UL-TDoA: Uplink Time Difference of Arrival

• UL-TDoA is a network-based localization method where multiple receivers record uplink signal arrival times to derive range-difference constraints for position estimation.
• It leverages techniques like 5G SRS, passive LTE sniffing, and UWB measurements combined with multilateration and least-squares estimation for accurate localization.
• Critical aspects include precise receiver synchronization, calibration (via SoO and LO-sharing), and robust bias correction to ensure sub-meter accuracy in diverse environments.

Searching arXiv for recent and foundational papers on UL-TDoA and closely related TDoA localization systems. arxiv_search(query="UL-TDoA 5G localization OpenAirInterface uplink time difference of arrival", max_results=5) arxiv_search(query="uplink time difference of arrival localization", max_results=10) Uplink Time Difference of Arrival (UL-TDoA) is a localization method in which a transmitting source emits an uplink signal and multiple spatially separated receivers measure its arrival time; the receiver-side time differences define geometric range-difference constraints from which the source position is estimated. In 5G NR, the standardized form uses uplink SRS, ToA measurements at gNB/TRPs, and LMF-side TDoA formation followed by multilateration or least-squares estimation. Closely related realizations appear in passive LTE sniffing, UWB RTLS, LPWAN Cloud RAN testbeds, and hybrid TDOA-AOA systems, with the common structural elements being receiver diversity, inter-receiver timing alignment, and hyperbolic or hyperboloidal geometry (Malik et al., 2024, Wu et al., 2024, Amiri et al., 9 Oct 2025, Maul et al., 2024).

1. Definition, scope, and terminology

In the 5G positioning literature, UL-TDoA is a network-based uplink localization technique: the UE transmits an uplink reference signal, several gNB/TRPs measure the arrival time, and the network estimates position from the differences in those arrival times. The implementation reported in OpenAirInterface uses SRS (Sounding Reference Signal) for this purpose, with UL-RToA or ToA measured in the RAN and converted to TDoA at the LMF (Malik et al., 2024).

Across adjacent literatures, the term is used with some architectural variation. In UWB RTLS, one frequently encountered realization is a tag-blink / anchor-listen architecture in which the tag periodically emits a blink frame, anchors timestamp reception, and a central localization engine computes position from synchronized anchor timestamps. A related drone-tracking implementation describes the same operational direction as forward / uplink TDoA, again with a mobile tag transmitting once and multiple anchors listening. By contrast, other UWB TDOA papers study the reciprocal anchor-broadcast/tag-listen configuration; these are closely related in geometry and estimation, but not identical in signaling direction (Zhang et al., 2021, Ramesh et al., 2020, Zhao et al., 2022).

The measurement principle is consistent across domains. A common transmitted signal is observed at several receivers, the unknown transmit time is eliminated by differencing, and the resulting observable is a range difference rather than an absolute range. This is why UL-TDoA is attractive in settings where scalability matters: it avoids per-anchor round-trip exchanges, reduces tag complexity, and shifts timing and computation burdens to infrastructure or a central processor (Ramesh et al., 2020, Malik et al., 2024).

2. Measurement models and localization geometry

The canonical UL-TDoA observable is a range difference. In the 3-D UAV-ground formulation, the true UL-TDoA range difference is

$$r^o = \|\mathbf{u}^o-\mathbf{s}_2\| - \|\mathbf{u}^o-\mathbf{s}_1\|,$$

with noisy observation

$r = r^o + \Delta r.$

This places the source on a hyperboloid of constant range difference between the two receivers (Amiri et al., 9 Oct 2025).

In passive LTE dual-sniffer localization, the paper defines a more elaborate timing observable because each sniffer captures both the eNb downlink and the UE uplink. The measured quantity at sniffer $k$ is the downlink-uplink subframe timing difference

$$\Delta_k=T_{\text{DL},k}-T_{\text{UL},k}+\varepsilon_{\text{SN},k},$$

which leads, after elimination of common terms, to the range-difference relation

$\Delta d_{12}=d_{\text{UE},1}-d_{\text{UE},2}.$

With a second sniffer placement, a second independent range difference $\Delta d_{13}$ is obtained, yielding two hyperbola equations (Wu et al., 2024).

