61  UWB Applications and Security

Key Concepts
  • UWB Fine Ranging: Centimetre-accurate distance measurement using UWB time-of-flight; enables secure proximity verification for access control and payments
  • Car Key Access (UWB): Using UWB ranging to locate a smartphone relative to a vehicle, enabling hands-free unlocking only when the phone is within a precise defined zone
  • Spatial Awareness: The ability to determine the relative position of UWB devices in 3D space, enabling context-aware applications
  • Physical Layer Security: UWB’s inherent resistance to relay attacks due to the physical impossibility of faking round-trip time-of-flight measurements with current hardware
  • CCC (Car Connectivity Consortium): The industry body that defines the UWB Digital Key standard for automotive access applications
  • IEEE 802.15.4z: The IEEE standard extending 802.15.4 with enhanced ranging capabilities (ERDEV) specifically designed for secure UWB ranging
  • Secure Ranging: A UWB ranging protocol that includes cryptographic measures to prevent MITM attacks on the time-of-flight measurement

61.1 In 60 Seconds

UWB enables applications impossible with other technologies: automotive digital keys immune to relay attacks, warehouse asset tracking with 30cm accuracy across 50,000 m2, and indoor drone navigation. IEEE 802.15.4z Scrambled Timestamp Sequence (STS) provides cryptographic protection for secure ranging, while time-of-flight physics makes relay attacks detectable because nothing travels faster than light.

Sammy the Sensor was amazed by UWB: “I can measure distances to the nearest centimeter!” Max the Microcontroller explained how: “UWB sends tiny, super-fast pulses and measures exactly how long they take to bounce back – like a bat using echolocation, but with radio waves and the speed of light!” Bella the Battery asked: “But what about bad guys trying to trick us?” Max replied: “That is the best part – if someone tries to relay your car key signal from far away, the extra distance adds nanoseconds of delay. Since nothing travels faster than light, the car can TELL the signal was relayed and refuses to unlock!” Lila the LED added: “We also use a secret scrambled code (STS) so attackers cannot fake the timing measurements. It is like having an unbreakable secret handshake!”

61.2 Learning Objectives

By the end of this chapter, you will be able to:

  • Evaluate UWB applications across automotive, industrial, healthcare, and consumer domains
  • Analyze UWB security features including IEEE 802.15.4z Scrambled Timestamp Sequence (STS) for secure ranging
  • Justify how time-of-flight physics and STS cryptography prevent relay attacks in access control systems
  • Design a UWB ranging deployment by applying hands-on simulation of TWR and trilateration principles
  • Identify common pitfalls in UWB deployments and their mitigations

Ultra-Wideband (UWB) provides centimeter-accurate positioning and secure ranging – your car knows exactly where your phone is when you approach to unlock it. This chapter covers UWB’s growing applications in IoT (indoor positioning, asset tracking, secure access) and its built-in security features.

61.3 Introduction

UWB’s unique combination of precision, security, and low latency enables applications impossible with other technologies. This chapter explores real-world applications and the security features that make UWB ideal for access control and secure ranging.

Objective: Simulate UWB two-way ranging (TWR) and demonstrate how time-of-flight physics prevents relay attacks.

Paste this code into the Wokwi editor:

#include <Arduino.h>
#include <math.h>

const float SPEED_OF_LIGHT = 299792458.0;  // m/s
const float UWB_CLOCK_FREQ = 499.2e6;      // 499.2 MHz timestamp clock
const float CLOCK_PERIOD_PS = 1e12 / (UWB_CLOCK_FREQ * 128); // ~15.65 ps

struct AnchorNode {
  float x, y;        // Position in meters
  const char* name;
};

AnchorNode anchors[] = {
  {0.0, 0.0,  "Anchor-A (0,0)"},
  {10.0, 0.0, "Anchor-B (10,0)"},
  {5.0, 8.0,  "Anchor-C (5,8)"},
  {0.0, 8.0,  "Anchor-D (0,8)"}
};
const int NUM_ANCHORS = 4;

float tagX = 3.5, tagY = 4.2;  // Tag position

void simulateTWR(float anchorX, float anchorY, const char* name);
void trilaterate();
void demonstrateRelayAttack();

void setup() {
  Serial.begin(115200);
  delay(1000);

  Serial.println("==========================================");
  Serial.println("  UWB Time-of-Flight Ranging Simulator");
  Serial.println("  IEEE 802.15.4z Secure Ranging Demo");
  Serial.println("==========================================\n");

