EMF safety and RF exposure measurement

1What a compliance survey has to survive

The deliverable is a document saying, with a signature on it, that a location is below a published exposure limit. A rooftop, a tower base, a schoolyard sixty meters from a macro cell. Someone who wants it to be wrong will read it.

Three things go wrong and only one is an instrument fault. Max-hold on a burst without duty correction over-reads by 10 log(1/δ), where δ is the duty cycle: 30 dB on a radar at one part in a thousand. A cable loss read at the wrong frequency row loses 2.4 dB. And most often the survey answers the wrong question.

That last failure is the subject here, because it does not look like one. Instrument calibrated, operator careful, every number traceable, and the answer still low by several hundredfold.

2What is limited, and by which quantity

Standards work in two layers. Basic restrictions, the dosimetric reference limits of IEEE C95.1-2019, are in-body quantities not measurable in the field: whole-body average SAR over 30 minutes, local SAR in a 10 g cube over 6, absorbed surface power density above 6 GHz. Reference levels are external field quantities derived conservatively from them, and are what a survey measures.

A template written for the 1998 guidelines is therefore wrong twice over. The whole-body window moved from 6 minutes to 30, and a higher local-exposure surface appeared where none existed. Neither error is visible in the final percentage.

3From a receiver reading to a field strength

In the far field E and H are locked together by the impedance of free space, so power density follows from either alone:

Equation (1) is illegal in the reactive near field, where a power-density readout reports a quantity that does not exist. One check to carry: √3770 is 61.4 V/m, exactly the FCC occupational limit from 30 to 300 MHz.

Figure 1 shows where each term enters. Written out, the chain is:

Antenna factor is the ratio of incident field strength to the voltage across a 50 Ω load, a property of the terminated antenna. With the aperture relation, equation (1) gives the identity every certificate implies:

Check it: a half-wave dipole at 100 MHz gives 40.00 − 2.15 − 29.77, or 8.08 dB(1/m), against a published figure near 8.1. Back the implied gain out of any certificate and ask whether it is plausible for that aperture. One implying 15 dBi from a biconical is a typing error, caught before the survey rather than after it.

4Time, traffic, and the maximum

Everything adds in power, never in field, and every source in every band is a term:

Ratios are squared before summing, so three sources each at 60 percent of their own reference level total 1.08 and the site fails with no reading above 60 percent. Every unmeasured band is a term set to zero.

Limits are on the maximum time-averaged exposure, 1800 s whole body and 360 s local. A traffic-dependent transmitter radiates what demand asks of it, and roof access is granted when it is granted. IEC 62232 and ITU-R SM.2452-1 resolve that by scaling an always-on component:

The worked example, in full

A 3.5 GHz macro cell: 100 MHz channel, 30 kHz spacing, 3276 subcarriers, an eight-beam burst set every 20 ms, a DDDSU frame, a declared 6 dB traffic-to-broadcast ratio. All values are illustrative.

The receiver reads −33.2 dBm on the strongest secondary synchronization resource element, with antenna factor 35.10 dB(1/m) and 2.0 dB of cable loss. Equation (2): −33.2 + 107.0 = 73.8 dBµV, then 73.8 + 35.10 + 2.0 = 110.9 dBµV/m, or 0.35 V/m. Equation (3) puts the implied gain at 6.01 dBi, so the certificate stands, and equation (1) gives 3.249 × 10⁻⁴ W/m².

Then the factors. 98.28 MHz over 30 kHz is 3276. Downlink duty is (3 × 14 + 10)/70 = 0.743, taken as 0.75. No limiter is declared, and 6 dB is a factor of 4. The product is 9828, so equation (5) gives 3.193 W/m²: 31.9 percent of the 10 W/m² limit above 2 GHz.

The raw reading would have said 0.0032 percent. A shaped broadband probe integrates the whole burst instead: all 240 subcarriers are on during a synchronization symbol, giving a 5.42 V/m burst, and at 5.71 percent duty the 30-minute average is 0.045 percent. Section 5 takes up what that number can and cannot support.

