Figure 121: Broadcast FM Stations

BC4 107.5 MHz Large Grid BC5 107.8 MHz Small Grid Figure 121: Broadcast FM Stations Page 195

This document is the exclusive property of Agilent Technologies UK Limited and cannot be reproduced without the written agreement of 8.11.9.6 Pirate FM Two of the five broadcast FM signals exhibited significant measurement to measurement variations. In some measurements, the direction indicated appeared correct, in others, two directions were indicated as shown in Figure 122 BC2 106.8 MHz BC3 107.3 MHz Figure 122 Results indicate one, sometimes two signals The spectrum measurements for both of these signals showed that the fluctuations were caused by another spectrally overlapping signal. Spectrums for BC3 are shown in Figure 123 below. The spectrums are computed from data simultaneously captured over the same 0.25 second interval at all sensor locations. With time-synchronization, and allowing for propagation, the spectrums of these broadcast signals should look nearly identical at each sensor, even if they look different from measurement to measurement due to changes in the radio station s content from one second to the next. Page 196

What is immediately obvious in the spectrums is asymmetry. Most of the sensors do not have the symmetrical spectrums expected with FM modulation. Sensor 1 is most affected with the desired signal completely hidden in what appeared to be the skirts of a stronger station at a higher frequency. The station was identified as a pirate radio station transmitting on 107.4 MHz. The pirate signal is evident in all of the spectrums to various degrees, the least impacted being Sensor 3. These spectral plots demonstrate how time-synchronized measurements from a network of receivers can provide insight into transmitter s location and coverage. Note: The fluctuation in the indicated directions (Figure 122) were most likely the result of changes in the instantaneous bandwidths of the legal and pirate stations corresponding to the station s content (voice, music, dead air, etc). For example, if the bandwidth of the pirate station was low (dead air), then very little energy would have been detected by the sensor receiver tuned to the legal station s assigned channel. Figure 145: Instantaneous Spectrums for 107.3MHz Page 197

240 meters This document is the exclusive property of Agilent Technologies UK Limited and cannot be reproduced without the written agreement of Having established the cause of the fluctuations, the system was tuned to the pirate radio station s frequency of 107.4 MHz. The actual location of the station as reported by Ofcom is indicated by tower icon in Figure 124 below. The measurement was accurate to 240 meters. While not part of the original trial objectives, these measurements demonstrate the usefulness of a sensor network in detecting and locating signals under real-world conditions where the signals may be weak and may overlap with other signals. Figure 124: Accurate Location of a Pirate Radio Station at 107.4 MHz Page 198

8.11.9.7 Pirate Radio Station Detection In central London, FM band signal detection is limited by the presence of other signals, not by receiver noise. As shown in Figure 125, the pirate radio station s signal is well above legal broadcast at Sensor 1 (900m). Power levels are comparable to (stronger) legal broadcast stations for sensors at distances ranging from 3 to 4.4 km. While the signal is not detectable at 7.4 km (Sensor 3) other results suggest that detection at this range is possible. A sensor at 20m elevation at a distance of 5-6 km (~10 km sensor spacing) would reliably detect this specific signal. The signal s power would appear lower than for legal stations (worst case), but remain above the legal stations skirt s (assuming the pirate station is transmitting on a frequency between legal stations). Sensor Distance from Pirate TX 1 900 meters 2 4 km 3 7.4 km 4 4.4 km 5 3 km 7 3.2 km Table 8.10: Sensor Distance from TX Pirate Pirate Figure 125: Simultaneous Spectrums Left: Small-Grid Spectrums, 1MHz Bandwidth Centred at 107.5 MHz Right: Large-Grid Spectrums, 100 khz Bandwidth Centred at 107.3 MHz Page 199

