How well does 5G really reach your phone? A city-sized record from Vienna offers clues

Cars, scanners and phones turn Vienna into a mobile-network laboratory

A team at TU Wien turned ordinary cars into a rolling measurement lab for Vienna’s mobile networks. Between June 27, 2024 and March 8, 2025, vehicles drove through urban streets and quieter suburban roads. Over 18 drive-test days, the cars covered about 100 square kilometers and produced a large public record of what phones can see.

The released record contains 2,893,129 measurement rows, grouped into 986,698 timestamp and operator entries. These entries point to about 929,217 unique GPS locations after coordinates were rounded to five decimal places. They also name 7,911 distinct cell identities, which lets analysts compare many sites rather than one tower.

Each car carried a wideband scanner that listened to nearby LTE and 5G signals without joining them. It also held three 5G-capable phones, mounted in the dashboard and connected to test software. The scanner gives a network-side view of what is deployed and visible. The phones give a user-side view of the serving cell, including signal quality and data rate.

The scanner setup used a PCTEL IBflex receiver, two rooftop antennas, and a GPS unit. Keysight Nemo Outdoor software on a laptop controlled the whole collection process. This made monitoring technology-agnostic, so LTE and NR signals could be observed in the same pass.

Phone logs record radio-quality readings such as received power, signal quality, total received strength, and interference-adjusted quality. They also include downlink and uplink throughput plus timing advance. These values come from phone diagnostic interfaces, not from a speed-test app shown on screen.

The campaign is multi-operator, but current phone-based 5G records come from only one carrier. That limit also applies to the estimated 5G cell metadata included in the release. The data come in four parts: scanner measurements, handset measurements, estimated site information, and high-resolution building and terrain models.

Low bands carry farther while high bands fade in dense streets

In dense city streets, radio waves do not travel equally at every frequency. A cellular signal on a low band can reach farther and hold up better when it has to pass through walls, windows, corners and crowds of buildings. The Vienna drive-test measurements make that pattern easy to see. The lowest-frequency LTE band used in the data is 800 MHz, and it produced the strongest received power across the measured streets. Mid-band LTE layers at 1800 MHz and 2600 MHz were weaker. The highest-frequency layer, a 5G C-band around 3500 MHz, was the weakest of all because its waves suffer more path loss and penetrate buildings less well. A 5G band near 2100 MHz sat between those extremes, with behavior closer to mid-band than to the very low or very high layers.

The quality of the received signal follows the same physical logic. Low-band LTE gave the most stable quality readings, with a median RSRQ close to minus nine decibels. That number matters because it describes how clean the received signal is relative to interference and noise. The mid-band and high-band layers showed much wider variation from place to place. In dense streets, more cells are packed into a smaller area, so phones and scanners can see several nearby transmitters at once. Their signals overlap, bounce off facades, and compete for the same airwaves. The result is less predictable quality on higher bands, even when the network has many sites deployed.

This frequency behavior helps explain why operators use low bands as a coverage foundation. They can fill buildings and cover larger areas while using fewer sites. Higher bands can add capacity where people are crowded together, but they fade faster once a signal meets dense urban obstacles. The measurements show that both effects coexist in the same city: low-frequency waves carry farther through streets, while high-frequency waves shrink their useful range as walls and traffic increase.

When a detected signal cannot be tied to its cell

A scanner can hear a radio signal long before it knows which cell is sending it. In the Vienna drive-test data, each detected LTE or 5G signal was checked against nearby decoded broadcast events using physical cell identity, channel number and measurement file. The goal was simple: pair what the receiver heard with the network information that identified the transmitter.

The pairing did not always work, because a signal without a cell identity cannot be placed on a map with confidence. Of 2,649,377 signal records examined, 472,645 could not be matched to any decoded broadcast event at all, which is 17.84 percent of the total. LTE left 14.90 percent unmatched, while 5G NR left 18.81 percent unmatched.

Among records that did match, timing problems were common but spatial problems were rare. Overall, 13.84 percent showed time outliers and only 0.53 percent showed space outliers. LTE had 17.99 percent time outliers and 1.96 percent space outliers; 5G NR had 12.48 percent and 0.06 percent. Roughly two-thirds of all records were fully consistent in both dimensions.

The timing slips point to asynchronous decoding and buffering inside the scanner logs. A strict ten-second matching window was too tight for that jitter, so the released data use a spatial fallback. Each signal record is linked to the closest candidate broadcast event among exact-key matches. Timing statistics are still reported, allowing users to choose different thresholds.

Estimating antenna positions from timing circles and public records

Timing advance is a radio clue that tells how far a phone sits from its serving cell. Each timing value can be turned into a circle around the measured location. The circle radius comes from that distance, so many circles should overlap near one transmitter. For LTE, the method used public Austrian transmitter registry entries to narrow candidate sites. Those records supplied plausible addresses before any radio geometry was fitted. Antenna heights were read from Google Earth Pro imagery rather than taken from operator files. On each measurement day, the ten most frequently observed LTE base stations per operator were selected. Across eighteen days, this produced fifty distinct LTE sites for every operator in that layer. That rule spread the work over more streets, times and cells instead of a few strong ones. For non-standalone 5G, phone logs do not expose base-station names directly. The same physical cell identity was therefore treated as one site within a single day. That assumption is safer because each drive covered a limited area and the identity space is large. A cell needed at least five measurements from distinct places before it could be localized. The thirty most frequent qualifying identities per day were kept for the estimate. Timing circles were drawn around each phone point, and their overlap tested the geometry. If one cluster of circles fit a single spot, that cluster was used for localization. Smaller inconsistent groups were discarded so mixed data would not pull the site estimate aside. For LTE sites with reference metadata, estimated locations had a root-mean-square error of 38.55 meters. Sector orientations had a mean absolute circular error of 27.95 degrees. Those values are physically plausible, though they do not prove the true antenna positions. For 5G, no external ground truth was available because phone logs lacked direct site labels. An internal check compared timing-advance distances with straight-line distances to the estimated sites. Across all 17,433 samples used in that check, the median residual was 69.6 meters. The 95th percentile reached 318.8 meters, and the 99th percentile reached 585.4 meters. That result says the inferred 5G sites respect timing constraints, but it is not independent proof.

A city that can be measured, but not fully known

A hundred square kilometres of Vienna now sit in an open dataset, and the value lies less in any single number than in what the data make possible. The scanner sees the network from outside; the phones show how users experience it, and the building models give both a physical stage. Together they support radio maps, coverage checks, digital twins, and machine learning that can be tested against real streets rather than simulated ones. That gives a rare chance to move from operator dashboards toward public infrastructure for wireless research.

The obstacles are also clear, because the cleanest part of the picture remains partly hidden. Many scanner signals cannot be tied to a decoded cell identity, and phone logs in non-standalone 5G lack stable base-station labels. Estimated antenna positions help fill the gap, yet they cover only a subset of sites and rest on timing circles, public registries, and imagery. Throughput logs contain real pauses, handovers, and scheduling gaps, so an analysis that treats every sample as equal will misread the network. Those limits are not flaws to hide; they define where careful modelling must begin.

The broader opportunity is that other cities could follow the same route, pairing drive tests with open building data and public transmitter records. If operators expose more identifiers, devices report cleaner beam information, and weather joins the traces, these maps could become living tools for planning. Then a city is no longer only a place where phones connect; it becomes an instrument that can be read, compared, and improved. Can a radio map be trusted when the antennas are inferred from the signals they emit?