TDOA Future Evolution

TDOA Future Evolution

Thursday, 07 November 2019

Who are we?

CRFS creates deployable technology to detect, identify and geolocate signals in complex RF environments.

“

Our RFeye systems are used worldwide by regulatory, military, law enforcement and intelligence agencies

“

Positioning

Geo location is the ability to pin point a transmission in 2 or 3 dimensions. “

DF generally gives a bearing to a transmission e.g. an angle from the sensor to the transmitter – hence does not directly geo locate position of transmission.

“

“ Our RFeye systems are used worldwide by regulatory, military, law enforcement and intelligence agencies

4

Spectrum Monitoring, Intelligence& Geolocation SolutionsGeolocation Methods - AOA

AOA• Responds to any RF transmission type e.g. CW as well as

modulated/burst• Most effective for narrowband signal.• Location uncertainty increases at larger ranges.• Array required – Size, Weight and Power• 2 Fixed for mobile target or 1 Mobile for fixed target.• Redeployable for FOB, tactical & Vehicle mounted• Rugged – fit and forget• Onboard autonomous intelligence

• - signal power based does so detection limited by noise floor of receiver

• - currently does not use any phase information or correlation techniques

• - antennas get large for frequencies below 500MHz e.g. 100MHz antenna 0.7mx0.7m

• - Prone to Multipath measurement error.

https://www.crfs.com/white-papers/principles_of_geolocation_techniques/https://www.crfs.com/videos/geolocation-webinar/

CRFS Spiral Antennas Internal Omnidirectional

Antenna – External connections

also available

VHF Extender

Spectrum Monitoring, Intelligence& Geolocation SolutionsAOA Deployments

5


6

Spectrum Monitoring, Intelligence& Geolocation SolutionsGeolocation Methods - POA

POA• simple technique using synchronous sweeps to

determine instantaneous power• useful for in building or short range geo

location• responds to any RF transmission type e.g. CW

as well as modulated/burst• Minimum of 3 Nodes

- Only useful within a few hundred metres of source

- effected by shadowing and fading e.g. requires planning and calibration

- Requires timing synchronisation system – in building wired system


Metal plate

Sensor

Antenna

Cable connector

SyncLincInterface Module

Ceiling Tile Senso

Spectrum Monitoring, Intelligence& Geolocation SolutionsTDOA


8

Spectrum Monitoring, Intelligence& Geolocation SolutionsTDOA

General Overview of a TDOA measurement

1. A modulated signal is transmitted from an unknown

source.

2. The signal is captured at three or more probes at

various locations around the source.

3. The signal captured at each probe is shifted in time

to find a position of maximum alignment.

4. The time shift necessary to align each signal is

multiplied by the speed of light to get a distance

difference between each probe.

5. The distance difference is plotted as a set of

hyperbolic lines.

6. The intersection of the lines indicates the location of

the source

Emitter on intersection of two hyperbolas

Two receiver 2D TDOA Three receiver 2D TDOA

Emitter on hyperbola of constant difference in distance from the two nodes

Four receiver 3D TDOA

Emitter on intersection of three hyperboloids

Spectrum Monitoring, Intelligence& Geolocation SolutionsTDOA – Intersection of Hyperbolas


10

Spectrum Monitoring, Intelligence& Geolocation SolutionsGeolocation Methods -

TDOA

TDOA• Best for wideband burst signals• Ideal for wide area• No Array required – lower Size, Weight and

Power• Minimum of 3 nodes for 2d TDOA• Minimum of 4 nodes for 3d TDOA• Operates below noise floor

- requires relatively long bursts with good correlation properties

- requires three or more stations for RF emitter positional fix

- requires timing synchronisation to operate –GPS or in building wired system


Spectrum Monitoring, Intelligence& Geolocation SolutionsGeolocation Methods -

TDOA

12

• Passive RF sensing platforms take advantage of the ubiquitous nature of

• Wireless communications and prevalence of active radar systems to gather intelligence

Passive Airborne Detection

STEALTH AIR & GROUND JAMMER COMMERCIAL FLIGHT UAS/UAV BORDER MONITORING LOW EARTH ORBIT

Spectrum Monitoring, Intelligence& Geolocation Solutions3D TDOA Applications

• Passively track airborne objects including UAS and aircraft

• Real-time update on object longitude, latitude, altitude and speed

• ‘See without being seen’ and ‘Locate without being located’

Spectrum Monitoring, Intelligence& Geolocation SolutionsRFeye® 3DTDOA

3D aircraft and UAS tracking

Layout affects accuracy – want a disperse laydown.