8.11.10 MOB 1 GSM 940 MHz While location results are reported for these GSM base-station frequencies, the results have not been verified and may be inaccurate because of the potential for correlation between signals originating from different locations. This situation occurs when two different base stations transmit the same mid-amble (as well as start and stop bits) on the same frequency at nearly the same time. The time intervals used in the measurement were reduced to slightly more than one burst to minimize the chances of this occurring. Figure 126: MOB1 (GSM) The cross-correlation results for these measurements strongly suggest that correlation between signals from different transmitters did occur. Multiple correlation peaks are visible in the two correlation plots in Figure 127 below. For a pair of sensors, the maximum theoretical TDOA is determined by the distance between the sensors, reflecting Page 200

the amount of time it would take for a signal to travel from one sensor to the other. The maximum TDOA result can be exceeded only when a signal does not follow a line-of-site path, or when signals from different sources correlate. Sensors 1 and 7 are 2.7 km apart setting the maximum TDOA at +/-9 usec.. Similarly, sensors 4 and 7 are 1.5 km apart, giving a maximum TDOA of +/-5 usec. Not only are there several well defined peaks outside of this range in both correlation plots, but the largest signal by far in the cross-correlation data for sensors 1 and 7 is well outside of this range at -48 usec. This can occur when the two transmitters, close to the two sensors correlate more strongly than a single transmitter located near one sensor, but received weakly at the second, more distant second sensor. The problem is made even more challenging by the sectored antennas used in GSM networks. Figure 127: GSM 940 MHz Correlations with Max Theoretical TDOA Page 201

One potential solution to the problem of signals correlating to other signals with common elements is to increase the sensor density to something more closely approaching the density of the transmitters. In the following map from Ofcom, 176 GSM base stations are indicated in an area smaller than that defined by the five-sensor network. By increasing sensor densities, the correlation power of a single transmitter can be increased relative to the correlation power between transmitters. Figure 128: Base Stations in Central London A number of measurements were made at for off-air GSM signals, each produced a different result (as shown in Figure 129 below), and each equally suspect because of the correlation between signals from multiple base stations. In this particular measurement, for example, a base-station is obviously close to Sensor 1 based simply on the power Page 202

in the time plot, yet location result suggests an emitter near Sensor 5. The correlation data for the Sensor 1-5 pairing also suggests a signal that is closer to sensor 5 than to sensor 1 (based on the centre peak being slightly to the right of centre (positive delay) and noting from the plot label the order in which the correlation computation was performed (Sensor 1 Sensor 5). Figure 129: MOB1 940 MHz, Location, Correlation and Time Plots Page 203

8.11.11 MOB2 GSM The issues noted for GSM at 940 MHz also apply to GSM at 1850 MHz. The only notable difference between MOB1 and MOB2 measurements are power levels. The correlation power levels at 1850 MHz signal were typically 20 db lower than at 940 MHz. As with 940 MHz, multiple correlation peaks are visible in this measurement at 1850.2 MHz Figure 130: GSM 1850.2 MHz Location and Correlation Page 204

Multiple transmitters are also obvious as different burst alignments at each of the five sensors as shown in Figure 131. Sensors 1, 5 and 7 show data that could be from the same transmitter, Figure 131: GSM 1850.2 MHz Time Data Page 205

8.11.12 UMTS 2122.5 MHz The spectrum data in Figure 132 clearly indicates strong UMTS signals at all five sensors. Given the frequency and the signal type, this is obviously the result of each sensor being near one or more UMTS transmitters. Figure 132: 5 MHz UMTS Spectrum The receiver bandwidth was set at 2 MHz to isolate the signal and to broaden the correlation peaks, making them easier to detect. As with the GSM signal, the UMTS signal includes signal components that are common between transmitters. These include codes that a mobile will use to synchronize to the base station. Locations indicated in Figure 155 below were not verified, so it is not known if they represent UMTS transmitter locations, multipath, or correlations between multiple UMTS transmitters with fixed time offsets between synchronization codes. Page 206

Figure 133: UMTS locations and correlations with 2 MHz bandwidth centred at 2122.5 MHz Further reducing the receiver bandwidth to 1 MHz produced the results in Figure 134. In this result, most of the correlation peaks are where they would be expected to be based on sensor spacing. The largest peak is still an outlier at -105 usec indicating correlation between signals from different transmitters. Page 207

