TDOA Localization: From

Theory to the Field

Overview
__
The Principles of TDOA Localization
The Quality of TDOA Localization
TDOA vs. DF Localization
Conclusion
__
Version 1.0
10 October 2023
© Decodio AG

Localization is essential in spectrum monitoring applications for helping

operators pinpoint the source of transmissions they are interested in.

Time-difference of arrival (TDOA) localization has emerged as an attractive

solution to passively find the source of signals of interest. In short, TDOA
localization uses three or more receivers to find the position of a target
based on the difference between the time it takes the signal to arrive at
each receiver, hence the name “TDOA.”

TDOA localization has numerous advantages. First, it can be used with

commercial off-the-shelf (COTS) or application-specific antennas, e.g.,
wideband monitoring antennas, directional antennas, or antennas with a
focus on special frequencies. Owing to the correlation gain, TDOA can be
applied on signals close to the noise floor or even below it. Also, TDOA is
more resilient to multipath than alternative solutions like direction-finding
(DF) localization.

In this article, we will delve into the technical details behind TDOA
localization, which will help us understand how to benefit from its full
potential. We will also discuss the quality of location estimates obtained with
TDOA. Finally, we will compare TDOA and DF localization, which will help us
select the most suitable method for our application.

1
 Signal at RX1 (𝑓)

The Principles of
TDOA Localization
The conventional TDOA localization needs at least three
receivers to locate a target in a 2D plane. The receivers
Signal at RX2 (𝑔)
need to be time-synchronized, usually through GNSS.

One common way to estimate the TDOA of the signal

arriving at two receivers is based on the cross-correlation
between the received signals. When the signal arrives at
each of the three receivers, it is streamed to a central
processing station. There, the signals from each two
receivers are cross-correlated in order to find the TDOA.
Signal at RX2 shifted with Δ𝜏1
The cross-correlation function (CCF) of two signals 𝑓 and
𝑔 is obtained by multiplying one of the signals (for
instance, 𝑓) by the complex conjugate of the other signal
(𝑔), integrating over the total duration of the two signals,
and then repeating this process for a set of time lags .

We will explain the computation of the CCF using as an Signal at RX2 shifted with Δ𝜏2
example a signal that arrives at two receivers, which we
will call RX1 and RX2. The signal travels through two
different paths, so the waveforms that arrive at RX1 and
RX2 will not be identical. Let’s denote by 𝑓 and 𝑔 the
signals arriving at RX1 and RX2, respectively. We
consider that the distances between the signal source
and each receiver are different, so the signal will arrive at
different times at RX1 and RX2.
Cross-correlation between the signals at RX1 and RX2
The maximum peak is found for the lag Δ𝜏1
Figure 1 illustrates this example: the first plot shows the
signal 𝑓 that arrives at RX1 at time 𝜏𝑅𝑋1 . Similarly, the
second plot shows the signal 𝑔 that arrives at RX2 at time
𝜏𝑅𝑋2 . The signals 𝑓 and 𝑔 have similar shapes, but 𝑔 has a
higher noise level.

Intuitively, cross-correlating two signals is equivalent to

shifting one of them until we find the time lag at which
they are the most similar. The measure of similarity is Figure 1. The receivers RX1 and RX2 receive a signal arriving
given by the integral: because we are summing up the through different paths at different times. The received signals are
product of the two functions at all time values, the sum cross-correlated in order to find the time lag at which they are
will be the largest when all the peaks (both negative and perfectly aligned. This time lag represents the TDOA of the signal
positive) are perfectly aligned. At this time lag, the CCF between RX1 and RX2. In this example, the perfect alignment is
will have the maximum value. obtained for the lag Δ𝜏1 .

In Figure 1, the third and the fourth plots show signal 𝑔

shifted with the delays Δ𝜏1 and Δ𝜏2 , respectively. In this A signal of interest arrives
example, Δ𝜏1 = 𝜏𝑅𝑋1 − 𝜏𝑅𝑋2 ; in other words, Δ𝜏1 is the at receivers placed at different locations.
delay applied to 𝑔 such that the useful parts of the signals By cross-correlating the versions of the
𝑓 and 𝑔 are aligned. The last plot shows the resulting
CCF. The maximum of the CCF is found for the delay Δ𝜏1 . signal that arrive at two receivers, we
The time shift Δ𝜏1 is also the TDOA between RX1 and obtain the difference in their arrival
RX2, since it is equal to the difference between the arrival times, also known as the TDOA.
times of the signal at the two receivers.