  // Two-Way Ranging with each anchor
  Serial.printf("Tag position: (%.1f, %.1f) meters\n\n", tagX, tagY);
  Serial.println("--- Two-Way Ranging (TWR) ---\n");

  for (int i = 0; i < NUM_ANCHORS; i++) {
    simulateTWR(anchors[i].x, anchors[i].y, anchors[i].name);
  }

  // Trilateration
  trilaterate();

  // Relay attack demonstration
  demonstrateRelayAttack();
}

void simulateTWR(float ax, float ay, const char* name) {
  float dx = tagX - ax;
  float dy = tagY - ay;
  float distance = sqrt(dx*dx + dy*dy);

  // Calculate time-of-flight
  float tof_ns = (distance / SPEED_OF_LIGHT) * 1e9;
  float roundTrip_ns = tof_ns * 2;

  // UWB timestamp counter ticks
  long ticks = (long)(roundTrip_ns * 1000 / CLOCK_PERIOD_PS);

  Serial.printf("  %s:\n", name);
  Serial.printf("    True distance:    %.3f m\n", distance);
  Serial.printf("    Time-of-flight:   %.3f ns\n", tof_ns);
  Serial.printf("    Round trip:       %.3f ns\n", roundTrip_ns);
  Serial.printf("    UWB clock ticks:  %ld\n", ticks);

  // Add realistic noise (+/- 10cm)
  float noise = random(-100, 101) / 1000.0;
  float measured = distance + noise;
  Serial.printf("    Measured (noisy): %.3f m (error: %+.1f cm)\n\n",
    measured, noise * 100);
}

void trilaterate() {
  Serial.println("--- Trilateration Result ---\n");

  // Simplified trilateration using 3 anchors
  float d1 = sqrt(pow(tagX - anchors[0].x, 2) + pow(tagY - anchors[0].y, 2));
  float d2 = sqrt(pow(tagX - anchors[1].x, 2) + pow(tagY - anchors[1].y, 2));
  float d3 = sqrt(pow(tagX - anchors[2].x, 2) + pow(tagY - anchors[2].y, 2));

  // Add noise
  d1 += random(-50, 51) / 1000.0;
  d2 += random(-50, 51) / 1000.0;
  d3 += random(-50, 51) / 1000.0;

  Serial.printf("  Ranges: A=%.2fm, B=%.2fm, C=%.2fm\n", d1, d2, d3);
  Serial.printf("  Estimated position: ~(%.1f, %.1f)\n", tagX + 0.05, tagY - 0.03);
  Serial.printf("  True position:       (%.1f, %.1f)\n", tagX, tagY);
  Serial.printf("  Error: ~%.0f cm (within UWB spec: <30cm)\n\n",
    sqrt(0.05*0.05 + 0.03*0.03) * 100);
}

void demonstrateRelayAttack() {
  Serial.println("--- Relay Attack Detection ---\n");
  Serial.println("  Scenario: Attacker relays car key signal from house to car\n");

  float legitimateDistance = 1.5;  // Key 1.5m from car
  float relayDistance = 30.0;      // Actual relay path: 30m

  float legit_tof = (legitimateDistance / SPEED_OF_LIGHT) * 1e9;
  float relay_tof = (relayDistance / SPEED_OF_LIGHT) * 1e9;
  float relay_extra = 500.0;  // Electronics add ~500ns processing delay

  Serial.printf("  Legitimate access (%.1fm):\n", legitimateDistance);
  Serial.printf("    Expected ToF: %.2f ns\n", legit_tof);
  Serial.printf("    Measured ToF:  %.2f ns  --> VALID\n\n", legit_tof + 0.3);

  Serial.printf("  Relay attack (%.0fm relay path):\n", relayDistance);
  Serial.printf("    Expected ToF:  %.2f ns (if legitimate)\n", legit_tof);
  Serial.printf("    Actual ToF:    %.2f ns (relay path)\n", relay_tof);
  Serial.printf("    + Electronics: %.0f ns (amplifier/relay delay)\n", relay_extra);
  Serial.printf("    Total measured: %.2f ns\n", relay_tof + relay_extra);
  Serial.printf("    Discrepancy:   %.2f ns  --> ATTACK DETECTED!\n\n",
    (relay_tof + relay_extra) - legit_tof);

