UAV-based Localization of Mobile Phones for

Search and Rescue Applications

2022 IEEE 22nd Annual Wireless and Microwave Technology Conference (WAMICON) | 978-1-6654-2195-9/22/$31.00 ©2022 IEEE | DOI: 10.1109/WAMICON53991.2022.9786189

Christian Dorn Andreas Depold Fabian Lurz

Chair of Micro- and Nanosystems Technology Institute for Electronics Engineering Institute of High-Frequency Technology
Technical University of Munich University of Erlangen-Nuremberg Hamburg University of Technology
Munich, Germany Erlangen, Germany Hamburg, Germany
christian.dorn@tum.de andreas.depold@fau.de fabian.lurz@tuhh.de

Stefan Erhardt Amelie Hagelauer

Institute for Electronics Engineering Fraunhofer EMFT Research Institution for Microsystems and Solid State Technologies
University of Erlangen-Nuremberg and Chair of Micro- and Nanosystems Technology, Technical University of Munich
Erlangen, Germany Munich, Germany
stefan.erhardt@fau.de amelie.hagelauer@tum.de

Abstract—In this work a system is proposed that utilizes an
unmanned aerial vehicle (UAV) to search and rescue trapped
victims using their mobile phones. The systems consists of two
parts, a ground station (GS) and an airborne station (AS). The GS
provides a downlink to the UAV, a GSM base station along with
antenna equipment and a mobile network jamming device. By
using a smart approach to block the synchronization sequences
of all base stations in range, the mobile phones of the victims
to be located are switching to an emergency fallback mode. In
this mode the phones connect to the strongest base station in
range, thus the one provided by the GS. By initiating a call to
the corresponding phone the AS can localize it using direction-of-
arrival detection with a 9-channel phase coherent receiver system.
Index Terms—uav, jammer, sar, sdr
I. I NTRODUCTION
Coping with humanitarian disasters is one of the main
challenges these days. According to a study of the United
Nations Office for Disaster Risk Reduction more than 1.7
billion people have been affected by disasters from 2005 to
2014 [1]. Predominant are natural disasters like the severe
earthquakes in Italy in 2016 or the landslides in France
recently. Yet man-made disasters like the Beirut Explosion in
August 2020 also heavily affect a lot of people. The incidence
of death along the victims is high with approximately 700, 000
in the time of the aforementioned study, whereof a high share
relates to people being trapped alive under collapsed buildings,
infrastructure or in cavities who cannot be found and rescued
in time. Therefore, time is the biggest factor for the search
and rescue (SAR) teams to rescue trapped victims. Even today,
the SAR teams mostly rely on service dogs to locate victims
under the debris. Unfortunately, the service time of dogs is
limited to about 15-20 minutes thus heavily limiting the search
area. Hence, the goal of this research is to locate potentially
alive victims in a large area to enable the SAR teams to
deploy their service dogs on point or take appropriate measures
immediately. Technologies for locating victims are scarce and
mostly limited to endoscope cameras, geophones (acoustical
detection device) or ground penetrating radar, which all rely on
boundaries like a calm and accessible disaster site and where it
is nearly impossible to cover a large area within a short time-
frame. Although there are technologies, as for example LVS
avalanche beacons, that allow precise localization of trapped
victims, they require to be worn at any time and are only
feasible for sports or SAR teams that are in immediate danger.
However, most of the people today carry a mobile phone with
them at any time. This is obvious in the western world, yet
even in developing countries the distribution of mobile phones
is very high. For example in India 91 out of 100 inhabitants
own a mobile phone [2]. Furthermore, it is most likely that
people carry their phones with them or at least have it in
range. Thus, locating mobile phones in the debris to pinpoint
the position of a victim is a feasible approach.
II. M OBILE P HONE L OCALIZATION C ONCEPT
There are some implications when it comes to the local-
ization of mobile phones. If a mobile phone is still logged-
in to a provider network, it is only sending and receiving
short keep-alive bursts, that are too scarce for a localization.
Although a call could be initiated to a phone, it requires
provider information to obtain the phone numbers or identities
of the phones on a disaster site. This could be difficult
or impossible to achieve in time. Furthermore, to address
security concerns, there are countermeasures in mobile radio
systems, that prevent the identification of a single phone in a
certain area. After successful authentication with the provider,
the unique identifier integrated mobile subscription identity
(IMSI), which is stored on the SIM card, is swapped with a
temporary one (T-IMSI), that is periodically renegotiated to
prevent distinction and thus localization.
To circumvent these countermeasures this research project
is preventing all valid base stations on the disaster site to
communicate with the mobile phones, covering all current