2
So far, we have explained how to acquire the TDOAs.
What might not be obvious is how to turn them into
locations, which is what we are interested in.

First, the time difference can be easily converted to a

distance difference by multiplying it by the speed of light.

Then, one distance difference gives us a set of possible

locations for the transmitter. Let’s take as example Figure
2 and suppose that we have computed the distance Figure 2. The TDOA is transformed into a distance difference of
difference between the paths traveled by the signal to arrival at two receivers. We consider that the signal arrives at the
receivers RX1 and RX2. This value determines a specific two receivers (RX1 and RX2). The signed distance difference
hyperbola, which has the foci at the two receivers. Using determines a branch of a hyperbola (the solid red line) with the
the sign of the difference, we limit the search space to focus at RX1. The source can be anywhere on this line.
only one branch of the hyperbola, with the focus at RX1
(the solid red line). The transmitter of interest can be
anywhere on this line.

By computing at least three TDOAs (for instance,

between the pairs RX1−RX2, RX1−RX3, and RX2−RX3), we
can find the target of interest at the intersection of all
hyperbolas, as shown in Figure 3.

In the Decodio Localizer software, TDOA localization can

be applied on both continuous transmissions and burst
signals. Figure 3. By computing more TDOAs, the target can be localized
at the intersection of three hyperbolas.

The Quality of TDOA Localization

A frequently-asked question that arises at this point is:
How good is TDOA localization? First, we need to define
what “good” means. In other words, we need to define
our quality metrics. Although we usually think of the
accuracy of location estimates as being the most
important quality factor, we will see that their precision
can be just as (if not more) critical.

Figure 4. Accuracy vs. precision in localization.

How to define the quality?
The difference between accuracy and precision is often The distance between the mean of all computed
not well understood. However, it is essential in order to locations and the true location of the signal source is the
interpret our results. accuracy of the location estimate.

A localization solution typically returns a set of location The spread of the estimated locations around their mean
estimates for a target signal. Because of the noise gives us the precision of the location estimate.
present in the signal, the location estimates will also be
noisy. Therefore, we can improve the results if we look at We can define the accuracy and precision in terms of the
the average location over a time period. This will mitigate location error, which we denote by 𝑒. We define the
part of the measurement noise. In Figure 4, we consider location error as the Euclidean distance between an
that the average location is the center of the circle which estimated location and the true location:
wraps the location estimates. 2 2
𝑒𝑖 = ‖𝒑𝑡 − 𝒑𝑖 ‖ = √(𝑥𝑡 − 𝑥𝑖 ) + (𝑦𝑡 − 𝑦𝑖 ) ,

3
where 𝒑𝑡 is a vector that contains the 2D Cartesian TDOA localization: the bandwidth, the time
coordinates 𝑥𝑡 , 𝑦𝑡 of the true location. Similarly, the synchronization between the receivers, the multipath
vector 𝒑𝑖 (𝑥𝑖 , 𝑦𝑖 ) contains the 2D coordinates of the 𝑖 𝑡ℎ profile, and the geometry of the receivers.
location estimate.
To illustrate the influence of these factors, we will use data
The accuracy is then the mean location error for a set of from a measurement campaign to give an idea about the
accuracy we can expect from Decodio Localizer’s TDOA
𝑁 location measurements:
solution.
𝑁

accuracy = ∑ 𝑒𝑖 . The setup consisted of three receivers spread out around

Budapest, shown previously in Figure 3. We used Narda
𝑖=1
SignalShark receivers. In this case, we localize TETRA
The precision is most commonly defined as the signal sources, but the TDOA can also be applied on
standard deviation of the location errors. Since the other signals.
standard deviation is sensitive to outliers, other
measures (e.g., the interquartile range) can be chosen While we do not know the exact true location of the signal
instead depending on the application. source, in most cases we can pinpoint it with high
confidence to nearby landmarks (e.g., the train station), as
this is where TETRA stations are likely to be found. Please
Accuracy and precision in note that this example is for illustration purposes and, in
other applications, the achievable accuracy will highly
practice depend on the particular setup.