  Serial.println("  Why UWB detects relays:");
  Serial.println("    Nothing travels faster than light (299,792,458 m/s)");
  Serial.println("    30m relay adds minimum 100ns to round-trip time");
  Serial.println("    Electronics add additional 200-1000ns delay");
  Serial.println("    UWB clock resolution: ~15 picoseconds");
  Serial.println("    --> Cannot fake shorter time-of-flight!");
}

void loop() {
  delay(30000);
}

What to Observe:

  1. Two-way ranging calculates time-of-flight for each anchor with nanosecond precision
  2. Trilateration from 3+ anchors gives position accuracy within 30cm (UWB spec)
  3. The relay attack demo shows why UWB is secure: extra distance adds detectable nanoseconds
  4. UWB clock resolution (~15 picoseconds) makes it impossible to fake shorter distances

61.4 Applications and Use Cases

61.4.1 Automotive Digital Keys and Access Control

Use Case: Secure, hands-free vehicle access

How It Works:

  1. Car has 6-8 UWB anchors (4 doors, trunk, inside cabin)
  2. Phone/key fob has UWB tag
  3. Continuous ranging determines precise distance and direction
  4. Car unlocks only when authorized device is within 1-2 meters of specific door
  5. Secure ranging prevents relay attacks

Deployed Systems:

  • BMW: UWB digital keys (2020+)
  • Audi: UWB integration (2021+)
  • Tesla: UWB support announced
  • Volkswagen, Mercedes: In development

Security Advantage: Traditional keyless entry vulnerable to relay attacks (amplify signal from inside house to car). UWB’s time-of-flight measurement makes relay attacks detectable (speed of light limits).

UWB relay attack detection relies on the speed of light (\(c = 3 \times 10^8\) m/s). The time-of-flight for distance \(d\) is:

\[t_{ToF} = \frac{d}{c} = \frac{d}{3 \times 10^8}\]

Example: Legitimate car key 2 meters from car has one-way \(t_{ToF} = \frac{2}{3 \times 10^8} = 6.67\) ns (round-trip = 13.34 ns). An attacker relaying from 30 meters away experiences one-way \(t_{ToF} = \frac{30}{3 \times 10^8} = 100\) ns, plus ~300 ns relay electronics delay = 400 ns total one-way. The car measures ~800 ns round-trip vs expected 13.34 ns → computed distance = 120 meters → attack detected and rejected. UWB’s 65-picosecond timing resolution (~2 cm range resolution) makes it impossible to fake shorter distances within the speed-of-light constraint.

61.4.2 Asset Tracking and Logistics

Warehouse Tracking:

Scenario: 50,000 m² distribution center, 500 forklifts and 10,000 pallets

  • Anchors: 125-200 UWB anchors (400 m² per anchor)
  • Tags: Active tags on forklifts, passive tags on high-value pallets
  • Method: TDoA for scalability
  • Accuracy: 30 cm (know which aisle, which shelf position)
  • Update rate: 1-10 Hz
  • Benefits:
    • Real-time inventory location
    • Optimize pick routes (reduce travel by 20-30%)
    • Safety: Prevent forklift-pedestrian collisions
    • Dwell time analytics

Cost Model:

  • Anchors: $200-400 each × 150 = $30-60k
  • Active tags: $50-100 each × 500 = $25-50k
  • Passive tags: $10-20 each × 10,000 = $100-200k
  • Infrastructure (gateway, server): $20-50k
  • Total: $175-360k for 50,000 m²
  • ROI: Typically 12-18 months from efficiency gains

61.4.3 Smart Home and IoT Devices

Apple’s Directional AirDrop and Handoff:

  • iPhone/HomePod use UWB to detect which device you’re pointing at
  • Point iPhone at HomePod: Transfer music playback
  • Point at another iPhone: Prioritize for AirDrop
  • Accuracy: ~10 cm and angular direction

Future Smart Home Applications:

  • Device Control: Point at smart light to adjust brightness
  • Contextual Automation: TV turns on when you sit on couch (not just enter room)
  • Multi-User: Different settings for each family member based on position
  • Security: Unlock only when specific person approaches specific door

61.4.4 Industrial Safety and Geofencing

Hazardous Zone Protection:

Scenario: Chemical plant with restricted areas

  • Tags: Workers wear UWB badges
  • Zones: Geofences around hazardous equipment
  • Precision: 30 cm accuracy prevents false alarms
  • Alerts: Real-time warnings if unauthorized entry
  • Evacuation: Know exact worker locations in emergency

Construction Site Safety:

  • Track worker proximity to heavy machinery
  • Automatic equipment shutdown if worker too close
  • Regulatory compliance (OSHA)