Figure 134: UMTS locations and correlations with 1 MHz bandwidth centred at 2122.5 MHz Page 208

8.11.13 Bonus Signal The results in Figure 135 are for an unidentified signal at a frequency near 2.8 GHz. The receiver bandwidth was 1 MHz The burst patterns visible in the time data and the indicated direction suggest this could be an S-Band RADAR signal originating at Heathrow Airport. Note: Only three sensors were used in this measurement. LHR Figure 135: Possible Radar signal with Time and Correlation Data Page 209

8.12 Conclusions and Recommendations The following section provides conclusions and recommendations for future work and potential deployment of a network of AMS units. 8.12.1 Signal Detection Traditional non-coherent detection using receivers and antennas with parameters such as noise figure and gain are well understood. As the TDOA network is a network of coherent receivers, coherent detection methods were also explored. With antennas, transmit locations, receive locations, receiver performance and all other parameters held constant, coherent detection was shown to have a significant sensitivity advantage over non-coherent detection, potentially requiring fewer sensors. While there are many other factors to consider, coherent detection may be appropriate for some applications. In general, industry standard propagation models were accurate enough for a first-pass approach to planning systems using either coherent, or non-coherent detection. However, as the results for 919 MHz demonstrated, propagation studies should be conducted for deploying large numbers of sensors in a specific environment, especially for critical applications. Industry standard propagation models such as the Hata model predict mean path loss. In both the pre-trial propagation measurements, and in the measurements of test signals during the trial, power was often 10 to 20 db higher or lower than the predicted mean value. The pathlost distribution should be considered when establishing senor densities. Page 210

8.12.2 TDOA Based Geolocation In this trial we have established how signal strength, signal bandwidth, multipath and sensor densities affect and limit geolocation accuracy in Central London. We have also demonstrated the ability for TDOA systems to locate a wide range of signals under real-world conditions including AM, FM, TV, PMR and cellular. Results and Observations 1. For greatest TDOA accuracy in high multipath environments, sensor densities should be sufficient to allow a minimum of four, and preferably five or more sensors to contribute to geolocation measurements. Sensor deployment densities and algorithms which limit geolocation computations to the theoretical minimum of three sensors should not be considered for urban deployment. 2. The impact of multipath on TDOA accuracy is likely to be far greater than sensor timing accuracy or sensor deployment geometry for signals within the geographic area defined by sensors. Sensors do not need to have picosecond timing accuracy, nor do they need to be precisely placed. There is no evidence in the trial data to suggest that system accuracy will be impacted if a sensor is moved a few hundred meters for logistical reasons. 3. The Mean Cross-Correlation SNR (MXSNR) proved useful as a composite measure of system sensitivity as related to TDOA geolocation accuracy. The following recommendations are based measured results. For narrowband signals such as AM or NBFM, MXSNR should exceed 42 db as a necessary (but not sufficient) condition for accuracies better than 500 meters. For accuracies of 1000 meters, MXSNR can be relaxed to 37 db. For a point of reference. The trial system, with wire-discone antennas and sensor input noise densities of -151 dbm/hz, recorded MXSNR values between 40 and 90 db for the fixed-location PMR signals. MXSNR s as low as 19 db were recorded for PMR stations that appeared to be mobile. MXSNR requirements decrease with signal bandwidth. For the GSM signal, 17 db is suggested for 500m accuracy. MXSNR is computed over the number of correlations used in a result. For narrowband signals, the greatest accuracies were achieved when 6-10 cross correlations were used in the Page 211

