1Two emitters, two geometries

A small unmanned aircraft flown over a radio link is a pair of radios. The controller sends a narrow, low-duty-cycle uplink. The aircraft returns a wide, high-duty-cycle video downlink. They occupy the same bands and belong to the same system, and for the purpose of finding the person flying they differ in every property that matters.

A scanning detector sold as a drone-band monitor is the least expensive sensor for the band, and it detects traffic. What it cannot do is report how much it missed: section 2 shows that such a receiver hears a hopping link about one percent of the time, so what it reports is a sparse and unrepeatable sample of the traffic, and an operator cannot tell a quiet sky from a missed one. Adding receivers does not change the fraction: three receivers each hearing the band one percent of the time are still hearing it one percent of the time, and the false alarms triple. The constraint is neither sensitivity nor channel count. It is coincidence, and coincidence can be computed. Figure 1 draws the two links.

Figure 1 is the difficulty in one picture. The aircraft is in clear air with a quasi-omnidirectional antenna, transmitting tens of megahertz at high duty cycle. The controller is a meter and a half above the ground, behind whatever the ground has on it, with an antenna pointed at the aircraft rather than at the sensor, transmitting a short slot.

There is a third emission, and it is the easiest of all: the mandated Remote ID broadcast. Under ASTM F3411 and 14 CFR Part 89 a compliant aircraft transmits its identity, its position and its control station position in the clear over Bluetooth or Wi-Fi, at least once per second. The European requirement under Regulation (EU) 2019/945 is equivalent and explicitly names the remote pilot's position. That broadcast is designed to be received by anyone, and by construction it is present only on aircraft whose operators chose to comply.

2Why detection is a timing problem, not a sensitivity problem

Control links hop. Regulation requires it: a frequency-hopping device in the 2.4 GHz band must use at least fifteen channels and may not occupy any one of them for more than 0.4 seconds within a defined period. The practical result is a set of emitters that are on a given frequency for a millisecond or less at a time.

Table 1 gives representative figures for the link classes a sensor meets.

Set a scanning receiver against that. If it covers a hop band of width B_h in steps of its instantaneous bandwidth B_i, dwelling d at each step with a retune time t_r, its revisit period is the product of the number of steps and the time per step. The probability of catching any one burst is the fraction of the revisit period during which the dwell and the burst overlap by at least the detector's minimum observation:

Detection over many bursts follows a geometric law, so the number of bursts needed for ninety percent confidence is the log of one tenth over the log of one minus the single-burst probability. Working that through for a 645 microsecond identification burst repeating every 600 milliseconds gives the numbers in Table 2.

There is a second, quieter penalty, and it carries a condition. A scanner observes any given channel for only the fraction of wall-clock time given by dwell over revisit. For a detector that integrates energy over the whole revisit period, it forfeits ten times the logarithm of that ratio in sensitivity: for the narrow scanner in Table 2 that is 20 dB, which at the free-space path-loss exponent is a factor of ten in range. A burst that falls entirely inside the dwell suffers no such penalty; the scanner's problem with that burst is the one percent chance of being tuned there when it arrives. Under integrating detection the scanning receiver is slower and 20 dB less sensitive at once.

Figure 2 shows where the twenty decibels go. Both the scanner's marks and the link's marks are sparse, and the receiver hears the link only where the two coincide, which for a narrow scanner is about one percent of wall-clock time. Figure 3 draws the time to ninety percent confidence against the receiver's instantaneous bandwidth, with the same dwell, retune and minimum observation as Table 2.

Sections 1 and 2 define a criterion, not yet a specification. Table 3 states it as four requirements a reader can score any receiver against; it is placed here so that it can be read with the derivation beside it.

Figure 4 is the band this paper is about. Read the spectrogram rather than the spectrum: the marks are short, they move, and none of them is where it was a moment ago, which is the whole of the detection problem in one picture. Note what the figure cannot prove. A max-hold trace and a spectrogram look much the same behind a fast swept receiver as behind a gap-free one, so R1 is not settled by a screenshot. It is settled by the published frame rate in R2, which is why that row carries a transform size.

3The link budget, and the asymmetry it creates

Free-space path loss sets the floor for both directions:

At 2.44 GHz that is 100.2 dB at one kilometer and 109.7 dB at three. At 5.8 GHz it is 7.5 dB worse at every range, which is one reason long-range control links migrate down to 900 MHz, where the same geometry costs 8.5 dB less than 2.4 GHz.

