KiwiSDR TDoA Direction Finding Now Freely Available for Public Use
A few weeks ago we posted about some experimental work going on with Time Difference of Arrival (TDoA) direction finding techniques on KiwiSDR units. The idea is that public KiwiSDRs distributed around the world can be used to pinpoint the physical locations of any 0 - 30 MHz transmitter using the TDoA technique. This feature has recently been activated and can be accessed for free via any KiwiSDR.
The KiwiSDR is a US$299 HF SDR that can monitor the entire 0 - 30 MHz band at once. It is designed to be web-based and shared, meaning that the KiwiSDR owner, or anyone that they've given access, can tune and listen to it via a web browser over the internet. Many public KiwiSDRs can be found and browsed from the list at sdr.hu or by signal strength and location on this website.
One thing that KiwiSDRs have is a GPS input which allows the KiwiSDR to run from an accurate clock, as well as providing positional data. Time Difference of Arrival (TDoA) is a direction finding technique that relies on measuring the difference in time that a signal is received at over multiple receivers spread out over some distance. In order to do this an accurate clock that is synchronized with each receiver is required. GPS provides this and is able to accurately sync KiwiSDR clocks worldwide.
Just recently all KiwiSDRs were pushed with a beta update (changelog) that enables easy TDoA direction finding to be performed with them. Since many KiwiSDRs are public, this means that right now anyone can browse to a KiwiSDR web interface and start a direction finding computation. You don't even need to own a KiwiSDR to do this so this is the first freely accessible RF direction finding system available to the public. This could be useful for locating signals like numbers stations, military transmissions, pirate stations, jammers and unknown sources of noise.
![KiwiSDR TDoA Interface](https://www.rtl-sdr.com/wp-content/uploads/2018/07/kiwisdr_TDOA_test_stanag-1024x494.png)
Usage
Running a TDoA job is as simple as using the KiwiSDR OpenWebRX GUI interface to select a signal and choose two or more receivers to use in the calculation.
If you want to try this out then it's easiest to start with VLF/LF or MW stations (less than 1.6 MHz) as these signals tend to propagate to receivers only via direct ground wave. HF sky wave signals are a bit more difficult to locate as they tend to travel longer distances by skipping, bouncing and refracting around the ionosphere, so it is difficult to determine exactly where they are coming from since the bounces result in a difficult to predict time delay. But if you know the rough location of the transmitter, you can try and select nearby KiwiSDR receivers, which will hopefully ensure that the signals are received directly via ground wave, and not via sky wave. More advanced users could try using receivers spaced further away, but at similar distances from the expected transmitter location. This will hopefully ensure that all the receivers have identical skip distances, and thus identical delays.
![Skywave and Groundwave Propagation](https://www.rtl-sdr.com/wp-content/uploads/2018/06/radio-propagation-skip-zone_566x298.jpg)
To get started follow these steps (and we also recommend reading the Help text, which is available by clicking the 'Help' button on the TDoA extension):
- Open a KiwiSDR that can receive some signals that you are interested in locating. You can browse KiwiSDRs by map and signal strength quality on this website.
- With the 'extension' drop down menu in the bottom right controls window choose TDoA and double check that the receiver modulation mode is set to 'IQ'.
- You should now see a map on the top half of the screen. This map displays all KiwiSDRs in the world that have GPS enabled and thus can be used for TDoA.
The map also displays several known transmitters in white with green markers that can be used as TDoA practice. Clicking on a known transmitter will automatically tune the KiwiSDR to that station.
- Tune to the signal that you are interesting in locating. Make sure that the receiver bandwidth covers the signal.
- Now you need to find two or more KiwiSDRs on the map that can receive the signal that you're interested in locating. (Two will give you a line of possible locations, whilst three may allow you to pinpoint the signal. But we recommend starting with only two or three first as more receivers can cause the calculation to fail).
To test and see if a KiwiSDRs from the map can receive the signal, double click on its marker. This will open the selected KiwiSDR in a new browser window, with it tuned to the station of interest. If you have a rough idea on where the transmitter is located, try to select KiwiSDRs such that they surround the transmitter.