3D TDOA needs at least four receivers and 2D needs at least three. Additional receivers increase location accuracy and coverage. System can select best combination for a given emitter location.

Best accuracy if emitter is within sensor network footprint.

Baseline size and receiver locations define the working volume for good airborne emitter geolocation accuracy.

Vertical ceiling for best results ≈ 1 x network baseline

Horizontal diameter for best results (from network centroid) ≈ 2 x network baseline

Baseline

1x baseline

2x baseline

NodeOptimum Altitude Accuracy Ceiling

Network Boundary

Spectrum Monitoring, Intelligence& Geolocation Solutions3D TDOA Network

• Established emitter geolocation technique:• Network of distributed omni-directional receivers• Measure precise time a transmission is received at each location• Use time difference of arrival to determine transmitter location

• Also referred to as Wide Area Multilataration or Passive Detection (PD)• Well-established approach for terrestrial emitters (2D)• Emerging use for commercial airport (passive) and wide area surveillance

Spectrum Monitoring, Intelligence& Geolocation Solutions3D TDOA

• Do nodes need to be on different elevations for 3D TDOA?• No, 3D TDOA does not need nodes on different elevations to work.• Nodes can be on different elevations but it isn’t required.

• Can Nodes be airborne and/or moving?• Yes. The node’s position in space is known at the time of the capture and is used in the TDOA algorithm.

• Does Doppler shift impact the performance of TDOA?• Doppler shift is a function of signal frequency. Generally for signals of interest, there is little impact on system accuracy even for

supersonic aircraft.

• Isn’t TDOA very backhaul intensive?• TDOA only requires a few hundred kilobits of network connectivity to each node to work satisfactorily.• CRFS provides the option to set sample quantization to further reduce the backhaul requirements.

• What is the altitude, measured by 3D TDOA, referenced to?• No Matter where the nodes are located or at what altitude any 3D TDOA result is referenced to altitude above mean see level.

AMSL using WGS84

• What is the latitude and longitude, measured by 2D TDOA, referenced to?• The lowest node in the group that created the 2D geolocation is projected onto a surface offset with respect to WGS84 to obtain

the latitude and longitude result

Spectrum Monitoring, Intelligence& Geolocation Solutions3D TDOA

Sectors Solutions Products About Us Back

Passive RF sensing platforms take advantage of the ubiquitous nature of

wireless communications and prevalence of active radar systems to gather intelligence

Applications

STEALTH AIR & GROUND JAMMER COMMERCIAL FLIGHT UAS/UAV BORDER MONITORING LOW EARTH ORBIT

17

Sample Based

CRFS software tasks the nodes to blindly capture time data on a regular basis from all nodes and send it back across the network regardless of contents.

A single geolocation is possible from one sampled data cycle

Detector Based

CRFS Software tasks the nodes to look for certain signal types and report back on signals found. Only then does the software request back processed sections of time data only pertinent to signals of interest from the relevant nodes.