The asymmetry does not come from transmit power, which is similar at both ends and capped by the same rules. It comes from geometry. The aircraft path is essentially free space. The controller path leaves a transmitter a meter and a half above the ground, so beyond a crossover of roughly 1.5 kilometers the loss follows a fourth-power law rather than a square law, and urban clutter adds 20 to 35 dB on top. For a sensor budget allowing 127 dB of path loss, the aircraft is detectable to around twenty kilometers in clear air while the controller is detectable to about 1.4 kilometers through urban clutter. Figure 5 plots both.

Figure 5 plots both against a 127 dB budget. The crossing points are the whole planning problem: a sensor sited for the aircraft is not sited for the operator.

4Finding the operator

A bearing is not a position, and received power is not a range. The methods available differ by an order of magnitude in what they deliver, and two of the classical ones are structurally unsuited to hopping links. Table 4 sets them out.

For a phase interferometer the geometry sets both the accuracy and the ambiguity. Bearing follows from the phase difference across a baseline, and unambiguous coverage of the hemisphere requires the baseline to be no more than half a wavelength:

The tension is immediate. A half-meter baseline at 2.44 GHz gives about 0.2 degrees of bearing accuracy at 20 dB signal to noise, and eight ambiguous bearings across the hemisphere, one for every half wavelength of baseline. Resolving them takes a ladder of baselines, the shortest at half a wavelength and the longest to refine, which is why direction-finding systems use arrays rather than pairs.

Whatever produces the bearing, two bearings produce a fix, and the error follows from range and cut angle. Cross-range error is range times bearing error: three degrees at two kilometers is 105 meters. Taking circular error probable as 0.5887 times the sum of the two semi-axes, two such bearings crossing at right angles give about 124 meters. The same two bearings crossing at twenty-five degrees stretch the ellipse to 343 by 76 meters and give 247, with no change in the sensors at all. Figure 6 plots the whole curve.

Figure 6 is the site-selection argument in one curve. Time-difference methods trade the bearing problem for a timing problem, and the conversion is simple: one nanosecond is thirty centimeters. The estimator floor for a 645 microsecond burst across 10 MHz at 10 dB signal to noise is about 0.15 nanoseconds, which is four and a half centimeters, and field systems do not reach it. Real accuracy is set by inter-site clock synchronization, 10 to 50 nanoseconds for a satellite-disciplined oscillator, and by multipath leading-edge bias in urban settings, which is a bias rather than noise and therefore does not average away.

Figure 7 is the front-end requirement rather than the answer: every method in Table 4 below the first two rows needs the same burst, captured coherently and timestamped.

5The legal boundary, which is also a design boundary

Radio detection of unmanned aircraft is lawful. Demodulating the communications those aircraft carry generally is not, and a system specification should state the distinction.

In United States law the Wiretap Act turns on contents, meaning information concerning the substance, purport or meaning of a communication (18 U.S.C. § 2510(8)). The existence of an emission, its center frequency, its bandwidth, its timing, its hop pattern, its amplitude, its phase and its bearing are none of those things. A further provision withholds the protection of ready public accessibility from communications sent using modulation whose essential parameters have been withheld from the public (§ 2510(16)), which means a proprietary drone link can be legally protected even though it carries no encryption. Unencrypted is not the same as lawful to decode.

There is one clean exception, and it is worth designing around. The mandated Remote ID broadcast is required by regulation to be open, documented and receivable by the general public, so a sensor may decode it. Its second use is less obvious and more valuable: correlating Remote ID against the non-cooperative detections lets a system suppress compliant traffic from the alert stream, so the one aircraft that did not announce itself is not buried under the dozens that did.