- Once you've found a KiwiSDR that receives your signal of interest, close the second KiwiSDR receiver window that you just opened, and go back to the original KiwiSDR window. Now instead of double clicking just click once on the KiwiSDR pin on the map that you confirmed reception with. This will add that KiwiSDR to the window in the bottom left. This window displays the KiwiSDRs that will be used in the TDoA calculation.
Make sure that it shows "XX GPS fixes/min" beside a selected KiwiSDR. If you get an error, remove that KiwiSDR and choose another.
- When you've found two or more KiwiSDRs that receive the signal of interest, position the map to where you'd like the TDoA result heat map to be displayed. The positioning of the KiwiSDR map will determine where the TDoA heat map plot is displayed.
- Click the 'submit' button to begin the TDoA calculations. The KiwiSDR server will gather 30 seconds of samples from each of your selected KiwiSDRs, and then run the TDoA algorithm on the KiwiSDR server. The whole process should take about 1-3 minutes to complete.
- Once completed you can view the results by using the drop down menu next to the submit button to choose the 'TDoA Map'
![KiwiSDR TDoA Results](https://www.rtl-sdr.com/wp-content/uploads/2018/07/kiwisdr_TDOA_test_stanag2-1024x515.png)
The KiwiSDR TDoA feature is still in testing and can be a little buggy. If you get "Octave Error", try refreshing the KiwiSDR page and trying again with different receivers. Sometimes you'll also get an error saying that the GPS of a KiwiSDR hasn't updated in a while. In this case just remove that receiver and choose another one. We also find that if you're zoomed too far out on the map, the TDoA algorithm will sometimes return 'Octave error'. Try zooming in a bit closer to the approximately expected location. KiwiSDRs can also only support four simultaneous users at a time, so during peak periods it's possible that some may become busy.
Over on the KiwiSDR forums Martin G8JNJ has also provided a list of helpful tips that he's discovered. For example he recommends choosing KiwiSDRs that are spaced evenly around the estimated transmitter location (if known). Ideally they should also be chosen an opposing pairs (e.g. one pair north and south of the transmitter, and one east and west of it).
Results
We tested the new TDoA feature a few times. Below are some examples of the results we achieved.
USA: NLK @ 24.6 kHz.
This is a Naval transmitter located in Seattle, Washington. With three receivers surrounding the transmitter, we were able to get a pretty close location marker, that is confirmed with the known location.
![USA NLK](https://www.rtl-sdr.com/wp-content/uploads/2018/07/kiwisdr_usa_nlk-700x472.png)
Europe: DCF77 Time Beacon @ 77.5 kHz.
This is a German long wave time beacon transmitter. Again with three receivers we were able to pinpoint the signal fairly accurately.
![DCF77 Located with KiwiSDR TDoA](https://www.rtl-sdr.com/wp-content/uploads/2018/07/DCF77-700x472.png)
Australia: Local MW Radio Station @ 549 kHz.
Here we tried to locate an Australian MW station. Unfortunately in Australia there is a lack of KiwiSDRs, and of the ones that are there, only three had GPS enabled and could receive the MW station, and two of those were right next to each other. With only effectively two stations we could only obtain a line of possible locations. Comparing with the known location plotted on Google Maps we confirmed that the transmitter is indeed located on the line.
![ABC Western Plains Australian MW Radio Station](https://www.rtl-sdr.com/wp-content/uploads/2018/07/kiwisdr_australia-700x498.png)
We also tested a few signals at higher frequencies. As mentioned previously, anything above VLF/LF/MW (ie the HF bands) is a lot more difficult to locate since the signal can bounce around the atmosphere and can case extra delays to occur in the signal arrival time. The extra delays can cause problems with the time of arrival measurements. Thus for these signals it's important to find receivers close to the transmitter, or receivers spaced further away at the same distance so they each have identical skip distances, and thus identical delays.
When locating an HF signal that is in a completely unknown location we recommend starting with only two or three receivers, checking the heat map, and slowly adding more receivers in the hot parts of the heat map and removing receivers that turn out to be in the cooler areas. This way you can slowly narrow down the receivers to ones that are closer to the signal source, and are thus more likely to receive the signal directly, rather than via ionosphere bounces.