The geometric core is the same in standard TDoA formulations. For anchor pair $i,j$, the UWB TDOA distance-difference model is

$$d_{ij} = \|\mathbf{p}-\mathbf{a}_i\| - \|\mathbf{p}-\mathbf{a}_j\|,$$

and each such equation defines a hyperbola in 2-D or a hyperboloid in 3-D. The same geometry appears in RTLS formulations expressed as

$$\sqrt{(x-x_i)^2+(y-y_i)^2}-\sqrt{(x-x_j)^2+(y-y_j)^2}=\hat{d}_{ij},$$

and in LPWAN multilateration, where TDoA corresponds to differences in path length divided by $c$ (Zhao et al., 2022, Zhang et al., 2021, Maul et al., 2024).

The observability consequence is immediate. Classical TDoA in 2-D typically requires three synchronized receivers. Several papers therefore introduce structural workarounds. The dual-sniffer LTE system emulates the missing receiver by moving one sniffer and collecting a second TDoA equation in a different configuration. The UAV-assisted 3-D formulation instead combines one TDOA with one AOA pair, so that the TDOA supplies the bistatic range-difference constraint and the AOA removes the nuisance range term (Wu et al., 2024, Amiri et al., 9 Oct 2025).

3. Cellular realizations: standardized 5G UL-TDoA and passive LTE

The most explicit standards-based realization is the OpenAirInterface implementation of 3GPP UL-TDoA. It spans UE, gNB/NG-RAN, AMF, LMF, and an external LCS client or API. The paper follows TS 38.305 and uses NRPPa from TS 38.455, with transport procedures from TS 29.518 and TS 38.413. A key architectural point is that there is no direct gNB–LMF connection; positioning signaling is relayed through the AMF. The implemented message chain includes location request initiation, TRP Information Request/Response, Positioning Information Request/Response, Positioning Activation Request/Response, Measurement Request/Response, and Location Response (Malik et al., 2024).

At the PHY layer, the gNB performs LS channel estimation on the SRS,

$r = r^o + \Delta r.$0

then interpolation, oversampling, IFFT-based delay-domain conversion, and peak-picking on the average power delay profile. The ToA in seconds is derived from the peak delay index, and the LMF converts ToA values into TDoA, uses the TRP with strongest RSRP as the reference, and applies linear least squares followed by nonlinear least squares (Malik et al., 2024).

The passive LTE dual-sniffer system represents a different cellular lineage. It does not rely on standardized 5G LMF signaling; instead, it exploits passively observed downlink and uplink subframe timing from a commercial LTE eNb and a target UE. The paper defines the UE, eNb, and sniffers at positions $r = r^o + \Delta r.$1, $r = r^o + \Delta r.$2, and $r = r^o + \Delta r.$3, derives timing relations for $r = r^o + \Delta r.$4, $r = r^o + \Delta r.$5, and $r = r^o + \Delta r.$6, and converts the differenced measurements into hyperbola constraints. The practical novelty is that the sniffers do not need GPS synchronization, because timing offsets are removed by differencing measurements and recordings are aligned by subframe index and time frame (Wu et al., 2024).

These two cellular realizations illustrate distinct meanings of UL-TDoA in practice. In standardized NR, UL-TDoA is embedded in a control-plane procedure with LMF, NRPPa, and SRS-based PHY processing. In passive LTE localization, UL-TDoA is reconstructed from external observations of air-interface timing, without network assistance and without transmitter-receiver round-trip ranging (Malik et al., 2024, Wu et al., 2024).

4. Synchronization, calibration, and infrastructure

UL-TDoA depends critically on inter-receiver timing alignment. The LPWAN Cloud RAN testbed was designed specifically to make uplink TDoA localization in LPWANs feasible by combining remote multi-base-station IQ capture, central processing, and over-the-air synchronization using Signals of Opportunity (SoO). Each base station uses two receive channels with LO-sharing: one for the LPWAN signal and one for the SoO signal. The SoO channel is used to estimate CFO, SCO, and time synchronization offset, which are then applied to the LPWAN waveform (Maul et al., 2024).

In that system, the SoO is DAB broadcasting at $r = r^o + \Delta r.$7, and synchronization uses the cross-correlation function (CCF) of SoO streams between neighboring base stations. The reported performance is time synchronization down to 1 ns, with average standard deviation 194 ps for BS0–BS1 and 187 ps for BS0–BS2, plus frequency synchronization standard deviation 3.1 mHz and 2.65 mHz. The paper explicitly relates 1 ns to about 0.3 m in free-space distance, which is the central physical reason synchronization is decisive in UL-TDoA (Maul et al., 2024).