978-1-6654-2195-9/22/$31.00 ©2022 IEEE

Authorized licensed use limited to: Universidad Nacional de Colombia (UNAL). Downloaded on April 26,2023 at 02:49:09 UTC from IEEE Xplore. Restrictions apply.
 800/900MHz
Phase Coherent Receive System
Linux Server Drone Uplink

RX1
TX1
OpenBTS USB E-GSM 900 Uplink - Receiver Control & Pre-processing
433 MHz
Packet Radio PX4-based

Zynq 7000 SoC

Kintex 7 FPGA
~

V4L2 Software-Defined Radio Driver

Flight Controller
OS
1.8 GHz 5.8 GHz
WiFi
PCIe RX
~

Jamming Software
RX ADC
RX2
TX2

USB3

GNURadio
Drone Control RX
2 GHz SDR LVDS NVIDIA Jetson
HereLink FPGA
WiFi Xavier AGX
RX1
TX1

PCIe x4
RX
QGroundControl
Zynq 7000 SoC
Kintex 7 FPGA

~ RX ADC USB
OS

2.1 GHz RX Ground Station

User Interface Downlink
~
RX MCU
RX2
TX2

USB
2.6 GHz
Touchscreen RX ADC WiFi
SDR 5.8 GHz
SDR RX TRX
Keyboard & Mouse
RX1
TX1

Measurement 433 MHz

Web- USB
Data Post-
server
Zynq 7000 SoC

Processing
Kintex 7 FPGA

~
5.8 GHz
WiFi
OS

3.6 GHz
USB

~ Fig. 2. Overview of the airborne station

RX2
TX2

SDR

Xilinx Kintex-7 FPGA and a Xilinx Zynq-7000 system-on-

Fig. 1. The ground station system, with three SDRs a Linux based server
and periphery chip with a combination of a hard-core cpu and additional
FPGA logic allow pre- and post-processing for digital filtering,
gain control and channel selection. Having a maximum output
radio access technologies (RAT) as GSM, UMTS/WCDMA, power of around 7 dBm, seperate power amplifiers are needed
LTE and 5G Sub-61 standalone (SA) whilst providing a for jamming and BTS operation. To allow coverage of a
separate GSM base transceiver station (BTS) in the (enhanced) disaster site spanning around 100m x 100m we expect an
900 MHz band (E-GSM900). This switches all phones to a output power of 20 W or 43 dBm to be sufficient for all RATs.
fallback for emergency services and leads them to use our E-
GSM900 BTS without any authentication, because it is the B. Airborne Station
only one reachable. The actual localization is done via an
unmanned aerial vehicle (UAV) that is autonomously flying The airborne station (Fig. 2) is attached to a Scarabot x8
over the disaster site and conducting continuous direction-of- multi-copter as the UAV. The UAV can carry a payload of up
arrival (DoA) measurements to locate the phones in the area. to 2.3 kg with a maximum flight time of up to 52 minutes.
For data processing and autonomous flying a NVIDIA Jetson
III. S YSTEM OVERVIEW Xavier AGX computing board is mounted to the bottom
The localization system is build around two main blocks, side. It interacts with the PX4 flight controller by receiving
the ground station (GS) and the airborne station (AS). telemetry data. Furthermore, the software in the computing
board can provide coordinates for new waypoints to approach
A. Groundstation automatically. To allow multipurpose usage of the UAV the
The ground station (Fig. 1) is a mobile 19-inch rack system actual payload can be swapped. Our payload comprises of
with external antennas. It incorporates the jamming device a 9-channel phase coherent receive system together with
together with the E-GSM900 base transceiver station and a combined antenna and landing gear. The receive system
the drone uplink hardware. Furthermore, the ground station allows sampling the lowest and highest channels of the E-
takes care of the post-processing of the measurements and the GSM900 uplink band (absolute radio-frequency channel num-
display to the end-users. The core part of the GS is an AMD bers (ARFCN) 975 and 124) at 880.2 MHz and 914.8 MHz in
Ryzen Threadripper based computer running a Linux system. parallel on 9 antennas using three analog-to-digital converters
It maintains three custom software-defined radio (SDR) PC connected to an Artix-7 FPGA. The sampled data is filtered
add-in cards that are interfaced via PCI express with 4x lanes in the FPGA and sent to the computing board via a USB3.0
width. A single SDR system allows to simultaneous receive interface. A more in depth-look at the receive system can be
and transmit on four channels with a large signal bandwidth found in [4]. On the computing board a minimum variance
of 200 MHz and a bandwidth of 450 MHz for digital pre- distortionless beam-former is used to calculated the incident
distortion (DPD). An additional integrated observation receiver angles of the measured signal. The antenna is an array of nine
can be used as feedback for the DPD system. Each two dual-dipole elements, that allow switching the polarization.
channels have a common local oscillator, that can be tuned Furthermore, a 433 MHz packet radio is part of the system
individually in a range between 75 MHz to 6000 MHz. A providing a control link from the AS to the GS that has
a deterministic latency. The UAV itself is controlled via a
1 5G mmWave systems are not relevant in this scenario, as they cannot HereLink remote control, that runs QGroundControl software.
penetrate the rubble pile This allows the GS to upload flight missions to the UAV.