Figure 2 shows why: the probe integrates across a window in which the burst is present for a small fraction of the time. Table 1 decomposes the gap term by term, and every term in it is a property of the network rather than of the instrument.

Table 1. The broadband reading and the compliance number differ by 28.6 dB, a factor of 717 in power density. None of it is instrument error. All of it is signal structure the survey did not remove, and traffic that was not present when the surveyor was on the roof.

Term	dB
Subcarriers not seen, kBW	+35.15
Traffic beam not entered, kbeam	+6.02
TDD downlink duty, kDC	−1.25
Burst power spread over 240 resource elements, not one	−23.80
Burst duty cycle of 5.71 percent	+12.43
Net	+28.55

Put that carrier on a rooftop with three others: FM at 15.0 V/m against 27.7, GSM 900 at 12.0 against 42.32, LTE 1800 at 20.0 against 59.01. The squared ratios with the 5G term raw sum to 0.489. Extrapolating that term takes it to 0.808, and Figure 3 shows where the budget then sits.

5Where the broadband survey falls short

The antagonist is an architecture: the shaped isotropic broadband probe read as one percent-of-limit number. It deserves its place. Shaped to the reciprocal of the reference-level curve, it implements the exposure sum in hardware, and if the question is only whether a rooftop has a hot spot it wins. It fails for four structural reasons, none fixable by a better probe.

• It returns a scalar where the standard requires terms. A probe gives the sum in equation (4) and discards the terms, so no extrapolation factor can be applied.
• It cannot extrapolate, because it measures the wrong quantity. A probe reading already contains −23.80 dB of occupancy and +12.43 dB of duty, so multiplying by 3276 double-counts both. Structure cannot be removed from a scalar.
• The detector is non-conservative on the modern signal. SM.2452-1 notes that diode probes driven above their true-RMS range err badly on high-crest signals, and compression produces a low reading.
• The shaping curve encodes a standard, and the standard moved. A probe shaped to ICNIRP 1998 reports against a 6-minute whole-body assumption, and the reader cannot tell which limit surface that is.

Take that claim at its least flattering to us. Grant the probe a perfect true-RMS detector, a shaping curve with zero error, isotropy to a hundredth of a decibel and unlimited sensitivity, none of which any real probe has. It still cannot produce the number the standard asks for, because every one of those improvements makes the same scalar more accurate and the standard needs the terms that went into it. The broadband probe does not fail because it is imprecise. It fails because it has already added up.

The complementary failure belongs in the same breath: without a preceding broadband scan, nine tripod points are nine samples of a field with maxima every 43 mm. The architecture is both, in that order.

6Derived requirements

Table 2 converts the physics into requirements a reader can score any receiver against, including ones we do not make.

Table 2. R7 is a method requirement: record every extrapolation factor with each measurement, and carry an undeclared k_beam as ±3 dB rectangular, not as 1.

	Requirement and number	Why not looser
R1	RBW at or below the reference-signal subcarrier spacing, 15 or 30 kHz	Adjacent subcarrier energy is multiplied by 3276 too, so 100 kHz over-reads by 5.2 dB.
R2	True-RMS detector, integration settable from 500 µs to 360 s	577 µs is one GSM timeslot; longer dilutes it by up to 9 dB.
R3	Phase noise at or below −105 dBc/Hz at 10 kHz offset, 60 dB of linear range	A rooftop spans 57.5 dB, from an FM carrier at −5 dBm to a resource element at −62.5 dBm; an attenuator change injects 0.3 to 0.5 dB.
R4	Documented amplitude budget, U at or below 3.0 dB at k = 2	3.0 dB sets a 50 percent decision threshold; 6.0 dB doubles the compliance radius.
R5	Isotropic total field from three orthogonal axes, matched within 1.0 dB	Reference levels assume maximum coupling; a linear antenna 45° off under-reads 3 dB.
R6	Continuous coverage in one calibrated chain, 100 kHz to at least 6 GHz	An unmeasured band is a term set to zero; two instruments sum two traffic states.