A later LPWAN paper addresses a different synchronization problem: frequency-hopping uplink waveforms with random burst phase resets. It states that 3 ns $r = r^o + \Delta r.$8 m, so sub-meter localization requires sub-nanosecond time synchronization, and transfers synchronization parameters from SoO reception to the localization channel via LO-sharing. SCO and time offset are transferred directly, whereas CFO scales with carrier frequency: $r = r^o + \Delta r.$9 The endpoint signal is then corrected by complex derotation for CFO and fractional resampling with a Farrow structure for SCO (Maul et al., 3 Jun 2026).

UWB systems emphasize clock synchronization and calibration in different terms. One RTLS paper organizes synchronization through Clock Calibration Packets (CCPs), master/slave anchors, and a time-base selection strategy. Another fuses TOA/TWR with TDOA so that the same message exchange provides the information needed to synchronize TDOA anchors wirelessly; the authors state that the extra message already present in TWR makes the TDOA clock calibration effectively “free.” Both approaches target the same underlying problem: TDoA range differences are corrupted by offset, drift, and hardware delay unless a shared time base is established or inferred (Zhang et al., 2021, Sidorenko et al., 2019).

The UV positioning prototype identifies a converse synchronization bottleneck: transmitter-side, rather than receiver-side, timing error. It decomposes each timing variance as

$k$0

with $k$1 attributed to atomic-clock rising-edge misalignment and $k$2 to receiver-side synchronization. The paper concludes that the dominant limiting factor is transmitter-side clock alignment error (Yu et al., 2024).

5. Estimation methods, hybridization, and robustness

Least-squares estimation is the most common solver class in UL-TDoA systems. In the passive LTE dual-sniffer method, the hyperbola equations are rearranged into

$k$3

with unknown vector $k$4, and the analytical LS solution

$k$5

The UE position estimate is obtained from the first two components of $k$6 (Wu et al., 2024).

Hybridization changes both identifiability and estimator structure. In UAV-assisted 3-D localization, a single UL-TDoA measurement is combined with one azimuth/elevation pair from the ground station. The TDOA equation is rewritten into the pseudo-linear form

$k$7

stacked with two AOA-derived equations to obtain

$k$8

The estimator is a closed-form weighted least squares solution,

$k$9

with $$\Delta_k=T_{\text{DL},k}-T_{\text{UL},k}+\varepsilon_{\text{SN},k},$$0 after linearization, and the covariance is shown to approach the CRLB under low-noise Gaussian conditions (Amiri et al., 9 Oct 2025).

Robustness measures address the fact that TDoA residuals are rarely ideal. A learning-based UWB framework models the observed TDOA as

$$\Delta_k=T_{\text{DL},k}-T_{\text{UL},k}+\varepsilon_{\text{SN},k},$$1

where $$\Delta_k=T_{\text{DL},k}-T_{\text{UL},k}+\varepsilon_{\text{SN},k},$$2 is a systematic, pose-dependent bias predicted from a 14-dimensional feature vector of relative geometry and anchor/tag orientation. After NN bias correction, a robust M-estimation-based EKF down-weights outliers using IRLS. The paper argues that the NN handles systematic bias and the M-estimation EKF handles sporadic outliers, making the two stages complementary (Zhao et al., 2021).

Another line of work treats TDoA not as a one-shot localization problem but as a distributed estimation problem. A delay-tolerant networked tracking paper replaces the usual nonlinear TDOA measurement with a linear, constant-output LTI measurement model

$$\Delta_k=T_{\text{DL},k}-T_{\text{UL},k}+\varepsilon_{\text{SN},k},$$3

when the sensors are static. This permits offline block-diagonal LMI gain design, single-time-scale distributed observers, and stability analysis under heterogeneous fixed communication delays (Doostmohammadian et al., 2024).

Dataset work reinforces the same robustness theme. The UTIL dataset provides raw UWB TDOA, SNR, power difference, and flight data under LOS and NLOS conditions, with both Centralized TDOA (TDOA 2) and Decentralized TDOA (TDOA 3). This suggests a mature UL-TDoA research program increasingly depends not only on geometry and synchronization, but also on measurement-quality modeling, outlier rejection, and reproducible benchmarking under cluttered indoor propagation (Zhao et al., 2022).