Multiple instances of multiple signal types can each yield a geolocation from eachdetection data cycle

Spectrum Monitoring, Intelligence& Geolocation SolutionsSample & Detector Based

Sample based – select a frequency band containing one signal, sample the band and geolocate

Detector based – select a frequency band containing many signals and build the signal detection list to geolocate

Max bandwidth is the real time bandwidth of the receivers in use. 100MHz is possible with current generation receivers

Max bandwidth is the real time bandwidth of the receivers in use. 100MHz is possible with current generation receivers


How sample based and detector based systems are typically used

Extend Frequency Range Coverage using multiple mission instances and program individually. (Future releases will allow the user to automatically do this within Site rather than manually add)


Sample based – Frequency band sampled at loop repeat rate, data sent back every time no matter what



Capture buffer time bound by node topology and bandwidthSmaller capture window than Detector based

Loop repeat rate

Capture buffer time bound by size of buffer on node

Returned data buffer

Returned Signal Data Type 1




Requested signal detection data sent to CRFS Software after capture buffer event

Loop repeat rate

Complete capture returned every time to CRFS Software


Sample based – Frequency band sampled at loop repeat rate, data sent back every time no matter what



TDOA Geolocation

GeolocationAnalysis

2D Map

Node Signal Detection

Node Retrieval

GeolocationGeolocation

Analysis

2D Map

Optional

Optional

Data persisted on Map using Map functions

Data persisted on Map using Map functions

Data sent to map as data overlay

Data sent to map as data overlay


Air navigation band detectors originally developed :

• ADS-B• Squitter type 17 contains clear to air flight information

• Lat, Lon, Alt, Speed, Heading …• Demodulated by detector and used to test system accuracy

• TACAN/DME• Pulse pair each of 3.4us spaced 12, 30, 36us apart, unmodulated

• LINK16• NATO data link standard• Requested by customer for pilot training• Frequency hopping 6.4us bursts on 13us time grid with 5MS/s MSK modulation

• PULSE• All the above share a common pulse detection mechanism followed by custom qualification• The generic pulse detector gives direct access to the pulse detection mechanism• Qualification steps can be configured• Multiple PULSE detectors can be configured to detect different pulse profiles

Spectrum Monitoring, Intelligence& Geolocation SolutionsPulse Detection

Detector Name This can be changed to reflect the specific target e.g. DJI Mavic

Start/Stop Frequency The frequencies over which this detector is valid

Pulse Duration The length of the pulse, from start to finish, expressed in seconds

Exact Duration If checked, the matched filter is tailored to exactly this duration

If not checked, the detector will try to pair leading and trailing edges

of pulses and verify that the pulse duration lies between a defined

minimum and maximum time. The setting in this mode automatically

appear when the option is unchecked.

Detector Threshold A multiplication factor applied to the automatically derived threshold

for energy detection. Values above 1.0 decrease sensitivity whilst

those below result in increased sensitivity.

Confidence Threshold Any energy pulse failing to exceed this threshold is discarded

Analysis Bandwidth The bandwidth that will be retrieved by the client for subsequent

TDoA

SNR Threshold This determines the SNR required to be exceeded before Site will

perform a geolocation retrieval. It is not used by the detector itself.

Min/Max Signal Bandwidth Signals which fail to fall between these bandwidth limits are

discarded. NB the bandwidth is an error prone measurement so

setting this window too aggressively will result in detections being

rejected unnecessarily.

Pulse Repetition Interval The time between pulses where the pulses repeat periodically. E.g.

GSM 2G repeats every 4.2ms.

Pulse Repetition Tolerance The measurement tolerance to be applied when determining whether

a signal is snapped to the time grid defined in pulse repetition

interval. If set too tight, detections will be discarded as not falling on

the time grid.

Frequency Raster If a signal is frequency hopping over known channels, this parameter

is used to specify the difference in frequency between channels. Any

detections which are not part of a cohort with this channel separation

from the others will be discarded. The tolerance is automatically set

at 10% of channel separation.

Minimum Hits The minimum number of detections that can be accepted as valid. If

fewer detections than this occur, then all will be discarded.

