies used by operators up to the mid-band. This chain plays a crucial role in measuring physical layer parameters, enabling synchronization of measurement equipment with the serving gNB and extracting decoded information (objective G3). A proprietary protocol is employed to query the network scanner and store the high-level information on the control laptop.

5) WIDE BAND MONITOR CHAIN -C4
The C4 chain is composed of a diode-based probe connected to a wide-band monitoring unit, as depicted in Figure 5. This chain enables continuous monitoring and recording of the total electric field exposure observed at the measurement location, thereby fulfilling the wide-band monitoring objective of G1. It is important to note that the measured exposure encompasses the contribution of the Opnet sector providing 5G FWA signal coverage, as well as all other sources and technologies that emit radiation towards the measurement point. In more detail, the meter continuously measures the exposure on a tri-axial probe, and then computes the total EMF by applying a RMS summation. The output of the chain is a set of timestamp plus measured EMF values, which are stored in spreadsheet XLS files.

C. ACTIVE TRAFFIC METHODOLOGY
The first methodology that we developed to evaluate exposure and performance at the measurement location is called Active Traffic (AT). This procedure involves collecting measurement samples using C1 while generating traffic with the T chain. Specifically, the methodology is divided into the following steps: Step 1) C1 and T are powered on, Step 2) traffic and logging on the T chain are activated, Step 3) the 5G FWA NARROW-BAND MEASUREMENT (5G-FWANM) algorithm detailed in Alg. 1 is executed on C1, Step 4) traffic and logging on the T chain are deactivated.
The core of the methodology is represented by the 5G-FWANM algorithm reported in Alg. 1, which performs the EMF measurement over the specified band. The coding of the measurement algorithms in software is an innovative aspect of 5G-based EMF assessments, representing a point of discontinuity with respect to legacy manual-based operations. In particular, software-based measurement methodologies, like the one developed in Alg. 1, are a promising solution to improve the measurement reliability, ease the measurement repeatability, and allow the sharing of the measurement procedures among the community. In more detail, we decided to present Alg. 1 as a set of SCPI commands, due to the extensive availability of such open interface in current measurement equipment. In this way, the involved community may run the presented algorithm to control their own measurement equipment, which in most of cases fully support SCPI-based commands. However, we also include a semantic explanation next to each command, in order to disclose  22: sleep(chp_pause_time) 23: end for 5G-FWANM to the general public -who may be not familiar with SCPI commands.

time_array[index_sample]=curr_time() //time measurement
More concretely, 5G-FWANM takes as input the start and stop frequencies (freq_start and freq_stop), the number of samples (avg_samples) used to compute the rolling average, the initial reference level value (initial_ref_level), the maximum number of channel power samples (max_chp_samples), the initial pause time (initial_pause_time), and the channel power pause time (chp_pause_time). It then outputs the SAN identification number (id_number), the GPS coordinates (gps_coord) of the measurement location, an array of channel power samples (chp_array), and an array of time measurements (time_array). The algorithm is coded as a set of SCPI commands, which are represented in human-readable ASCII format.
The main steps of the 5G-FWANM algorithm are as follows: first, the identification number and GPS coordinates are obtained from the SAN (lines 1-2). Next, the SAN is configured to perform narrow-band measurements on the specified spectrum portions (lines 3-16). Finally, the channel power is measured (lines 18-23). The channel power recording is run after the initial time initial_pause_time (line 18). In this way, a meaningful set of samples is collected by the SAN before providing as output the first channel power sample. In the following steps, the channel power and the time reference are saved (lines 20 and 21). The routine iterates over the following sample after the pause time chp_pause_time (line 22). The algorithm ends when all samples in max_chp_samples have been stored in the chp_array vector (line 20).