We might be tempted to always desire the highest Bandwidth. The signal bandwidth is critical for the
possible accuracy from a localization solution (e.g., on precision of TDOA localization. This is because the auto-
the order of decimeters or meters). However, this might correlation function (ACF) of a signal is the Fourier
not be necessary in many scenarios. Relaxing the transform of its power spectral density. Therefore, as
requirements can bring many benefits such as a lower Figure 5 shows, the wider the signal bandwidth is, the
cost of the setup or an easier operation. sharper the main lobe of the ACF becomes and the more
precise the timing estimate (and hence the TDOA) will be.
For example, if we want to localize a target inside a city,
then an accuracy of several hundred meters can be
enough to pinpoint the target to several buildings.
However, if the target needs to be localized at a
particular street number, the localization method should
yield an accuracy of at least several meters.

The precision should not be ignored either. Even if the

distance between the center of the cluster and the true
location (i.e., the mean distance error) is small, we can
have a large spread of location estimates around the
mean location. This means that our precision is low and
we cannot locate a target with high certainty. In practice,
this could mean that a larger area should be searched
for the source of interest, which might require more time
and resources. Figure 5. Signal bandwidth vs. shape of the autocorrelation
function (ACF) with narrow band signals (top) vs. wider band
signals (bottom). Note how the width of the main lobe in the ACF
What errors to expect from gets narrower with a wider band.
TDOA?
While it is hard to give a general answer that is In the following, we will use a TETRA signal from the
applicable to all localization scenarios, we will highlight measurement campaign to show the impact of bandwidth
the most important factors that influence the quality of on the precision of TDOA localization.

4
 Narrowband Wideband

We want to localize a TETRA signal with a bandwidth of In this example, we have the same signal as before, only
25 kHz. However, to simulate the impact of a signal with that this time we use almost the entire bandwidth of the
a low bandwidth, we select only a portion of 4 kHz from signal to compute the TDOA (the green area now spans
the signal (the green stream from the figure). the width of the signal bandwidth).

The main lobe of the resulting CCF has a width of The width of the main lobe in the CCF is now approx.
approximately 450 µs. 125 µs, so more than 2x sharper than in the previous
narrowband example.

We obtain a localization precision of approx. 188 m. The This leads to a precision of 67 m. The span of the
total span of the heatmap is 1.2 km. heatmap is now approx. 500 m. The precision is more
than twice as high for WB signals than for NB signals. In
practice, this means that we need to search for the
source of interest over a smaller area.

Receiver synchronization. The receivers need to be arrive at a receiver through multiple paths. NLOS
synchronized using GNSS, which is affected by jitter propagation occurs when the signal traveling through the
errors and can decrease the localization precision. The direct path between the transmitter and the receiver is
receivers must be placed outdoors, where they can have obstructed by an object.
a clear sky view, in order to minimize GNSS errors. If the
receivers are not properly synchronized to account for Multipath propagation can lead to multiple peaks in the
factors such as cable length and processing time, ACF. In this case, it is harder to select the correct peak
systematic biases of up to 100 ns (equivalent to 30 m) can especially if the direct path is (partially) obstructed. As a
affect the TDOAs. result, the location estimate can be biased.

Multipath and non-line of sight (NLOS). Multipath Both multipath and NLOS are inevitable in crowded
propagation is the phenomenon through which signals urban environments and can introduce errors of even

5
hundreds of nanoseconds in the TDOAs. Even in remote using spread spectrum modulation, can have a signal
areas, trees, hills, or mountains can lead to multipath and level even below the noise floor and still be recovered
NLOS propagation. This decreases the accuracy of TDOA thanks to the good auto-correlation properties of the
localization. For this reason, it is advisable to place the spreading codes.
receivers on high places (e.g., tall buildings, hills) to
maximize the chances of the receiver being in line of sight
(LOS) with the transmitter.