Diagnostic Level Described next

Spectrum Monitoring, Intelligence& Geolocation SolutionsPulse Detector Settings

Setting the pulse detector for initial use is best

accomplished by following the steps listed:

•Record an off-air signal containing examples of the signal

to be detected in xdat format

•Examine the captured signal using RFEye Deepview

•Identify the pulses from the graphical display and measure

their time and frequency characteristics

•Create and configure the detector

•Turn on the debug so that the detection stages can be

examined

•Run the pulse detector with these settings, saving the

returned debug data to disk

•Use the diagnostic data to fine tune any settings

•Once finished, turn off diagnostic reporting

Spectrum Monitoring, Intelligence& Geolocation Solutions

Bespoke Pulse Detector

52.2455° N 0.1035 ° E2116ft5.8GHz, 29/5dBm

52.2465° N 0.1032 ° E76ft5.8GHz, 29/5dBm


RFeye® 3DTDOAUAS and aircraft tracking

All air traffic over Buffalo in a 48 hour period.Flight tracks can be filtered by time, altitude, range, etc.

First point on flight path

Nth point

Shade denotes relative age of last update – darker shade is older


Passive Detection of Commercial Aircraft

https://youtu.be/mjw7weIVFmc


Here we see a Link-16 emission revealing an aircrafts flight path over the UK in real time

ADSB 2 signals shown in Green, with Tacan blue and Link-16 in Red

• Network baseline~ 120km

• 10 nodes• Simultaneous

tracking of multiple emissions


Multi-mission

Here we see a Link-16 emission revealing an aircrafts flight path over the UK in real time

• Aircraft transmitting Link-16• Time indicating presentation• Blue is oldest• Red is most recent• Aircraft was not transmitting either

DME/TACAN or ADS-B• Second aircraft entered from north

after first aircraft departed area

Time:0123456789

1011121314151617181920


Flight path v time


900 km

Median location error box (to scale)

?

• Comparison of 3D TDOA position with decoded GPS ADS-B position

• Scale (median location error):• Within node boundary: <

200 m• Green: < 500 m• Yellow: < 5 km• Red: < 10 km

• Black squares in each region represent the above dimensions

AccuracyHow Accurate is RFeye 3DTDOA

Example Walkera Devo 10 Controller with RX1002 Receiver used in many common commercial UAV

http://store.walkera.com/index.php?route=product/product&product_id=359

Spectrum Monitoring, Intelligence& Geolocation SolutionsDrone Detection

RF Signature of DJI MAVIC captured using RFeye Sens

Analysed in RFeye DeepViewsoftware


Parameters entered into RFeye SITE


Detection waterfall, Single Rx, Rural environmentColour – detection SNR

Detection in busy environment.

Detection waterfall

Crisp and clear signal extraction



RF

RADAR

EO

Size

Below L.o.S

Design

Radar Targeting

Jamming

RF: Passive sensing, High POI. Capable of scanning wide frequencies with low network utilization and autonomous capability.

Radar: Active sensing, always visible. Multiple well known counter measures.

Electro Optical: Must be facing the threat. Passive sensing.

‘See without being seen’ and ‘Locate without being located’

Multi Layer SensingDefeat Countermeasures

• Four receivers• ~ 70 km baseline• Located in Buffalo,

New York

~ 70 km


RFeye® 3DTDOA DeployedPassive Detection Using ADS-B Around Buffalo, NY, USA



Spectrum Monitoring, Intelligence& Geolocation SolutionsFull Passive RF Detection

Solutions

Accuracy Excellent (⌀ 3Km)

Accuracy Good (⌀ 6Km)

Accuracy Advisory (⌀ 12Km)

Node (Baseline ⌀ 1Km)

GPS JammerKrasukha-4

RADIO

GSM

RADIO

IED JAMMER

SAT PHONE

LINK16

DJI Phantom

Thank You

Contact InformationWebsite: www.crfs.comEmail: [email protected]

CRFS and RFeye are trademarks or registered trademarks of CRFS Limited. Copyright ©2018 CRFS Limited. All rights reserved. No part of this document may be reproduced or distributed in any manner without the prior written consent of CRFS. The information and statements provided in this document are for informational purposes only and are subject to change without notice. Document number CR-002228-MD

CRFS Inc4230-D Lafayette Center DriveChantilly, VA 20151, USATel: +1 571 321 5470

CRFS LtdCambridge Research ParkCambridge, CB25 9TL, UKTel: +44 1223 859 500

TDOA Future Evolution

Documents

Transcript of TDOA Future Evolution