This is a demonstration of RF Geolocation using a network of RF sensors.
We will be using the N6841A RF Sensor, which has a frequency range of 20 MHz to 6 GHz with
an information bandwidth of up to 20 MHz.
It has half a gb of capture memory, DC power, and two antenna inputs.
The sensor has built-in GPS for location and timing, and the IEEE 1588 network time-sync
protocol for time reference in situations where GPS is either unavailable for not desirable.
The sensor is designed for outdoor deployments, and comes with sensor management software
and an open programming interface.
We will also be using the N6854A RF Geolocation Server.
It is designed to locate non-cooperative RF emitters, using the TDOA algorithm with up
to five sensors.
We can locate narrow or wideband signals, and even signals below the noise floor.
The algorithms are appropriate for a sensor network deployed in rural or high, multipath
urban environments, over an area a square kilometer to hundreds of square kilometers.
They also support fixed or land mobile sensor networks, and can operate in conjunction with
the E3238S search system.
Let’s first review the basic principles of time difference of arrival geolocation.
Here we have two receivers, R1 and R2, and a signal source, S.
The signal will arrive at the receivers with a time difference that is a result of the
difference in distance between the signal source and each of the receivers.
And knowing the difference in distance tells us that the signal emitter must be somewhere
on the hyperbolic line, shown in red.
If we have three or more receivers, we can locate the signal source by looking at the
intersection of two or more hyperbolas.
It’s important to note that TDOA geolocation accuracy is affected by geometry.
Transmitters which are surrounded by receivers can be located more accurately than transmitters
that are outside of the receiver network.
At distances far from the receiver network, the lines of constant time difference run
nearly parallel, so the time difference of arrival algorithm cannot provide a geolocation,
but rather a line of bearing towards the signal.
For this demonstration, we will be using seven sensors which are installed in downtown London.
Because the RF sensor is small, weatherproof, and only requires a DC power and land connection,
the insulation can be relatively low-impact on the building and neighborhood areas.
Here it’s installed on a safety railing next to some, uh, air conditioning equipment.
At this site, it is mounted on an existing TV antenna mast, amongst other antennas.
And at this site we have a temporary tripod weighted down with sandbags.
If we look at the sensor management tool, we can see the location of these seven sensors
in downtown London.
And if I switch to the dashboard view, I can see that all seven sensors are online and
current, uh, and synchronized with GPS.
So let’s switch into our TDOA view.
And let’s make a measurement with the sensors at Excel, Holborn, Peckham, and Rotherhithe.
I will select a center frequency of 102.8 MHz, and we will use about 2,000 samples.
I will set the system to trigger in six seconds, and press Start.
Okay.
The hotspot on the map shows the estimated position of the transmitter.
In this case, it is a little bit on the edge of our sensor network, so let’s set up another
measurement.
We’ll remove the sensor at Holborn, and add Shoreditch.
That is a little bit better.
Let’s make another change and remove the sensor at Peckham and add Stratford.
Now we have an excellent measurement geometry for locating this particular transmitter.
Remember that we will receive the best accuracy when the transmitter is surrounded by the
sensor network.
I will set the geolocation system to automatically repeat measurements so that we can get an
idea of the variations in the estimated position with real-world issues like noise and multipath,
and even dynamic multipath off of moving vehicles.
At this scale, the geolocation results look very repeatable.
Let’s zoom in and take a closer look.
We asked for 2000 points at around 160 kHz bandwidth.
So each one of these measurements is based on about 10 milliseconds of time data.
This particular signal is actually a pirate, unlicensed FM radio station.
For each measurement, the geolocation server saves the measurement parameters and the time
data in a database.
I will recall one and re-scale the map.
This signal was far outside the network, towards the south.
Now let’s make a new measurement.
I will select the frequency of a burst transmitter.
And notice we have IF triggering selected.
The sensor network will wait for the signal to appear before capturing.
Now the system is armed and waiting for a burst.
If any of the five sensors detects the signal, it will trigger all five sensors to make a
measurement.
Okay.
We captured a signal.
Let’s zoom in on the geolocation and look a little closer.
Oh, we just captured another burst.
If we look at the spectrum, we see that this signal is only about 2 or 3 kHz wide.
So the correlations are quite broad.
And, in the time domain, we can clearly see where the burst started.
And we captured about 125 milliseconds.
Now let’s look at another signal, this one at 162.275 MHz.
We will use a span of 12.5 kHz.
So it is another narrow band signal.
And this is a good demonstration of the repeatability of measurements done on signals that are far
outside of the sensor network.
You can see that we are using five sensors.
And, if we look at the time series, we’ll notice that the amplitude from the sensor
at Excel is quite a bit lower than the others.
But that’s as expected because the transmitter is on the opposite side of the city.
That concludes our demo of the N6854A RF Geolocation Server.
Thank you for your interest.