6. Experimental findings, misconceptions, and practical limitations

Reported performance varies strongly by modality, geometry, and propagation conditions. In the passive LTE dual-sniffer study, the TDoA-based scheme significantly outperforms the ToA-based scheme: the comparative table reports ToA mean 36.83 m, RMSE 36.52 m, STD 4.79 m, versus TDoA mean 13.99 m, RMSE 10.12 m, STD 9.65 m; the paper also states that TDoA distance error can be reduced to 0.1 m to 0.5 m in favorable cases and improves noticeably with higher SNR (Wu et al., 2024).

In 5G OpenAirInterface, the end-to-end UL-TDoA implementation produced location estimates for 16 ground-truth points with errors roughly from 0.35 m to 5.41 m, including a best reported error of 0.3461 m at point M and a worst reported error of 5.4106 m at point O. The paper presents these results as evidence that open-source, 3GPP-aligned UL-TDoA is viable in both RF-sim and real O-RAN testbeds (Malik et al., 2024).

UWB studies show both high precision and strong sensitivity to propagation. One RTLS paper reports TDoA standard deviations 0.18 ns, 0.19 ns, and 0.14 ns over an 800-minute test, with average deviation not more than 200 ps, static tag error less than 10 cm, and moving tag error less than 30 cm. Another learning-based framework reports 42.08 percent localization error reduction compared to a baseline without bias compensation, with about 0.14 m RMS error on average in three unseen test constellations. By contrast, the UTIL dataset benchmarks indicate around 10 cm performance in obstacle-free environments but substantial degradation in cluttered and NLOS scenarios (Zhang et al., 2021, Zhao et al., 2021, Zhao et al., 2022).

LPWAN results emphasize infrastructure and waveform effects. The CRAN testbed demonstrates that synchronized multi-site IQ capture and SoO-based alignment can achieve sub-nanosecond timing precision. The frequency-hopping LPWAN localization paper then shows the downstream consequence: in real urban deployment with four base stations, pure LOS gives $$\Delta_k=T_{\text{DL},k}-T_{\text{UL},k}+\varepsilon_{\text{SN},k},$$4 m and $$\Delta_k=T_{\text{DL},k}-T_{\text{UL},k}+\varepsilon_{\text{SN},k},$$5 m, whereas at least one obstructed path yields $$\Delta_k=T_{\text{DL},k}-T_{\text{UL},k}+\varepsilon_{\text{SN},k},$$6 m and $$\Delta_k=T_{\text{DL},k}-T_{\text{UL},k}+\varepsilon_{\text{SN},k},$$7 m because multipath can drive the peak picker to a wrong delay hypothesis (Maul et al., 2024, Maul et al., 3 Jun 2026).

Several recurrent misconceptions are addressed directly by the literature. UL-TDoA does not remove the need for receiver synchronization; it removes the need for synchronization with the transmitter, requiring only relative timing between receiver nodes in the classical form (Amiri et al., 9 Oct 2025). Standard TDoA usually requires at least three receivers, but two practical exceptions are documented: moving one sniffer to create a second TDoA equation, and fusing a single TDOA with a single AOA pair (Wu et al., 2024, Amiri et al., 9 Oct 2025). Finally, higher SNR is not a universal cure: in passive LTE, increasing SNR has little effect on ToA accuracy while TDoA improves noticeably; in indoor UWB, LOS/NLOS state, anchor geometry, and bias structure are often more decisive than nominal noise level alone (Wu et al., 2024, Zhao et al., 2022, Zhao et al., 2021).

Taken together, the literature presents UL-TDoA as a family of localization methods rather than a single algorithm. The unifying model is range-difference geometry from an uplink emission, but practical realizations diverge in waveform design, synchronization source, protocol architecture, estimator class, and failure mode. The most stable pattern across cellular, UWB, LPWAN, and UV implementations is that localization performance is limited less by the abstract hyperbola model than by timing infrastructure, calibration fidelity, and the treatment of multipath, NLOS, and hardware-induced bias (Malik et al., 2024, Maul et al., 2024, Yu et al., 2024).