D. MAXIMUM POWER EXTRAPOLATION METHODOLOGY
The second methodology that we adopted is the MPE, which is mainly used to extract an upper bound of the exposure level at the measurement location. We initially sketch the general MPE approach reported in [30] and [31], and then we detail how we tailor the MPE procedure in the specific case of 5G FWA over mid-bands. Intuitively, the MPE is based on the on-field evaluation of the received power per RE P RE that the gNB under investigation generates at the measurement point. The power of 5G over the entire grid of RE is then expressed as: where N SC is the total number of signal subcarriers and F TDC is the duty-cycle deterministic factor for TDD duplexing. Intuitively, the main idea behind the MPE procedure is to apply the power measured over P RE (expressed in linear power units) to all subcarriers in the DL direction. The 5G power P 5G (expressed in linear power units) is then converted into 5G electric field (expressed in [V/m]) [22]: where Z is the input impedance (expressed in [ ]), L CABLE is the power loss of the cable connecting the receiving antenna and the SAN (expressed on a linear scale lower than unity), and F is the antenna factor of the receiving antenna (expressed in [m −1 ]). The main goal behind MPE is then to select representative values for P RE . Intuitively, in fact, the power per RE strongly depends on the usage of the radio resource, which includes, e.g., control channels, as well as DL/UL traffic channels. Moreover, even by considering the REs that are assigned to specific channels, their power distribution is not constant across the RE set, which further complicates the selection of meaningful P RE values. Consequently, typical candidates for P RE value include, e.g., median and/or averages over the RE for a control channel and/or traffic channel [30], [31].
In this work, we consider as possible candidates for P RE the following subsets: 1) median of REs assigned to SSB resource grid, labelled as P SSB RE ; 2) median of REs assigned to PDSCH resource grid, labelled as P PDSCH RE . More specifically, P PDSCH RE is retrieved by imposing the generation of traffic with chain T. In this way, we evaluate the resource grid under exploitation of radio resources for active traffic towards the measurement location. However, it is worthwhile to note that the REs assigned to PDSCH span over a much larger portion of bandwidth than the one of SSB. In particular, the Opnet configuration includes 40 [MHz] of usable bandwidth, while only 7.2 [MHz] of the Opnet spectrum is reserved for SSB. In order to make a fair comparison between P SSB RE and P PDSCH RE (and avoid eventual effects due to calibration of the receiving antenna), in this work we have restricted the median of REs used for P PDSCH RE only to those REs corresponding to the 240 subcarriers of SSB. Consequently, the same spectrum amplitude of 7.2 [MHz] and the same frequency range are employed in both cases. Furthermore, we exclude from the computation of P PDSCH RE the REs that belong to slots 1-2 (used for Physical Downlink Control Channel (PDCCH)) and slots 3,12 (used for PDSCH-DeModulation Reference Signals (DMRS)).

V. SCENARIO DESCRIPTION
We consider a scenario in the baseball stadium of Nettuno, a small town in the central part of Italy. The stadium is served by a raw-land site, shown Fig. 6(a). The installation includes various operators and technologies, one of which is the Opnet gNB 5G FWA service. The stadium scenario allows on one side an easy positioning of multiple measurement chains around the CPE, while at the same guarantees a large flexibility in the selection of the height to perform the measurement, e.g., to match the actual height above ground for a CPE positioned on the balcony/roof of a house. Specifically, Opnet offers signal coverage over mid-band frequencies by utilizing three distinct sectors. Our focus is on the panel that radiates towards the stands, as depicted in Fig. 6(b). We then select a measurement location in close proximity and Line-of-Sight (LOS) conditions to the site, located on the stadium steps, as shown in Fig. 7(a)-7(b). The selected location is within the main radiation zone of a single Opnet sector and outside the main radiation lobes of the other two Opnet sectors, as clearly shown the sectorization in Fig. 7(b) (light blue lines). Notably, the measurement point is near the azimuth of a single serving sector, which is oriented towards the stands of the stadium. In this way, we focus our investigation on the DL exposure from one Opnet sector through the narrow-band chains C1-C3. However, the exploitation of the wide-band meter in chain C4 allows also monitoring the total exposure from the considered Opnet sector and from other operators whose sectors radiate over the measurement location.