geolocation computation. For wider bandwidth signals, more than six correlation pairs produced little, if any improvement in accuracy. Sensor densities should produced the recommended MXSNR for at least 6 correlation pairs. 4. The trial results do not suggest that Sensor 5, located on the taller Ofcom building, contributed more to improved accuracy than other sensors at lower elevations. Without a compelling argument for using taller buildings, it is recommended that they be generally avoided to minimize the risk of inter-modulation distortion and overload resulting from the transmitters that are often found on taller buildings. 5. The sensor network s ability to locate cellular base stations may have been degraded by the presence of synchronization signals in the base station signals (e.g. the GSM midamble). The cross-correlations produced multiple correlation peaks between synchronization signals from different transmitters on the same frequency, but in different cells. These peaks were stronger than the correlation peaks for any one signal received at multiple sites. For this application, more advanced algorithms and much higher sensor densities are likely to be required. 6. The sensor network proved quite capable of locating, or indicating the direction of broadcast signals, including broadcast by pirate FM radio stations. Two of TV broadcast signals were not accurately located, and a root cause was not discovered. Further study of these results are recommended. 7. If pirate radio stations tend to occur more frequently in some areas than in others, a non-uniform sensor deployment should be considered as a method for improving system performance and lowering deployment costs. 8. The demonstrated accuracy using the 169 MHz NBFM test signal 169 MHz was 1 km for 54% of the results. 25% of the measurements were accurate to 500m. The demonstrated accuracy for the GSM test signal was 750m for 60% of the measurements.42% of the measurements were accurate to 500m. As predictors of sensor an operation sensor network in Central London, these numbers are conservative. For example, NBFM signals will often have wider signal bandwidths, higher radiated powers, and will not be transmitted from street level. The off-air PMR measurements demonstrated that under better conditions (more power and higher elevation transmitters), greater accuracy is achievable. Page 212

8.12.3 Sensor Density 8.12.3.1 Sensor Density Overview The sensor performance requirements and deployment densities required in an urban environment will vary by application. Factors that affect sensor requirements include Frequency Coverage Signal Bandwidth Transmitter Elevation Transmitter Power Transmitter Density Transmitter Frequency reuse Potential for signal correlation with co-channel signals Geolocation accuracy requirements Sensor Locations and Elevations Sensor antenna(s) Sensor RF Performance The trial system employed 1.5-4.7 km sensor spacing. The system was well suited to some of the test signals, but not for others. For example, at 919 MHz the system was quite capable of locating the GSM signal with 200 khz bandwidth, but struggled to locate the 2 MHz QAM signal at the same frequency and power, using the same antenna from the same location. The system performed well with PMR Base and Broadcast FM signals. Under normal conditions, the sensor spacing could be increased relative to the spacing used during the trial for broadcast applications, however, the densities available in the test system were a contributing factor in the ability of the system separate the pirate radio station from the broadcast signals. Sensor densities used in this trial were not adequate for locating cellular base stations. This application requires further study to determine, for different cellular technologies, the maximum spacing relative to GSM and UMTS cell sizes. Strategies for dealing with correlating signals from multiple emitters should also be investigated. Sensor spacing requirements are influenced by the signal (modulation, power, location), by the environment (rural or urban), the presence of other signals, and by the sensor properties (location, antenna gain, feed lines, receiver sensitivity, etc). This trial was designed so that sensor performance was not best in class. This Page 213

was intentional as a system with optimally-placed, high-performance components would be cost prohibitive. Instead, inexpensive wirediscone antennas were installed, pre-selectors were avoided, and low-noise amplifiers disabled. Unless otherwise noted, in the sensor spacing recommendations that follow it is assumed that receiver and antenna performance, and antenna placement will be comparable to the trial system. Clearly, the costs of an RF sensor network must be justified in the context of realized benefits for one or more specific applications, such as managing PMR spectrum. For this reason, application specific antennas should be considered in addition to general coverage antennas as a way of boosting system performance or relaxing sensor spacing requirements. Sensors are not limited to a single antenna, nor are all sensor sites required to have the same compliment of antennas. 8.12.3.2 Sensor Densities for Broadcast and Pirate Radio To detect pirate radio stations in London a sensor grid employing a 10 km grid spacing is recommended. At this spacing the maximum distance to a pirate station is less than 6 km ensuring reliable detection of 10W stations at 20m elevation using transmit frequencies between legal stations. This spacing is based on noncoherent detection methods. Coherent detection will not provide an advantage in this application where sensitivity is interference limited. To locate a pirate radio station in London, a sensor grid employing a maximum of 5 km grid spacing is recommended. Areas which are more prone to pirate radio stations should have localized sensor spacing of 3-4 km. Alternatively, a mobile sensor may be temporarily deployed in the general vicinity of a pirate station, increasing MXSNR and the number of correlation pairs used to geolocate the signal. There are many highly variable factors which will influence geolocation accuracy for pirate radio stations: Multipath, interference from other stations, deviation, power levels and transmit antenna heights. While the radiated power for the WBFM test signal proved too low for reliable geolocation (50% < 1250 meters), accuracies better than 750m were obtained in 50% of the measurements where MXSNR exceeded 10dB. The maximum sensor power observed at the receiver input for the WBFM test signal at 83 MHz was -76 dbm with the test transmitter at a distance of 984m. By comparison, at a similar distance to a sensor, the pirate station received power at 107.4 MHz was found to be 35 db higher. While the test signal accuracy was limited by noise Page 214