Table 3 shows where the 3.0 dB in R4 comes from, and the row worth staring at is the last one, which is not an instrument term at all.

Table 3. One unknown network parameter contributes more variance than the whole instrument chain combined. In a 5G exposure survey the dominant uncertainty is not the instrument, and no purchase decision changes that.

Contribution	Half-width (dB)	Distribution	ui2
Receiver amplitude accuracy	±1.5	rectangular	0.750
Antenna factor certificate	1.0 at k = 2	normal	0.250
Antenna directivity, isotropy imbalance	±1.0	rectangular	0.333
Operator and tripod scattering	±1.0	rectangular	0.333
Detector response to modulation	±0.6	rectangular	0.120
Cable, mismatch, linearity, drift, repeatability	combined	mixed	0.409
Undeclared traffic-beam ratio	±3.0	rectangular	3.000
The instrument chain alone sums to 2.196, giving U = 2.96 dB at k = 2. Adding the traffic-beam term gives 5.196 and U = 4.56 dB, moving the threshold from 50.6 to 35.0 percent of the limit. Half-widths are illustrative.

7Meeting the requirements

An exposure measurement system at scale is assembled rather than bought whole. An integrator pairs a receive module with a calibrated antenna set and software of their own, so the receiver has to hold its amplitude accuracy across the band, cover that band in one calibrated chain, take commands from someone else's software, and fit a mast or a case. The ICX-FieldHawk family covers that on one engine in three form factors: handheld, rugged tablet, and a USB or LAN module under 305 g. Each requirement below carries its published value and its condition, and the summary table in section 9 collects them.

R3. Published single-sideband phase noise at a 1 GHz carrier and 10 kHz offset is −107.5 dBc/Hz for the ICX-400 family and −101.6 dBc/Hz for the ICX-090 family, at 25 °C after 10 minutes of warm-up with spur reject standard on. An adjacent carrier at −10 dBm throws a skirt of −10 − 107.5 + 10 log(30 000) = −72.7 dBm into 30 kHz, so a resource element at −60 dBm sits 12.7 dB clear and takes 0.23 dB of error. On the 090 tier the margin is 6.8 dB and the error 0.82 dB.

R4, and the honest limitation. Published amplitude accuracy is ±2.0 dB from 9 kHz to 9.5 GHz and ±3.0 dB from 9.5 to 40 GHz, at 25 °C after 10 minutes of warm-up with spur reject standard on. Substitute ±2.0 dB into the budget for the ±1.5 dB illustrative term and the sum becomes 2.778, so U is 3.3 dB. That is above the 3.0 dB target set in R4, and above 9.5 GHz it reaches 4.2 dB. Meeting R4 needs a site amplitude correction against a calibrated reference, which is why the published amplitude correction and Amplitude Offset functions belong in the method. Any receiver quoting one ex-factory figure has the same problem; what differs is whether the correction path exists.

R5, honestly. The published antennas are an omnidirectional element and an active directional antenna, neither a three-axis isotropic probe, so total field comes from three sequential orientations in quadrature, exact only for a stationary field. Power detection, in Figure 4, is one of six published measurement functions a survey uses at every point, Channel Power and Antenna Factor among them, included rather than licensed.

R7. Antenna factor correction belongs inside the chain, not in a spreadsheet afterwards. The correction table is applied at the instrument, so the logged value is already a field strength. The host application, SpectraCore, drives that over SCPI with published bindings for C, Python, MATLAB and LabVIEW, and an integrator whose survey software is the product can bypass SpectraCore and drive the module directly.

8Measurement practice

Figure 5 is worth setting beside the practice list below, because every item on it exists to make that one number defensible.

Most of what makes a survey defensible has nothing to do with which receiver is in the case.