In the next step, we position the CPE at the measurement location, as shown in Fig. 8(a). The CPE is mounted on a self-standing pole and is oriented towards the serving sector. The CPE is then connected to a laptop, which serves as the client in the T chain (as seen in Fig. 8(b)). We proceed to install the measurement chains C1-C4. As depicted in  Fig. 8(b), the C1 chain is placed in front and below the CPE. This positioning allows the C1 chain's directive antenna to only detect radiation from the serving sector and not from the CPE, while also keeping the radio link between the CPE and the serving sector unobstructed. Fig. 8(b)-8(d) also show the positioning of the remaining chains C2-C4 around the CPE, which are placed to accurately measure the sector's radiation over the measurement locations. In more detail, C1, C2, C4 and Opnet CPE antennas are placed on tripods, in order to minimize the effect of ground reflections. Eventually, C1 SAN, C1 laptop and T laptop are placed on a camping table that is used to: i) ensure the short connections between the equipment and the measurement antenna / CPE equipment, ii) provide a single control desk to jointly supervise T and C1 SAN chains. Finally, C2 SAN is located at the press stand ( Fig. 8(d)), due to the fact that such equipment requires a stable support (the total weight of the SAN is more than 20 kg) and an electricity plug in close proximity. Eventually, the C3 chain is also placed next to the C2 SAN (Fig. 8(d)), due to the following reasons: i) the omnidirectional measurement antenna should be placed far from the CPE (to avoid measurement of UL signals), ii) the cable between the scanner and the measurement antenna is relatively short, and hence the network scanner is placed close the receiving antenna. Finally, it is worth noting that C1 and C4 are battery-powered, while the CPE, C2, and C3 require connection to the electricity grid. Fortunately, this task is easily accomplished in the selected scenario as electricity plugs are available in the stadium.
Overall, Fig. 8(a)-8(d) are also useful to understand the positioning of the four measurement chains around the CPE, and consequently allow the repeatability of the conducted experiments. In more detail, we adopt the following spacing among the measurement antennas and the CPE: i) 1.5 [m] between Opnet CPE and C4 probe (Fig. 8(c)), with a side positioning of C4 to avoid signal detection from the CPE, ii) 2 [m] between Opnet CPE and C1 antenna, oriented in the opposite direction than the CPE (Fig. 8(b)), iii) 2.5 [m] between Opnet CPE and C2 antenna (Fig. 8(b)), iv) 8 [m] between Opnet CPE and C3 antenna (Fig. 8(d) and Fig. 8(b)).

VI. EMF AND PERFORMANCE ASSESSMENTS
We divide the presentation of our outcomes into the following parts: i) evaluations based on the AT methodology and spectrum assessments, ii) evaluation based on code selective assessment and MPE methodology, iii) joint assessment.

A. ACTIVE TRAFFIC AND SPECTRUM EVALUATION
During this step, we begin by applying the AT methodology with the parameters of 5G-FWANM outlined in Tab. 6 and using the measurement chains T and C1. In particular, the start and stop frequencies are set in accordance with the 5G FWA frequencies of Opnet as presented in Tab. 1. The number of samples for each channel power measurement is set to 100, allowing us to compute the channel power over a meaningful set of data. The initial reference level is set at 6 [V/m], to capture the full dynamics of the observed signal. 2 The number of channel power measurements is set to 240. This parameter, combined with the channel power sample time set at 0.5 [s], results in a total measurement time of approximately 120 [s] for each test.
In the next step, we perform the following actions: We first conduct three runs of 5G-FWANM without introducing any 2. The antenna factors vs. frequency of the measurement antenna are preliminary loaded on the SAN in order to directly retrieve the channel power in terms of exposure. traffic to the measurement location, to gather information on the baseline exposure levels in that area. Next, we sequentially run the AT methodology 19 times, by activating and deactivating the T chain before and after each run, to collect a comprehensive dataset on exposure and traffic samples. These runs were conducted during the morning hours of a working day in June 2022, a time during which traffic from other CPEs served by the same sector is likely to be present. Fig. 9 presents the results of this step. In particular, Fig. 9(a) illustrates the DL throughput versus time evolution, while Fig. 9(b) shows the trends in 5G exposure. The x-axis in both figures represents the time reference, which has been normalized to 0 [s], corresponding to the time at which the first channel power sample was recorded by 5G-FWANM in each test. Eventually, Fig. 9(b) is complemented by Tab. 7, which shows a set of summary statistics of EMF exposure without and with traffic generation.