The Buzzer (UVB-76)
Using the just previously mentioned technique we attempted to locate the source of the Buzzer (UVB-76), a Russian numbers station at 4.625 MHz. Eventually we came to the results shown below. According to the heat map the buzzer appears to be located somewhere in the vicinity of St. Petersburg. Back in 2014 the numbers station researchers at priyom.org received an anonymous tip from a member citing a transmitter location just north of St. Petersburg. The TDoA heat map results seem to confirm that the anonymous tipper is correct.
![The Buzzer (UVB-76)](https://www.rtl-sdr.com/wp-content/uploads/2018/07/buzzer_located_tdoa-700x472.png)
Final Words
Right now the biggest problem appears to be the lack of active KiwiSDRs around the world. The more active KiwiSDRs there are, the better the direction finding results can be. At the moment Northern Europe and the USA are fairly well represented, but the rest of the world is not. Asia, Africa, Russia and South America are especially lacking. Also not all KiwiSDRs are utilizing the GPS feature. If you are running a KiwiSDR please do consider activating the GPS option. Another issue is that many KiwiSDRs suffer from poor reception and bad antenna setups, so not all active receivers are actually useful.
In the future we expect this feature to only improve, with the people behind it, John Seamons and Christoph Mayer, working hard to improve results. For example one possible future improvement is utilizing ray-tracing techniques to try and take into account delays caused by sky-bounce propagation. Update (15 July 2018): You can now also plot results over Google Maps.
If you want to purchase a KiwiSDR and contribute to the worlds first freely accessible TDoA system, you can purchase it immediately on Amazon or Seeed Studios for $299, or wait for a sale to occur on massdrop.com, where it is often discounted by up to US$100.
Can any of the KiwiSDR receiver sites with (GPS Clocks for ToA resolving) handle transmitters operating in SSB mode? 73s! Josh-KF4BF
I think you were close.
The signal is probably coming from Nato HQ near Mons Bergen.
Hey… someone get on 7.200 mHz and clear out some of those fowl mouth CBer want to be HAMs.
Ok, lets see if this works, in the 120 m Shortwave band a signal 2381 Khz, Using the heat map I was able to eliminate certain receivers out of the equation, so I used these receivers, “JO20iu websdr.ucll.be:8073” “JO10qm hainaut-picardie.ddns.net:8073 ” “JN37af javaradiofrance.ddns.net:8073”
I got this location on the map 50°24’00.0″N 4°15’00.0″E a location in Belgium.
After a little hunting I saw the shadow of this rather large Antenna in at this exact location, 50°22’55.1″N 4°14’31.4″E , only for the shadow it would be rather difficult to find and the antenna is large.
So what do people reckon , is this the signal I hear on the 120 Meter SW “commercial” band of 2381 Khz ? This signal has been broadcasting for a long time and should it really be in the commercial band like so many other signals ? This could be useful for hunting down these unwanted signals in the broadcast bands.
If this is the signal from this transmitter then I must say that I’m bloody well impressed !!!
Hi Mark. That signal at 2381.4 is STANAG 4285, a well-known milcom data transmission format. The antenna you found is identified on Wikimapia as a TV/FM broadcast tower: http://wikimapia.org/#lang=en&lat=50.381972&lon=4.242056&z=19 If you click on the antenna image the annotation overlay will take you to a website with all the details and good photos of the antenna. I don’t think it’s very likely that commercial V/UHF and milcom HF transmission would occur from the same facility. But who knows.
STANAG signals have been traced previously by others via TDoA to this location in The Netherlands: http://wikimapia.org/#lang=en&lat=51.807381&lon=3.893023&z=16&m=b Probably Dutch Navy and/or NATO. When I used the Kiwis F1JEK, DF0KL and M0TAZ during daylight when the signal had no fading I got a location within 20 km of there. So that would be my guess.
Does commercial broadcast have exclusive use of the 120 m band in the EU? It could be that STANAG is there because the band has shared allocation.
Thanks for the WiKi link, it will be very useful.