and multipath, the pirate radio station geolocation accuracy was limited by the presence of other signals and multipath. 8.12.3.3 Sensor Densities for PMR Base Station Using the same broadband antennas, feed lines, deployment heights and receivers, a sensor spacing of 12 km is recommended for noncoherent detection of PMR signals with transmit frequencies below 500 MHz. A spacing of 4-8 km is recommended for TDOA-based geolocation. The spacing implemented should be closer to 4km for greater reliability in locating the lower-power PMR transmitters. All of the fixed-pmr stations below 500 MHz were detected with mean signal-to-noise ratios exceeding 35 db. Most exceeded 43 db, a value far in excess the minimum required. While most of the stations were strong, the weakest station ultimately limits sensor spacing. In this trial, the 2W British Museum transmitter reported an adequate MSNR, but this one example was also close to one of the sensors. Sensor spacing can be increased from those used in the trial to 12km At this spacing non-coherent detection is possible for lowpower transmitters using gain antennas from elevated locations. Results demonstrate that TDOA-based geolocation accuracy is improved for PMR signals when 6-10 cross-correlations are used. These narrowband signals also require higher SNR s to achieve accurate results. Of the fifteen off-air PMR signals that appeared to be from fixed transmitters, nine were located to within 500 meters (Table 8.9) indicating sufficient signal to noise. All of the off-air PMR measurements accurate to better than 1km reported XSNR s exceeding 63 db. Based on test-signal results, XSNR s greater than 42dB were indicated as a requirement for 500 meter accuracy leading to the conclusion that sensor densities can be relaxed from those used in the trial. The recommended 4-8 km sensor spacing is based on: off-air and test-signal results, channel models, and the need for 6-10 usable cross-correlation results (4-5 sensors). 8.12.3.4 Sensor Densities for PMR Mobile Station For a 10W EIRP mobile transmitting NBFM at 450 MHz, the recommend sensor spacing is 3km with the condition that antenna gain and feed line loss combine to greater than 0 db net gain. Spacing can be increased to 4km with a 5dB net gain in sensitivity. Test-signal results were used to establish the recommended spacing. The primary driver for the dense spacing is the high XSNR requirements for narrowband signals combined with higher path losses from street level. Page 215

8.12.3.5 Sensor Density Summary Two coverage areas are defined for the purpose of illustrating the number of sensors that may be required. The Inner London area corresponds to a circular area with a radius of ~13 km. The Greater London area is also circular with a radius of ~23 km, corresponding roughly to the radius of the circle formed by the M25. Table 8.11 reports the number of sensors as computed using equation 8.13. For the Inner London area, actual sensor counts are likely to be a little higher based on geometry and available sites. For the Greater London area, sensor counts may be lower based on propagation in regions outside of Inner London. These regions were not studied in this trial. Area Pirate Detection Pirate Location PMR Base Detection PMR Base Location PMR Mobile Location Sensor Spacing * 10km 5 km 12 km 4-8km 3-4 km # Sensors: Inner London: 600 km2 # Sensors : Greater London: 1600 km2 7 28 5 11-43 43-77 18 74 13 29-115 115-205 Table: 9.11 Approximate number of Sensors Required FM and PMR (PMR < 500 MHz) * Based on Central London Propagation Characteristics In a well designed sensor network, sensor densities will not be constant. They will vary based on region specific propagation, and on the application. They are also likely to increase with time. A sensor grid deployed with 6 km spacing initially may be later infilled in some areas to obtain 3 km spacing. Mobile sensors should be considered for temporarily increasing sensor densities. During the trial, Sensor 2 was moved to a new location, powered with a generator, and connected via a wireless network. Placing even one sensor near a signal of interest can greatly increase system sensitivity for that signal. Page 216