Several observations can be made by analyzing Fig. 9(a), Fig. 9(b) and Tab. 7: First, the exposure is very low (around 0.15 [V/m]) when no traffic is introduced to the measurement location (bottom part of Fig. 9(b) and left column of Tab. 7). Second, the observed traffic levels can be high (greater than 200 [Mbps] in the DL direction), as shown in Fig. 9(a). Third, the observed exposure levels increase when traffic is introduced to the measurement location (top part of Fig. 9(b) and right column of Tab. 7). In particular, all the features reported in Tab. 7 (except from the standard deviation) are increased upon generation of DL traffic. Fourth, the maximum exposure level is always lower than 0.36 [V/m], even when traffic is introduced (top part of Fig. 9(b) and right column of Tab. 7). Fifth, both exposure and traffic tend to increase during an initial transient period of around 20 seconds, which we believe is affected by the time required to saturate the 5G FWA link, a process governed by the TCP protocol used by the iPerf utility. Sixth, the maximum exposure of 0.36 [V/m] reported in Tab. 7 is orders of magnitude lower than the most stringent exposure limit enforced in Italy (set to 6 [V/m]) and than the International Commission on Non-Ionizing Radiation Protection (ICNIRP) guidelines for whole body general public exposure (set to 61 [V/m]) [32].  In the next step, we aim to gain a deeper understanding of the relationship between traffic and exposure levels of the 5G FWA service. To achieve this, Fig. 10 presents the exposuretraffic pairs observed over the different tests. Each point in the figure represents the average exposure and average DL traffic measured during the test, and the figure also includes error bars, expressed as 95% confidence intervals for both exposure and traffic.
Three main observations can be made by analyzing Fig. 10 in detail: Firstly, our measurements show that 5G FWA exposure is strongly proportional to the amount of injected traffic. When DL transfer is activated in the measurement location, an exposure increase of nearly 0.2 [V/m] is observed. In the following section, we analyze the characteristics of the observed 5G FWA spectrum. Specifically, we collect real-time spectrum samples from C1 in the following cases: i) traffic chain T not active, ii) traffic chain T active. Fig. 11 shows the resulting waterfall diagrams for cases i) and ii), respectively. As a reminder, a waterfall diagram is a representation of the evolution of the spectrum (x-axis) versus time (y-axis). Moreover, we complement the figure by adding a set of summary statistics about the received power samples in Tab. 8.
The colors in Fig. 11 are proportional to the received power that is measured in each pixel of the waterfall, where the pixel coordinates are represented by time and frequency domains. The colorbar on the right of each subfigure reports the numerical range associated to the color set. By analyzing Fig. 11(a)-11(b), we can note a sharp decrease of received power, characterized by blue pixels, on the right of the subfigures. This part naturally identifies a guard band that is ensured to avoid interference with frequencies above 3.5 GHz that are licensed to another operator -a common setting that is adopted also in pre-5G technologies. The interesting part of Fig. 11(a)-11(b) is represented by the zones colored with yellow-to-green and bright yellow colors, corresponding to pixels where the measured received power is non-negligible and therefore a useful signal (higher than noise) is measured.
When traffic is not injected in the measurement location ( Fig. 11(a)), the highest values of received power are concentrated in the central part of the spectrum, roughly between 3.472 [GHz] and 3.49 [GHz], which is identified by a strip colored with bright yellow color. This zone is typically used for transporting control traffic information, including, for example, the SSB and the System Information Block (SIB). Moving apart from this zone, we can note that the color of the pixels turns from yellow to green. This zone is instead characterized by a consistent lower amount of received power, typically smaller than 5 [dB] compared to the maximum values. The lower utilization of the spectrum on the two sides of the control channel zone is likely due to a relatively low utilization of network resources used to serve other CPEs. This is an expected behavior for two main reasons: i) there are no other CPEs located close to the measurement point, and ii) the peak utilization of the FWA service typically occurs during evening and late evening hours, when most households customers access the Internet.
On the other hand, the waterfall diagram turns to yellow and bright yellow colors over the spectrum (except from the guard band) when traffic is injected to the CPE in proximity to the measurement location ( Fig. 11(b)) Interestingly, the analysis of spectrum usage reveals that the collected power samples are stronger than the ones collected without traffic, experiencing an increase of around 5-15 [dB] over all the usable spectrum extent. Additionally, the brighter colors in the central part indicate that the radio resources are preferentially assigned to data transfer starting from the center and then moving towards the right and left part of the spectrum.