I was way off the mark on that one, I will need to play around with it more ! 🙂
The displayed “most likely position” lat/lon marker is a bit deceiving in some cases. You really have to evaluate the quality of the TDoA solution to decide if the MLP marker is useful or not. Sure, if you get a heat map where the red/green area and contour lines are contained in a small space then you can be pretty confident in the solution.
One of the best things to do is examine the individual sub-maps of the results menu. So if you’ve used three Kiwis, 1, 2 and 3 look at the menu entries called “1-2 map”, “2-3 map” etc. and not just the “TDoA map” and “TDoA combined” entries. If any one of the pair maps has contours much wider than the others it will significantly effect the accuracy of the result. By looking at the pair maps you can determine which sampling Kiwis are not ideal and should be replaced on a further run. A new document by Nils, DK8OK, talks about these ideas in detail: https://dk8ok.org/2018/07/25/direction-finding-first-experiences
Hello,
Great work. Congratulations. Even my thesis work aims at “Detection of HF radio transmitters using passive geolocation techniques.” We have a receiver network (4 receivers) deployed across France capable of synchronously capturing signals from the HF band. From our experimental campaign we could observe that HF geolocation could be achieved using the TDoA method. The captured signals were actually broadcast signals and thus their properties were completely unknown, still we could locate the Tx with an error of about 5 km in some cases. We captured signals from HF broadcasters which fall within the range of one-hop propagation from the receivers.
I would like to know if you had information about the signal type you received using the SDR modules and how the obtained TDoA was translated to obtain the ground range? Did you use the ionospheric profile to obtain the reflection height?
I will wait for your reply. If it’s okay, maybe we can have a discussion through skype?
Regards,
Ankit Jain
Ankit,
Christoph Mayer is the author of the TDoA algorithm and there is additional information over on his blog: https://hcab14.blogspot.com
Note the article say NLK on 24.6 kHz. The actual frequency is 24.8 kHz.
Kiwis running the latest software release (>= v1.204) now plot the TDoA output onto a Google map instead of the “coastline” maps you see above. This allows you to immediately zoom-in after a TDoA run and start looking for any possible transmitter/antenna site.
I am blown away by this. Could a downconvertor be used so that VHF and UHF stations can be located? Would it be sufficient to phase lock the LO with GPS derived 10 MHZ clock? I would like to see some local stations with TDOA capability at VHF and above.
They are not on sdr.hu at the moment, but in the past we had a couple of Kiwis using 6 and 2m downconverters. The Kiwi supports re-mapping the frequency scale and entry to allow this.
I don’t know if the current TDoA would work in this case or not. Locking the converter LO to GPS may not even be required as long as short-term drift/jitter is not significant over the 30 second TDoA sampling period. You don’t really care about the frequency accuracy. It only matters that the precise time is known as samples are recorded.
As we are trying to locate a transmitter location, what counts is the output frequency of that transmitter.
As the downconverter is located at the receive end, this does not help at all in finding the location of the transmitter.
Tim KI7ZIE
A most fascinating and useful technology. I wonder if this might have applications in the field of search and rescue? Say for example you have a missing hiker in a vast wilderness area. The hiker was known to be carrying a cellphone, but there is no cell reception in the area. If his phone is turned on, even with no base station nearby to connect to, it will still periodically send out signals and wait for a response from a cell base station. Most if not all modern cellphones communicate over frequencies above 2 GHz but unlike atmospheric bounce signals they are not terribly powerful and designed to be strictly short range communications, so perhaps several mobile KiwiSDR’s could be deployed around the periphery of the area the hiker is believed to be lost in and the computers running a program that automatically links to the other KiwiSDRs in the search and listens for these periodic signals and calculates a likely position when one is received. The same idea could be useful for locating downed aircraft, missing ships at sea, locating tagged pets or wildlife, finding lost persons with transmitting devices other than cellphones (FRS/GMRS radios, PLBs, EPIRBs etc…).
KiwiSDR covers 0 to 30 MHz, so what you’ve suggested might work if the hiker happened to have a phone that works in that range.
I think (or at least hope) that search and rescue teams use some some kind of radio based direction finding when they are trying to find a person who is likely to have a transmitter on them. However most phones work on similar frequencies so it’s hard to tell whether you just located a member of your team or the person you’re looking for.
