Passive RF geolocation: TDOA and FDOA techniques explained

An adversary radio that never receives an interrogation pulse cannot know it is being located. That is the operational appeal of passive geolocation: it estimates where an emitter is using only the energy the emitter itself radiates, with no transmission back toward the target. The price for that covertness is mathematical – you cannot measure range to a transmitter you do not cooperate with, so you must infer position from the differences in how the same signal arrives at several separated sensors. The two measurable differences that carry position information are time and frequency: time difference of arrival (TDOA) and frequency difference of arrival (FDOA). This article explains how both work, how they are solved jointly, what limits their accuracy, and how a geolocation engine fits into the wider SIGINT platform architecture.

Why passive, and why differences

Active positioning systems – radar, secondary surveillance, GPS – work because the system controls one end of the timing. The interrogator knows when it transmitted and measures when the reply returns; the difference is range. A non-cooperative emitter gives you none of that. You observe a signal at an unknown absolute time of emission, so the absolute travel time to any single sensor is unknowable. What is knowable is the difference in travel time between two sensors, because the unknown emission time cancels when you subtract. Differences, not absolutes, are the currency of passive geolocation.

A single TDOA measurement between two sensors does not give a point – it gives a locus. Every point in space whose distance to sensor A minus its distance to sensor B equals the measured range difference lies on a hyperboloid of revolution with the two sensors as foci. To collapse that surface to a point you need more independent measurements: additional sensor pairs (more TDOA hyperboloids), the orthogonal information from FDOA, an altitude constraint from terrain, or motion over time. Passive geolocation is fundamentally a problem of intersecting constraint surfaces while propagating measurement uncertainty.

TDOA: hyperbolas from time

TDOA exploits the finite speed of light. If a signal reaches sensor A and sensor B with a relative delay of Δt, then the difference in path length is c · Δt, where c is the propagation speed. Because one nanosecond corresponds to roughly 30 centimeters of path difference, the entire technique is gated by how precisely the sensors agree on time. The measurement itself comes from cross-correlating the two received signals: the correlation peak occurs at the lag that best aligns them, and that lag is the TDOA estimate.

Three properties of the signal and geometry govern TDOA quality. First, bandwidth – the correlation peak is sharper, and the delay estimate more precise, for wideband signals; a narrowband CW tone produces a broad, ambiguous correlation peak. Second, integration time and signal-to-noise ratio, which set the processing gain of the cross-correlation and therefore how far the peak rises above the noise floor. Third, geometry: two sensors and a target that are nearly collinear produce a hyperbola that is almost flat near the target, so a small timing error maps to a large position error. This geometric amplification is the geometric dilution of precision (GDOP), and it is often the dominant error term even when timing is excellent.

Synchronization: the hard constraint

TDOA accuracy is bounded by timing accuracy before any signal processing begins. A common time reference is mandatory. GPS-disciplined oscillators give sensors a shared clock good to tens of nanoseconds, which is adequate for many wideband applications. Where higher precision is needed – sub-nanosecond – sensors are tied together with Precision Time Protocol (PTP) or White Rabbit over fiber, distributing a common reference that holds the network coherent. Whatever the distribution mechanism, a residual clock bias always remains, and a robust solver treats inter-sensor clock offset as a nuisance parameter to be estimated jointly with position, using a known reference emitter when one is available for calibration.

FDOA: isodoppler curves from frequency

FDOA exploits the Doppler effect. When a sensor moves relative to an emitter, the received carrier is shifted in frequency proportionally to the radial velocity between them. Two sensors with different velocity vectors relative to the same emitter observe different Doppler shifts; the difference between those shifts is the FDOA. Like TDOA, the unknown transmit frequency cancels in the difference, so FDOA is measurable even when the emitter's true center frequency is unknown – provided the sensors share a precise frequency reference.

Each FDOA measurement defines an isodoppler surface – the locus of emitter positions producing the observed frequency difference for the given sensor positions and velocities. Crucially, isodoppler surfaces are oriented differently from TDOA hyperboloids. Where TDOA constrains position along the baseline between sensors, FDOA constrains it according to the geometry of relative motion. This orthogonality is why the two are powerful together: a TDOA-only solution may be poorly conditioned in one direction that FDOA constrains tightly, and vice versa. FDOA also shines for narrowband signals, where TDOA timing resolution is weak but long-integration Doppler resolution stays sharp.

The cross-ambiguity function

TDOA and FDOA are usually measured together in a single operation: the complex cross-ambiguity function (CAF). The CAF correlates two sensor signals across a two-dimensional grid of candidate time delays and frequency offsets, and its peak gives the joint TDOA/FDOA estimate for that sensor pair. The CAF is computationally heavy – a delay-by-Doppler surface for each pair, over long snapshots – which is one of the reasons geolocation engines lean on GPU acceleration, exactly as the channelization and classification stages do. The sharpness and height of the CAF peak also yield the measurement covariance that the downstream solver needs to weight each pair correctly.