8.12.4 RF Performance The performance parameters for an RF sensor are generally the same as for any off-air monitoring receiver. The key differences are in emphasis. For example, sensor density can be increased to compensate for lower sensitivity. Distortion performance may be less of a concern with lower gain antennas mounted at lower elevations, and away from building-top transmitters. Phase noise performance requirements are increased to allow coherent processing of signals from multiple receivers. 8.12.5 Size/Mounting For high frequency coverage, it is desirable to have the sensor mounted close to the antenna for minimum feed line loss. For installation in large numbers, the physical size of the sensor should be small, it should also support mounting on a wide range of existing infrastructure e.g. existing antenna masts, walls, railings etc.. 8.12.6 Antennas and Filters To simplify installation the antenna should be physically small. The receiver should be capable of switching between two antennas for frequency coverage or diversity. 8.12.7 Network and VPN Performance Sensor networks require modest but robust networking. The bandwidth requirement is relatively low by modern standards but failure of a network connection can significantly impact performance. For low sensor densities, the loss of a sensor could result in the minimum of three sensors no longer being available. For higher sensor densities the impact will most likely be reduced location performance. VPNs have many advantages including security and the ability to use private address ranges etc. VPNs can however result in significant issues when the communication link is less reliable. If the link drops-out then the VPN must reliably detect this and automatically re-establish. Agilent experienced that some equipment did not reliably do this. The bandwidth requirements of a remote AMS is relatively modest and easy achievable with low-cost and widely available technology such as ADSL. The trial demonstrated that sensors can operate successfully over 3G connections. However just like ADSL performance is dependant Page 217

upon the network operator. Significant differences in data rates though the day were experienced between Vodafone and T-mobile at the same site with a good signal reported from both networks 8.12.8 Summary The trial TDOA system deployed in Central London was shown to be effective in detecting and locating a wide variety of test and off-air signals. The trial was comprehensive in its coverage of signal types and power levels, sensor quantity, sensor spacing and geolocation geometries. The TDOA system did not conclusively demonstrate an ability to locate cellular base stations. While measurements were made, and locations plotted, locations were not verified. Further analysis of the results also showed that correlations between synchronization signals from different base stations could interfere with TDOA estimates. Increased sensor density and/or more advanced algorithms may be required for this application. TDOA accuracy was ultimately limited by multipath. However, accuracies significantly improved when multipath effects were overcome by combining results from four and five sensors. Sensor deployment densities and algorithms which limit geolocation computations to the theoretical minimum of three sensors should not be considered for urban deployment. The trial demonstrated the feasibility of deploying sensor networks in Central London. The existing networking infrastructure, while far from perfect, was usable in a temporary installation, and could be made reliable in a permanent installation. Given the small, nonradiating antennas, and minimal amount of hardware and cabling, building owners and managers were generally agreeable and accommodating. 8.12.9 Recommendations The trial has confirmed that a AMS Sensor networks can operate in an urban environment and from this the main recommendation would be a initial deployment of operational sensors across a city such as Central London. A uniform spacing of sensors is neither required nor recommend in the initial deployment. Using receivers and antennas with performance similar to those used in the trial, an initial deployment spacing of 6 km with 3km spacing in some critical areas would provide monitoring and TDOA-based geolocation coverage for a number of applications. Page 218