You made the assumption that it’s the radiated power that is the limiting factor “they are not terribly powerful and designed to be strictly short range communications”.
Cell phone bands vary with region, but start around 900 MHz. At such high frequencies we are limited to Radio Line Of Sight (RLOS) coverage or D (km) = 4.13 (squareroot of transmitt station [m] + squareroot of transmitt station [m]) under normal propagation conditions. The optical LOS is slightly smaller and you have to replace the 4.13 by 3.52 to calculate it.
Increasing the Effective Radiated Power, either by increasing transmitter output power into the antenna or increasing antenna gain, doesn’t help. RLOS is thelimiting factor, other wise Secondary Surveillance Radar with antenna gains of about 27 dBi should not be limited by RLOS. For the same reason even highflying aircraft cannot be interrogated after a few hundred NM varying with FL.
Directional finding of a phone on a lost hiker is feasible, but certainly not practical for your usual search-and-rescue (SAR) team. As noted, the transmission distance at ground level is limited (depending on terrain, on the order of 1 – 10km). If the receiver was in an aircraft or other high location, this could be perhaps 20km or more.
As a previous posted noted, the frequency ranges used for cell phones starts at 900Mhz, but depending on phone carrier, type of phone and such, the bands used extend to 6Ghz.
In general , the cellular frequency bands are locked out receivers available to the general public – specifically to prevent listening in to conversations. But also, mobile phones incorporate various transmission modes such as frequency hopping, that require specialized receivers to be able to follow.
There is a commercially available device by Harris Corporation, designed for use by law enforcement.
Look for information on Stingray, which is a cell-site simulator. This is used to intercept phone calls, can mimic a cell phone system (pretending to be a legitimate carrier tower), and locate a phone – long as the power is on.
To locate a specific phone, you would need the IMSI, ESN or other identifying information. Otherwise, you would also be picking up the signals from all the other mobile phones in the area, with no chance of distinguishing which was the target.
Tim KI7ZEI
Fine business !
My congratulations and thanks.
KR,
José //
CT4AN
Kiwi SDR isn’t going to DF “any” freq between 0-30 MHz. No matter how many stations you have you cannot DF NVIS. Very cool though.
“No matter how many stations you have you cannot DF NVIS”
That’s true but if you have enough stations you can DF the groundwave component 🙂
NVIS covers a wide range of distances, out to perhaps 400 miles. I have had luck with using the scheme to look stations at the further reaches of NVIS.
Supakewl
Absolutely amazing, especially the part with number stations. For many years they’ve been impossible to locate for most people and now it’s not only possible, but so easy that almost anybody can do that!
Definitely would like to see a Massdrop soon.
They’ve been happening regularly every 4-6 weeks. One just happened June 27. You can signup on their site to receive an email notification. On the first day of a new drop I also make a comment on this thread: http://valentfx.com/vanilla/discussion/700/save-money-on-another-kiwi-or-tell-a-friend-kiwisdr-is-now-available-on-massdrop-com-100-off-msrp#latest
Last drop seemed to sell-out within two days (the drop offering period is normally 7 days). The drop terms specify “limited quantities” but they don’t say how many. Last time we worked out it was about a dozen. So you have to work a bit to get your $100 discount. I think they have all these limitations because they sell so far under MSRP.
I am happy to see that my station, carefully tuned and installed in my parent’s house to be free from computers EM noise, has been taken for the demo.
Cool !
73’s de J-Luc F1JEK
We’re making improvements to the TDoA extension almost every day. Top priority is to plot the results on a zoomable Google map overlay instead of the current “coastline” map. Essentially like what you see above for the Aussie MW station. This will make it much more convenient once you have a TDoA solution to zoom into the Google satellite map and begin hunting for the antenna field. Already there have been some interesting discoveries.
For a standalone version of the interface with different features please see the directTDoA project by Kiwi contributor linkz: http://81.93.247.141/~linkz/directTDoA
Please join us on the Kiwi forum if you have any questions: http://valentfx.com/vanilla/categories/kiwisdr-tdoa-topics
Regards,
John, ZL/KF6VO, KiwiSDR