61.4.5 Healthcare and Patient Monitoring

Hospital Asset and Patient Tracking:

  • Equipment: IV pumps, wheelchairs, ventilators (prevent loss, optimize utilization)
  • Patients: Wandering prevention (dementia care), infant security
  • Staff: Optimize workflows, emergency response
  • Accuracy Needs: Room-level (3-5m) often sufficient, UWB provides margin

Advantages over BLE:

  • Higher accuracy: Know specific bed, not just room
  • Better reliability: Less interference in RF-noisy hospital environment
  • Faster updates: Real-time tracking for patient safety

61.4.6 Drone and Robotics Navigation

Indoor Drone Navigation:

  • GPS doesn’t work indoors
  • Vision-based systems require good lighting and features
  • UWB provides absolute position reference
  • Combined with IMU for high-rate, accurate 3D positioning

Autonomous Mobile Robots (AMRs):

  • Warehouse robots use UWB for precision navigation
  • Multi-robot coordination (know positions relative to each other)
  • Combined with SLAM for robust navigation

61.5 Security Features

UWB’s physical layer properties provide inherent security advantages, enhanced in recent standards.

61.5.1 Secure Ranging (IEEE 802.15.4z)

Scrambled Timestamp Sequence (STS):

The 802.15.4z standard introduced STS to prevent relay and spoofing attacks:

  1. Shared Secret: Devices establish cryptographic key
  2. Timestamp Scrambling: Scramble timestamp bits with AES-128
  3. Verification: Receiver checks scrambled sequence matches expected
  4. Attack Prevention: Attacker can’t replay or modify without key

Relay Attack Protection:

Traditional ranging vulnerable to relay attack: - Attacker captures signal at car - Relays to accomplice near key inside house - Car unlocked (thinks key is nearby)

UWB prevents this: - Relay introduces time delay (even nanoseconds) - Time-of-flight calculation detects extra delay - Distance computed is greater than actual - System rejects ranging result

Physical Layer Security:

  • Wide bandwidth makes jamming difficult (spread across GHz)
  • Short pulses difficult to intercept and decode
  • Low power density (appears as noise floor)
  • Covert communication possible

61.5.2 Privacy Considerations

Location Privacy:

UWB enables precise tracking, raising privacy concerns:

  • Data minimization: Only collect positioning data when necessary
  • Anonymization: Separate tag ID from user identity when possible
  • Consent: Clear opt-in for tracking
  • Access control: Strict controls on who can access location data
  • Retention: Limit storage duration

Regulatory Compliance:

  • GDPR (Europe): Location is personal data
  • CCPA (California): Location tracking disclosure requirements
  • Industry standards: ISO/IEC 29003 for location privacy

61.6 Understanding Check

You’ve been asked to design a UWB positioning system for a warehouse with the following requirements:

Warehouse Specifications:

  • Dimensions: 200m × 250m = 50,000 m²
  • Height: 12m (high-bay warehouse)
  • Tracking targets: 500 forklifts, 200 high-value carts
  • Required accuracy: 50 cm
  • Update rate: Minimum 5 Hz (real-time)
  • Obstacles: Metal shelving racks, pallets, inventory

Questions:

  1. How many UWB anchors do you need? Justify your calculation.

  2. TWR or TDoA - which would you choose and why?

  3. What’s your infrastructure cost estimate? (Use $300/anchor, $75/active tag, $25/passive tag)

  4. Where would you place the anchors? Consider height and distribution.

  5. What challenges do you anticipate with metal shelving? How would you mitigate?

Detailed Solution:

1. Anchor Count Calculation:

For a warehouse with significant obstacles, use ~300 m² per anchor (more conservative than open office): - Total area: 50,000 m² - Anchors needed: 50,000 / 300 = 167 anchors (minimum) - Add 20% redundancy for coverage gaps: 167 × 1.2 = 200 anchors

Alternative calculation by spacing: - Typical anchor spacing for warehouses: 15-20m - Grid: 200m / 15m = 14 rows, 250m / 15m = 17 columns - Total: 14 × 17 = 238 anchors - Recommendation: 200-240 anchors

2. TWR vs TDoA Decision:

Choose TDoA for the following reasons:

Factor TWR TDoA Winner
Number of tags 700 total 700 total TDoA (scales better)
Tag power High (active ranging) Low (blink only) TDoA
Infrastructure Simpler Requires sync TWR
Update rate Limited by exchanges High (100+ Hz possible) TDoA
Cost per tag $75 (active) $25 (passive) TDoA

With 700 tags and 5+ Hz requirement, TDoA is clearly superior. Tag cost savings alone: (700 × $50 savings) = $35,000.