Authorized licensed use limited to: Universidad Nacional de Colombia (UNAL). Downloaded on April 26,2023 at 02:49:09 UTC from IEEE Xplore. Restrictions apply.
 IV. L OCALIZATION P ROCESS to answer a telephone call. Hence, the base station initiated
In order to localize a mobile phone several steps need to be MTC is modified to not be stopped after a certain number of
executed. rings. Furthermore the UE is made to transmit with maximum
power by signaling it via the slow dedicated control channel
A. Jamming (SDCCH) during the call initiation.
After the GPS of the GS is locked and it is synchronized
to the 1 pps signal, the GS scans for all base stations in range
(BTS for GSM, eNodeB for LTE/5G-nSA and gNodeB for
5G-SA) using a GNURadio based application. When all base
stations are known, the jamming process can be started. This
means, that first all mobile phones (MS: mobile station in
GSM or UE: user equipment in all other RATs, here UE) need
to accept GSM as the only available access technology. This
can be achieved by triggering an inter-RAT cell reselection
process [5]. An UE in idle mode, meaning a phone that does
not maintain an active connection, is measuring the signal
quality periodically. Depending on the RAT the concept is
different. In GSM the received signal strength (RXLEV) and
received signal quality (RXQUAL), obtained from the bit
error rate, are the main factors for link quality. If the link
quality drops below a certain threshold, a cell re-selection is
commenced. For UMTS/WCDMA this is done by measuring
the per-chip to interference ratio of the primary common pilot Fig. 3. Measuring system with antenna array mounted to the bottom of the
channel (P-CPICH). In LTE there are cell-specific reference drone
signals (CRS) that occupy every sixth sub-carrier in frequency
(i.e. 90 kHz distance) and in total two or four OFDM symbols C. Start of the UAV
within a sub-frame. These CRS are used to monitor the link
When it can be assumed, that most of the UEs are connected
quality. In 5G SA the synchronization signal blocks (SSB),
to the base station, the UAV is started. A flight mission, usually
containing primary and secondary synchronization signals, are
linearly traversing the disaster site, is uploaded to the UAV.
used as link quality indicators. By transmitting a high-power
Once the AS is ready and the flight mission has begun, the
white noise signal during the transmission of these chan-
GS will commence modified MTC calls to each registered and
nels/signals the UE will erroneously assume a poor quality link
non-flagged phone in succession. When all phones have been
to the valid base stations. This will force the UE to trigger a re-
called it starts from the beginning.
selection of the used base station and thus, use our E-GSM900
base station. To prevent a UE to connect to another GSM base D. Localization of an UE
station it is sufficient to block the broadcast control channel The receiver on the AS is triggered via the 433 MHz control
(BCCH) from being received [6]. This contains, among other interface. When a modified MTC call is made, information
information, the mobile network code. If the channel can not is sent to the UAV containing the unique phone number
be received, the UE considers this base stations as not present. and a command to start the receiver. Upon reception of
A detailed in-depth view of the jamming process will be part the command, the receiver system samples all nine antenna
of another publication. channels in parallel with coherent phase for around 600 µs.
This is slightly longer than a normal TDMA burst (577 µs)
B. Login of mobile phones
to accommodate for latency. The sampled data will be pre-
After cell re-selection is commenced, all mobile phones in processed and sent to the GS via the backbone downlink.
range will successively connect to the provided E-GSM900 On the GS the data is post-processed, the training sequence
BTS to at least provide emergency services. To avoid inter- of the normal burst is correlated and the phase information
ference, the base station will be dynamically placed in a part extracted. This can be done several times in short succession
of the band, where no base station is present and therefore per modified MTC and thus, a good estimation of the incident
no jamming is conducted. The UE will be assigned a unique angle can be made. By using multiple measurement locations
telephone number and informed via a short message (SMS). To utilizing the flight information of the UAV, the position of
flag phones belonging to the SAR teams as not to be localized, the victim under the debris can be pinpointed using multi-
they shall answer to the SMS. This will exclude them from angulation techniques.
the localization procedure. Being now a valid base station, the
use of T-IMSI can be disabled and mobile terminated calls E. Result Display and End-of-mission
(MTC) to the UEs can be started. Due to the circumstances The position of the located phones will be displayed by their
of being trapped under debris, victims are usually not able unique phone number via a map on the GS once a location