Geometry. The placement of the receivers with respect

Multipath propagation is the main
to the target also has an important influence on the factor that affects the localization
precision. Usually, the localization accuracy and precision accuracy. The precision is mainly
are the highest when the target is inside the convex hull
limited by the signal bandwidth.
defined by the receivers. However, there can be cases in
which the signal source is outside this area, as shown in
Figures 5 and 6. In this example, the estimated locations
are spread over an area of 2 km due to the poor
geometry. Note that the receivers must not be placed in To summarize, the main factors that affect the localization
a line, as this leads to ambiguous locations. accuracy are the receiver synchronization and the
propagation conditions. Since a perfect receiver
SNR. While the SNR affects the precision of location synchronization is hard to achieve and the system will
estimates, its effect becomes evident only for wideband likely operate in multipath environments, we should
signals. In fact, TDOA can be applied on signals close to expect a localization accuracy of tens to hundreds of
the noise floor or even below it thanks to the correlation meters.
gain [1]. When computing the cross-correlation, signals
that are uncorrelated (such as the noise) are attenuated. The signal bandwidth is the main factor driving the
precision, since PMR signals are typically narrowband.
On the other hand, the signal of interest will correlate with Only for wideband signals do factors such as the GNSS
itself and will be preserved. Some signals, such as those jitter and the SNR start to become more important.

Figure 6. The source of the signal is located outside the convex Figure 7. Close-up of Figure 6. The precision is lower than if the
hull delimited by the receivers. source were inside the area delimited by the receivers. The point
cloud spans an area of approx. 1.3 km.

TDOA vs. DF Localization

Having understood the principles of TDOA localization, we can now compare it with its most popular alternative, DF
localization. This will help us make an informed decision about which method is best suited for a particular application.
Table 1 summarizes the main differences between the two methods.

Perhaps the most crucial difference between the two techniques is the type of antenna they require. In order to
perform DF localization, we need complex, specialized DF antennas. Most DF antennas have a frequency range
limited to 8 GHz [2, 3, 4] and are vertically polarized [5]. This limits the type of signals we can localize using DF.

6
 In contrast, TDOA can be used with wideband monitoring antennas, directional antennas, or antennas with a focus
on special frequencies. This could mean, for instance, that we can use TDOA localization even with signals from the
K band intended for satellite communications. Satellite communications are becoming crucial in military operations,
as they can provide internet connectivity and communication capabilities even in remote areas or where ground
communications structures are damaged [6]. Therefore, being able to localize satellite terminals based on their
uplink transmissions can prove to be an important tactical advantage.

On the other hand, it is worth noting that TDOA localization systems need at least three receivers (as opposed to
minimum two for DF) with a stable network connection between them in order to transfer the data needed to
perform the cross-correlation.

Table 1. Comparison between TDOA and DF localization.

TDOA Localization DF Localization

SNR Works even in low SNR Needs good SNR

Antennas Works with COTS antennas Needs bulky, complex DF antennas

Frequency Limited to the frequency range of regular Limited to the frequency range of DF
antennas antennas (typ. up to 8 GHz)
Number of receivers Needs min. 3 RXs Needs min. 2 static RX or 1 moving RX
(e.g., in a drive test)
Geometry of receivers Best if source within the area defined by Flexible
the RXs; RXs cannot be placed in a line
Signal bandwidth Works best with WB signals Preferably NB signals

Conclusion
In conclusion, TDOA localization can be an important ally for passive source localization. It is especially useful in cases
in which we need to monitor possibly weak signals with lean, wideband, COTS antennas. The accuracy and precision
of TDOA localization can easily reach tens to hundreds of meters in regular applications. Therefore, TDOA localization
can mitigate some of the disadvantages of DF or even complement it in hybrid localization method.

References
[1] Reducing the Noise Floor and Improving the SNR with Cross-Correlation Techniques, by Jithesh Srinivas, Zurich
Instruments. Link: https://www.zhinst.com/ch/en/blogs/how-reduce-noise-floor-and-improve-snr-employing-cross-
correlation-techniques
[2] Direction-finding antennas from Rohde and Schwarz. The maximum frequency covered is 8500 MHz, by the
R&S®ADD597 antenna. https://www.rohde-schwarz.com/products/aerospace-defense-security/direction-finding-
antennas_334198.html
[3] Alaris DF antennas cover frequencies up to 8 GHz. https://alarisantennas.com/by-application/direction-finding/
[4] CommsAudit DF antennas currently have a maximum range of up to 6 GHz.
https://www.commsaudit.com/product/antennas/
[5] “The world’s first VHF-UHF direction finding antennas for all polarizations,” Rohde & Schwarz. Link:
https://scdn.rohde-schwarz.com/ur/pws/dl_downloads/dl_common_library/dl_news_from_rs/194/n194_DDF0xAE-
DDF195_e.pdf
[6] Starlink satellite services in Ukraine, Wikipedia. Link:
https://en.wikipedia.org/wiki/Starlink_satellite_services_in_Ukraine
7