The increase in received power upon generation of DL traffic is also confirmed by the metrics in Tab. 8. In particular, a strong increase of min/max/mean/median/mode received power is observed, while the standard deviation is kept unchanged. For example, the mean received power is increased of more than 13 [dB] when traffic is generated towards the CPE.

B. CODE SELECTIVE AND MAXIMUM POWER EXTRAPOLATION ANALYSIS
We initially run C3 over the considered Opnet frequencies.
Results, detailed in the Appendix for the sake of clarity, confirm the capability of the instrument to synchronize with the Opnet network, as well as the SA operation and TDD configuration shown in Tab. 2.
In the following step, we provide the signal information of Tab. 2 to chain C2, in order to extract the resource grid in use by the operator. Intuitively, the code domain analysis allows to decode the whole 5G radio frame, providing the received power for each RE of the subcarrier vs. symbol grid.
We then capture the resource grid in the following cases: i) traffic chain T inactive, ii) traffic chain T active. Fig. 12 reports the resource grid in the two conditions. Focusing first on the case without traffic generation ( Fig. 12(a)), we can note that the zones presenting the strongest RE power are (mostly) the ones carrying control information, like the SSB on the left and the SIB in the center. The remaining REs are typically transmitted at lower power, either in UL or in DL.
The situation is completely different when traffic is generated towards the measurement location, as shown in Fig. 12(b). In this case, the RE power is notably increased for those radio resources of PDSCH (as expected), which are used for data transfer in the DL direction. Obviously, the REs used in the uplink still exhibit low power, due to the fact that most of data packets are transferred from the server to the client in the DL, while the UL is mainly used for short (and less frequent) TCP ACKs.
In the following, we compute the power distribution of SSB and PDSCH, by adopting the procedure in Section IV-D to select the subset of REs and compute the median values P SSB RE and P PDSCH RE . Fig. 13 reports both power distributions and median pointers at the end of this step (with numerical values expanded in the caption for the sake of clarity).  Three considerations hold by analyzing the figure. First, the SSB distribution is narrower than the PDSCH one. This outcome is expected, as SSB includes signal information that is spread at a constant power value, while the power on the PDSCH REs is governed by the actual traffic levels that are experienced on the radio link at the measurement location. Second, the different spread between the two distributions also reflects the different modulation schemes adopted by control and traffic channels -QPSK and highcardinality QAM, respectively. Third, the median of PDSCH is close to the one of the SSB. This result could indicate a passive behaviour of the transmitting antenna, in which no beamforming (or a very light implementation of beamforming) is adopted. Eventually, the outcomes of Fig. 13 are confirmed by the metrics reported in the summary statistics reported in Tab. 9. In fact, despite PDSCH exhibits larger variability (in terms of minimum value, maximum value and standard deviation), the SSB is higher in terms of mean/median/mode power per resource element.
Given P SSB RE = −60.63 [dB] and P PDSCH RE = −62. 12 [dB], we then apply the procedure in Section IV-D to compute the total field E 5G , which resulted into 0.50 ± 0.08 [V/m] and 0.59 ± 0.09 [V/m] with a confidence level of 95% for SSB and PDSCH, respectively.