Solving the system

With a set of TDOA and FDOA measurements from multiple sensor pairs, the geolocation problem is to find the emitter position – and velocity, when FDOA is in play – that best explains them. The relationship between position and the measurements is nonlinear, so the solution is iterative. A typical engine first computes a closed-form initial estimate (for example, a spherical-interpolation or two-step weighted-least-squares solution) to get into the right neighborhood, then refines with a Gauss-Newton or Levenberg-Marquardt iteration that minimizes the weighted residual between predicted and measured TDOA/FDOA values.

Weighting is not optional. Each measurement carries an uncertainty derived from its CAF peak, and a maximum-likelihood solution weights measurements by the inverse of their covariance – sharp, high-SNR pairs dominate; weak pairs contribute little. The output is not just a coordinate but a covariance, which becomes the confidence ellipse the analyst sees. A fix without an error ellipse is operationally dangerous: it invites false confidence in a number whose true uncertainty might span kilometers under poor geometry. The same TDOA, AOA, and hybrid trade-offs are explored in depth in our overview of RF geolocation for defense.

Accuracy, geometry, and the CRLB

The achievable accuracy of any TDOA/FDOA system is bounded below by the Cramér-Rao lower bound (CRLB), which combines the measurement precision (a function of bandwidth, SNR, and integration time) with the geometry (the GDOP). No estimator can beat the CRLB; a well-built solver approaches it. Practically, three levers move the bound. Improving synchronization tightens the timing and frequency measurement noise. Increasing collection bandwidth and integration time raises processing gain. And improving geometry – distributing sensors so the constraint surfaces cross at large angles near the target – reduces GDOP. Of the three, geometry is the one most often neglected and most often the limiting factor, because sensor placement is constrained by terrain, platform availability, and the need to stay clear of the target's awareness.

A concrete intuition: with nanosecond-class synchronization, a wideband signal, and three or four well-distributed sensors, TDOA fixes of a few tens of meters at ranges of tens of kilometers are realistic. Degrade any one input – narrow the signal, collinear the sensors, or let clock bias drift – and the ellipse can balloon by an order of magnitude. This sensitivity is why a passive geolocation capability is as much a sensor-placement and synchronization-engineering problem as it is a signal-processing one.

The minimum sensor count depends on the dimensionality of the problem and which observables are available. With TDOA alone, each pair gives one hyperboloid; two independent baselines (three sensors) constrain a 2D fix when an altitude assumption or terrain model removes the vertical unknown, and four sensors are needed for an unconstrained 3D fix. Adding FDOA injects an independent observable per pair, so a moving pair of sensors can in principle fix a stationary emitter where a static pair cannot. In practice an engine fuses every available measurement rather than meeting a bare minimum, because redundancy both tightens the estimate and provides the residual statistics needed to detect and reject outlier measurements caused by multipath or interference.

Multipath, bias, and outlier rejection

Real environments rarely deliver clean line-of-sight signals. Reflections from terrain and structures create multipath components that arrive after the direct path, smearing or splitting the cross-ambiguity peak and biasing the delay estimate long. Urban and mountainous geometries are the worst offenders. A production solver guards against this with robust estimation – iteratively reweighted least squares, RANSAC-style consensus over subsets of measurements, or innovation gating in a tracking filter – so that a single corrupted pair does not drag the whole fix off target. The same machinery that estimates residual clock bias also surfaces measurements whose residuals are statistically implausible, which is often the first hint that a sensor has lost lock or that the assumed emitter association is wrong.

Difficult emitters: hopping, bursts, and low duty cycle

Modern military emitters are deliberately hard to locate. Frequency-hopping radios spread energy across a wide band with short dwell on each channel; burst transmitters emit briefly and go silent. Both shorten the coherent window available for cross-correlation, which weakens both TDOA timing resolution and FDOA Doppler resolution. The mitigation is statistical accumulation: detect and locate individual hops or bursts, associate them to a common emitter using classification and emitter fingerprinting, and fuse the resulting weak fixes over time with a batch or Kalman estimator. Each burst is a faint constraint; enough of them, correctly associated, converge to a tight track. Wideband collection that captures the full hop set across all sensors simultaneously is the enabling hardware requirement.

From a fix to the picture

A geolocation engine does not stand alone. It is a consumer of the signal processing pipeline – detections and time-tagged IQ snapshots flow into it – and a producer of geospatial intelligence that flows back out. Computed fixes, with their error ellipses and emitter associations, are written into the bearings and metadata databases where they correlate with classification and identification results. The product is a geospatial order of battle: not merely where signals are, but what they are and which networks they belong to. Time-sensitive tracks are pushed onward to the common operating picture for operational consumers. The architecture that surrounds and feeds the geolocation engine – collection, channelization, the bearings database, the analyst workflow – is covered end to end in our SIGINT platform architecture guide.