Authorized licensed use limited to: Universidad Nacional de Colombia (UNAL). Downloaded on April 26,2023 at 02:49:09 UTC from IEEE Xplore. Restrictions apply.
is fixed. This is done using a webserver on the GS and a
webpage that refreshes when new data is available. This allows
SAR teams with tablets or smartphones to respond to new
information rapidly. The mission ends when the UAV battery
is depleted.

Fig. 5. Spectrum of the receive system with two combined polarization angles
[3]

ACKNOWLEDGMENT
Fig. 4. Hidden beacon at the field test in Wesel This work is funded by the Federal Ministry of Education
and Research (BMBF) of Germany as part of SORTIE under
project number 13N15191.
V. F IELD T EST
To verify the AS receive system it was tested on a field test R EFERENCES
at a test site of the German Federal Agency for Technical [1] United Nations International Strategy Disaster Reduction (UN ISDR),
Relief (German: Technisches Hilfswerk (THW)) in Wesel, ”Infographic on Economic and Human Impacts of Disasters 2005-2014,”
2015.
Germany. To verify the functionality a beacon in the 868 MHz [2] The World Factbook — Central Intelligence Agency, 16.04.2020
ISM-band, that is near to the E-GSM900 uplink band, was [3] A. Depold, C. Dorn, S. Erhardt, R. Weigel, F. Lurz, “A Light Weight
utilized. The beacon transmits a GSM-like GMSK burst. It 3x3 Switched Polarity URA Antenna and Receive System for Direction
Finding,” IEEE Topical Conference on Wireless Sensors and Sensor
has been hidden in a rubble pile (Fig. 4) and a D-GPS Networks, 2022.
system provided a ground truth to verify the measurements. [4] A. Depold, C. Dorn, S. Erhardt, R. Weigel, F. Lurz, “A 9-Channel Phase
The receiver system was attached to a handle (Fig. 3) to Coherent Receive System for Direction of Arrival Estimation“, 2021
European Microwave Conference (accepted)
simulate a flight scenario. The results of one measurement with [5] M. Gardill, S. Zorn, R. Weigel and A. Kölpin, ”Triggering UMTS
two polarization angles have been combined and a spectrum user equipment inter-RAT cell reselection using noise jammers,” 2011
was computed using a minimum variance distortionless beam- German Microwave Conference, 2011, pp. 1-4.
[6] S. Zorn, M. Maser, A. Goetz, R. Rose and R. Weigel, ”A power saving
former (Fig. 5). It depicts the probability density of the beacon jamming system for E-GSM900 and DCS1800 cellular phone networks
location over azimuth and elevation angles. Although this for search and rescue applications,” 2011 IEEE Topical Conference
particular measurement has a very low variance in angle not on Wireless Sensors and Sensor Networks, 2011, pp. 33-36, doi:
10.1109/WISNET.2011.5725020.
all measurements show comparable results. Fortunately, it is
possible to do a large number of measurements due to the short
duration of a TDMA burst. False measurements can easily be
identified as they do not converge to a single point. The results
have been published in [3]. The GS has only be tested in parts,
a complete test of both systems is planned in the near future.
VI. C ONCLUSION
In this publication a new approach for SAR teams to
pinpoint the location of trapped victims has been shown. By
using an UAV a search for survivors can be conducted at an
early stage of the rescue operation, even when it is still not
safe to enter the disaster site. By using the mobile phones of
trapped victims no other equipment needs to be brought into
the site.

Authorized licensed use limited to: Universidad Nacional de Colombia (UNAL). Downloaded on April 26,2023 at 02:49:09 UTC from IEEE Xplore. Restrictions apply.