1. Scan before you measure. Broadband probe for where the maximum is, frequency-selective for what it is made of.
2. Spatially average in power, not in field: the root mean square of the fields, never the mean of the V/m readings, and no closer than 0.5 m to a conductive object.
3. Record the integration time per measurement, not once per day: under 577 µs for a GSM timeslot, under 0.5 ms for a Wi-Fi beacon, 72 s or less from 2 to 6 GHz. Log every extrapolation factor with its source, and state U, k, and which uncertainty convention was applied.
4. Cross-check every point by effective aperture: the same power density from P_rec divided by Gλ²/4π must agree within 0.5 dB. In the worked example the routes agree to 0.02 dB.

One limit of the state of the art belongs in every report. Where the point lies outside the synchronization beam sweep, SM.2452-1 requires the measurement to be made in a traffic beam and says plainly that methods for attracting one are still under development. A survey assuming the easy case is non-conservative by up to 9 dB, and no instrument closes that gap. Theoretical-maximum extrapolation also runs 5 to 9 dB above the actual-maximum assessment IEC 62232:2022 permits, so say which convention was used.

Field evidence

The instrument a safety officer carries is increasingly an integrator's product with a general-purpose receiver inside it, built with the integrator's own antennas and software. That arrangement puts the arithmetic of sections 4 and 5 on the integrator rather than on the officer, and it is why this paper spends its length there. The failure reported from the field is not a sensitivity failure. It is a survey that was correct, traceable and signed, and answered the wrong question by 28.6 dB.

9Summary, definitions and further reading

Table 4 collects the governing relations and published values with conditions.

Table 4. Selection turns on whether the site carries anything above 9.5 GHz. The 9.5 GHz module meets R1, R2, R3 and R6 as published; R4 needs a site amplitude correction and R5 needs three sequential orientations, and both of those are method rather than model.

Requirement	Relation or published value	Condition
R6 coverage	9 kHz to 9.5 GHz (090); 9 kHz to 40 GHz (400)	one calibrated chain, all three form factors
R1, R2	RBW 1 Hz to 10 MHz swept; PosPeak, NegPeak, Sample, Average, RMS, MaxPower	VBW 1 Hz to 10 MHz; power detection at 8 ns resolution
R3 phase noise, 1 GHz	−107.5 dBc/Hz (400); −101.6 dBc/Hz (090)	10 kHz offset, 25 °C, 10 min warm-up, spur reject standard on
R4 amplitude accuracy	±2.0 dB; ±3.0 dB	9 kHz to 9.5 GHz; 9.5 to 40 GHz; 25 °C, 10 min warm-up
Source: the ICX-FieldHawk handheld, rugged and USB datasheets. Values on preliminary pages should be verified before quotation.

Basic restriction

An in-body exposure quantity tied to the biophysical effect, not measurable in the field. Extrapolation is its complement: scaling an always-on signal to the maximum traffic load.

Reference level

An external field quantity derived conservatively from a basic restriction. Compliance with it guarantees compliance; exceeding it proves nothing. The total exposure ratio sums each source's contribution over its own reference level, field ratios squared, and must not exceed 1.

Symbols used in this paper.

Symbol	Meaning	Units
Einc, Hinc	Incident rms electric, magnetic field	V/m, A/m
Sinc	Incident power density	W/m²
Z0, AF	Free-space impedance, antenna factor	Ω, dB(1/m)
Lc, Gpre	Cable loss, preamplifier gain	dB
kBW, kDC, kbeam	Extrapolation factors	dimensionless
U, TER	Expanded uncertainty, total exposure ratio	dB, dimensionless

Further reading

• ICNIRP, Guidelines for Limiting Exposure to Electromagnetic Fields (100 kHz to 300 GHz), Health Physics 118(5), 2020.
• IEEE Std C95.1-2019, Safety Levels with Respect to Human Exposure to Electric, Magnetic and Electromagnetic Fields.
• Report ITU-R SM.2452-1 (07/2022), Electromagnetic field measurements to assess human exposure; IEC 62232:2022; 47 CFR §1.1310; FCC OET Bulletin 65 Edition 97-01; ISO/IEC Guide 98-3:2008.

If you are building an exposure product around a receive module, or specifying what a survey report must contain, our application engineers would be glad to work through the chain and the budget with you.