C. JOINT ANALYSIS
In the final part of our work, we compare the EMF measurements obtained using the following chains/methodologies: i) C1 with AT, with and without traffic, ii) C1 with RT recording, with and without traffic, iii) C2 with MPE extrapolation from SSB, and iv) C4 wide-band monitoring. Additionally, we supplement the measured EMF with simulated values, obtained by applying a free-space propagation model based on the output power counters provided by the operator. Specifically, Opnet provided the average output power from the considered sector during our experiments, with a granularity of 15 minutes. For each value of output power, we proceed as follows: 1) We calculate the received power at the measurement location, following the procedure outlined in [33], by taking into account the input parameters of the radiating antenna, the configuration of the panel (in terms of orientation, electrical and mechanical tilting, maximum gain, and radiation diagrams), and the 3D distance between the panel and the measurement location; 2) We calculate the electric field from the received power values, by assuming an isotropic receiving antenna. We refer interested readers to [33] for the equations used to calculate the electric field. Regarding the RT measurements, we note that the electric field strength is extracted from the received power samples of the spectrum by applying the antenna factor of the receiving antenna and the channel power computation of [14]. However, the power samples collected in real-time are measured using a peak detector, while the samples collected with AT in non-real-time are measured using a RMS detector. The former results in a consistent overestimation of the received power compared to the latter, mainly due to the fact that the peak-to-average power ratio is strongly influenced by the efficient modulation techniques used in 5G. To address this issue, the power samples collected in real-time are scaled by a 20 [dB] margin, which is set in accordance with previous work [12] tailored to the analysis of peak-to-average power levels of 5G signals.  For clarity, the measurements taken with AT and in RT are presented as average 5G exposure over the considered test. There are several key observations to make when analyzing the figure. Firstly, the exposure measured when generating traffic is higher than when there is no traffic (as expected). Secondly, the 5G FWA exposure estimated through the MPE approach is consistently higher than the exposure recorded with the C1 chain using AT in NRT and with RT measurements. Specifically, the MPE exposure from SSB is equal 0.59 [V/m], while the EMF recorded with the C1 chain is always lower than 0.4 [V/m]. This outcome confirms the effectiveness of the MPE approach in providing a strong upper bound for exposure levels. Additionally, the measured exposure with AT and with RT measurements are always lower than the simulated one. This is expected, as the total output power of the sector is also used to serve other CPEs that may request traffic during our experiments. Therefore, assuming that all the power is directed towards the measurement location introduces an upper bound on the exposure level. However, it is worth noting that there is an increase in exposure when passing from no traffic to traffic injected in the measurement location. This increase in exposure is evident in both the measured values and the simulated ones. Finally, the wide-band monitoring reveals that the 5G FWA exposure is a small share compared to the total exposure, which includes the sectors from other operators that radiate over the measurement location. These results further support our approach, which is based on selective measurements, to characterizing 5G FWA exposure.
Eventually, the relative small gap between narrow-band measurements and simulations shown in Fig. 14 also reveals that reflection effects, which may arise from the stadium dimensions, do not have a substantial impact on our assessment. We remind, in fact, that the numerical evaluation of [33] is based on a simple model that does not account for any reflection coefficient. In addition, the reflection effect is minimized on the measurement side, by: i) always ensuring a non-negligible height above ground of the measurement antennas, and ii) placing the measurement antennas far from metallic rolled sections / elements / structures -which may greatly amplify the reflection effects.

VII. CONCLUSION AND FUTURE WORKS
In this work, we have focused on assessing the EMF and throughput in a 5G SA deployment providing FWA service over mid-bands. By understanding the main features of the 5G FWA service, we designed and evaluated a measurement framework composed of four independent chains, which are supported by an additional chain for traffic generation. Additionally, we implemented both AT-based and MPE-based measurement methodologies to characterize the impact of traffic on the exposure, as well as the maximum exposure levels. Furthermore, we complemented our analysis by evaluating the simulated exposure from the power counters collected by the considered sector, as well as the total exposure radiated by other technologies/services.
Our results, collected from several measurements performed in a baseball stadium in close proximity to a raw-land installation, reveal that the 5G FWA exposure is always very low, even when traffic is injected towards the measurement location. Additionally, this work confirms the suitability of MPE approaches to introduce an upper bound for 5G FWA service operating on a standalone network. Furthermore, a good match was found between the simulated exposure and the measured one. We also observed a good stability in both throughput and exposure level across different tests. Finally, 5G FWA exposure always represents a small share compared to other sources (like 4G ones).
We believe that our findings provide valuable insights for the development of 5G FWA service. However, there are several areas of research that could be further explored in the future. Firstly, we plan to expand our evaluations to different locations, including Non-Line of Sight (NLOS) environments and locations further away from the serving sector. Additionally, we aim to study the combined impact of DL exposure from the gNB and the UL one from the CPE, which represents another source of exposure. Moreover, we plan to integrate in our assessment network-based performance indicators, including packet delays and packet losses. Finally, we aim to investigate the effect of exposure near the base station when multiple CPEs simultaneously request high levels of traffic. Fig. 15 reports a screenshot from the laptop controlling the network scanner. Interestingly, the figure proves the capability of the scanner to synchronize with the Opnet sector, a new feature that was tested in the considered SA deployment. In addition, the figure reports decoded parameters that confirm the setting made available by the operator in Tab. 2, particularly regarding SA capability and TDD configuration (matching the F TDC factor of Tab. 2).