3. Infrastructure Cost Estimate:

Anchors: 200 × $300 = $60,000

Tags:

  • 500 active forklift tags @ $75 = $37,500
  • 200 passive cart tags @ $25 = $5,000
  • Total tags: $42,500

Infrastructure:

  • Network switches for anchor backhaul (20 switches × 24 ports): $10,000
  • Ethernet cabling (200 drops × $100): $20,000
  • UWB positioning server/software: $30,000
  • Installation labor (assume $50k for 50,000 m²): $50,000

Total Project Cost: $212,500 (~$4.25 per m²)

4. Anchor Placement Strategy:

Height: Mount at 8-10m (below 12m ceiling) - Reason: Clear line-of-sight over most obstacles - Avoids interference from forklifts and inventory at ground level - Still accessible for maintenance

Distribution:

  • Grid pattern: 15m × 15m spacing
  • Align with building structure (columns, roof supports)
  • Avoid placement directly above tall shelving
  • Higher density near loading docks and high-activity zones

Coverage zones:

  • Ensure every location sees minimum 4 anchors
  • Use simulation software to model coverage
  • Identify dead zones, add anchors as needed

5. Metal Shelving Challenges and Mitigation:

Challenges:

  • Multipath: Reflections off metal create ghost signals
  • Attenuation: Metal blocks UWB signals
  • NLOS: Non-line-of-sight when shelving blocks direct path

Mitigation Strategies:

  1. Anchor height: Mounting high reduces shelving blockage
  2. Redundancy: 200+ anchors ensure multiple paths
  3. NLOS detection: Algorithms detect and reject bad ranging measurements
  4. Kalman filtering: Smooth position estimates, reduce jitter
  5. Zone-based: Accept lower accuracy (1-2m) in dense shelving areas
  6. Hybrid approach: Combine UWB with wheel odometry on forklifts

Expected performance:

  • Open areas (loading docks): 30 cm accuracy
  • Normal aisles: 50 cm accuracy
  • Dense shelving: 1-2 m accuracy (still acceptable for most use cases)

A car manufacturer is implementing UWB digital keys and asks you to evaluate security.

Question: How does UWB prevent relay attacks that plague traditional keyless entry systems?

Solution:

Relay Attack on Traditional Keyless Entry:

  1. Attacker uses radio amplifier near car (receiver)
  2. Accomplice uses amplifier near house where key is inside (transmitter)
  3. Signal relayed between car and key
  4. Car thinks key is nearby, unlocks
  5. Attack succeeds because system only checks “can I communicate with key?” not “how far away is key?”

UWB Relay Attack Prevention:

UWB measures time-of-flight, which is bounded by the speed of light:

  1. Car sends challenge to key
  2. Measures round-trip time with nanosecond precision
  3. Calculates distance: d = (time × speed_of_light) / 2

Physics of relay attack failure:

  • Legitimate distance: Car to key = 2 meters
  • Expected time: 2m / (3×10⁸ m/s) = 6.7 nanoseconds
  • Relay introduces delay:
    • Attacker radio: +5 meters
    • Relay hardware: +10 nanoseconds (processing)
    • Total extra delay: ~25+ nanoseconds
  • Computed distance: ~5+ meters (instead of 2m)
  • Car detects attack, doesn’t unlock

IEEE 802.15.4z Enhanced Security (HRP UWB):

Adds Scrambled Timestamp Sequence (STS): - Encrypted timestamp in ranging exchange - Attacker can’t modify without cryptographic key - Prevents manipulation of time-of-flight measurement

Multi-layered Security:

  1. Physical layer: Time-of-flight (relay detection)
  2. STS: Cryptographic authentication
  3. Angle of arrival: Verify direction matches expected
  4. Motion detection: Key should be moving toward car

Result: UWB digital keys are considered relay-attack proof with current technology. Attack would require breaking speed-of-light barrier.

61.8 Common Pitfalls in UWB Implementations

Pitfall: Placing UWB Anchors in a Straight Line

The Mistake: Installing 4 UWB anchors along a single wall or in a linear arrangement, then wondering why position accuracy is poor or positions “jump” unpredictably.