6Measurement practice

1. Detect on the downlink, then cue onto the uplink. The downlink gives early warning cheaply. Finding the operator needs a longer dwell and more antenna gain pointed at a quieter, lower emitter; the option 35 active directional antenna published for the ICX-FieldHawk line covers 0.5 to 10 GHz, with under 5 dBi of gain with its amplifier off and under 25 dBi with it on.
2. Do not set a detection threshold on a max-hold trace, in SpectraCore or in any other software. Max hold discards the underlying statistics, so a constant-false-alarm threshold computed against it has no characterizable false-alarm probability.
3. Use an order-statistic false-alarm threshold, not a cell average. The 2.4 GHz reference window is full of interferers, and cell averaging collapses in their presence.
4. Confirm before declaring. A per-burst false-classification rate of one in a thousand, confirmed four times in ten opportunities, gives a track false-alarm rate around two in ten billion. Confirmation buys seven orders of magnitude for a few hundred milliseconds of latency.
5. Survey the site before trusting a bearing. Every reflector within a few hundred meters is a competing arrival, and interferometric bearing error in dense clutter is five to twenty degrees regardless of the array.

Field evidence

Two things show up in deployment that the arithmetic above does not predict. The first is siting. Sensors placed for the aircraft are mounted high and clear, and the same mast is the worst place from which to hear a controller a meter and a half off the ground behind a building line, so an installation that detects well and geolocates badly is a recurring outcome. The second is clutter, and it lands at the top of Table 4's urban range rather than the middle: sites with metal-clad buildings inside two hundred meters are at the fifteen-degree end, which at two kilometers is the difference between a street and a district. Both are geometry problems, and both cost less to fix before the mast goes up than after.

7Where radio detection is blind

Radio detection has blind spots, and a specification that states them is the one a buyer can plan against. Table 5 sets the modalities against the threat modes.

Fiber-tethered aircraft deserve their own sentence. Spools of ten to twenty kilometers are now fielded, and the control and video links run on glass. There is no emission to detect, at any sensitivity, at any bandwidth. A radio sensor is one layer of a system that pairs radio for cue and operator geolocation with radar for track and electro-optics for identification.

Cutting the false-alarm rate with an existing decoder

A false alarm on a cooperative aircraft costs operator attention. Cooperative aircraft announce themselves continuously on 1090 MHz, and the same receiver that watches the control bands can decode that broadcast to an aircraft address, callsign, altitude and position. A track correlating with a decoded 1090ES report is cooperative traffic and can be suppressed before an operator sees it; a track with no such report stays a candidate. Watching 1090 MHz costs tuner time, and a second channel if it has to run while the control bands are being watched. No other hardware is needed: with the -SDR option, the ICX-FieldHawk presents itself through SoapySDR, the vendor-neutral hardware abstraction layer, the ADS-B 1090ES chain is one of the six documented in the SDR Integration Handbook, and an existing GNU Radio decoder runs against the instrument with its calibration already applied to the samples, while SpectraCore and every standard measurement function stay installed. Figure 8 draws where the decoder attaches.

Figure 8 draws the attachment point. The fourth layer is what distinguishes this from a development board: the calibration files install with the driver, so the flowgraph above is handed a measurement rather than samples.

8Summary, definitions and further reading

Table 6 collects the governing relations and published values with their conditions.

Circular error probable

The radius of the circle, centered on the estimate, containing the true position half the time.

Probability of intercept

The minimum duration a signal must be present for the analyzer to measure its amplitude correctly. A stronger claim than the duration required merely to detect it.

Remote ID

A mandated broadcast identifying an unmanned aircraft, its position and its control station, sent in the clear.

Further reading

• ASTM F3411-22a, Remote ID and Tracking, and 14 CFR Part 89 §§ 89.305 and 89.315.
• Commission Delegated Regulation (EU) 2019/945, Annex Parts 2 to 4 and 6.
• 47 CFR § 15.247, the frequency-hopping rules for the 2.4 GHz band.
• 18 U.S.C. §§ 2510 and 2511, the definitions and prohibitions of the Wiretap Act.
• FAA, DOJ, FCC and DHS, Advisory on the Application of Federal Laws to the Acquisition and Use of Technology to Detect and Mitigate Unmanned Aircraft Systems, August 2020.
• D. J. Torrieri, "Statistical theory of passive location systems," IEEE Trans. Aerospace and Electronic Systems, vol. AES-20, no. 2, 1984.
• Berkeley Nucleonics, the ICX -SDR option datasheet and the SDR Integration Handbook (ICX-FieldHawk), berkeleynucleonics.com.

If you are specifying a sensing layer and want the intercept and link-budget arithmetic run against your own site geometry, our application engineers would be glad to help.