Why It Happens: Linear placement seems simpler for cabling and installation. Designers don’t realize that geometric diversity is essential for trilateration accuracy.

The Fix: UWB anchors must be spread across the space with geometric diversity - never collinear. For 2D positioning, place anchors in a rectangle or triangle pattern around the tracking area. For 3D positioning, vary anchor heights (floor, ceiling, mid-wall). Poor geometry leads to high GDOP (Geometric Dilution of Precision), where small ranging errors translate to large position errors. Aim for each tracked point to have 4+ anchors visible with good angular separation (>30 degrees between any two anchors from the tag’s perspective).

Pitfall: Ignoring NLOS (Non-Line-of-Sight) Conditions

The Mistake: Deploying UWB in environments with metal shelving, water pipes, or dense equipment without accounting for signal blockage, then blaming the technology when accuracy degrades from 10cm to 2+ meters.

Why It Happens: UWB marketing emphasizes “centimeter accuracy” without caveats. Developers test in open labs, then deploy in cluttered warehouses or hospitals where obstructions are everywhere.

The Fix: UWB requires line-of-sight or soft NLOS (drywall, glass) for best accuracy. Metal, water, and dense concrete severely attenuate or block signals. Survey the deployment environment and identify obstruction zones. Use redundant anchors (6-8 instead of minimum 4) so tags always see enough anchors. Implement NLOS detection algorithms that identify and reject corrupted ranging measurements. For challenging environments, combine UWB with IMU (inertial measurement unit) data using sensor fusion to bridge NLOS gaps.

Pitfall: Using TWR for Large-Scale Deployments

The Mistake: Implementing Two-Way Ranging (TWR) for a system with 500+ tags, then discovering the network can’t sustain the required update rate as tag count increases.

Why It Happens: TWR is simpler to implement (no anchor synchronization required), so it’s the default choice for prototypes. The prototype works with 10 tags, so developers assume it scales linearly.

The Fix: TWR requires each tag to exchange multiple messages with each anchor, consuming airtime proportional to (tags x anchors). For large deployments (>50 tags), use TDoA (Time Difference of Arrival) instead. In TDoA, each tag transmits a single blink, and synchronized anchors measure arrival times - airtime scales linearly with tag count, not quadratically. The trade-off is infrastructure complexity (anchors need precise time synchronization via wired network or GPS), but TDoA scales to thousands of tags with high update rates.

You have three primary technologies for indoor positioning in IoT systems: UWB, BLE 5.1 with AoA, and Wi-Fi RTT (802.11mc). This framework helps you choose based on accuracy requirements, infrastructure constraints, and budget.

Quick Decision Matrix:

Requirement UWB BLE AoA Wi-Fi RTT
Accuracy 10-30 cm 1-3 m 1-5 m
Update Rate 10-100 Hz 1-10 Hz 0.2-2 Hz
Infrastructure Dedicated anchors BLE gateways Existing Wi-Fi APs
Cost per anchor $200-400 $150-300 $0 (reuse APs)
Power (tag) 60 mW active 10 mW active N/A (phone-based)
Deployment New wiring + anchors New gateways Firmware upgrade
Relay-attack proof ✅ Yes (STS) ❌ No ❌ No

Step 1: Define Your Accuracy Requirement

Use Case Required Accuracy Technology
Shelf-level inventory (which specific shelf) 10-30 cm UWB
Room-level tracking (which patient room) 1-3 m BLE AoA or Wi-Fi RTT
Zone-level tracking (which department) 5-10 m BLE beacons (RSSI)
Building-level (which floor) 10+ m Wi-Fi RSSI

Step 2: Evaluate Infrastructure Constraints

UWB Requirements:

  • Dedicated UWB anchors at ceiling (20-30 ft spacing)
  • Ethernet backbone with PTP time sync for TDoA
  • Power over Ethernet (PoE) or AC outlets
  • New installation project (anchors + cabling)

BLE AoA Requirements:

  • BLE 5.1 gateways with antenna arrays (40-50 ft spacing)
  • Ethernet or Wi-Fi backhaul (no strict time sync)
  • Lower anchor density than UWB
  • Moderate installation (gateways only, no special cabling)

Wi-Fi RTT Requirements:

  • 802.11mc-capable access points (most enterprise APs since 2018)
  • No new hardware if APs already support 802.11mc
  • Firmware upgrade to enable RTT
  • Client devices need 802.11mc support (Android 9+, limited iOS)

Step 3: Tag vs Phone-Based Positioning

Approach UWB BLE AoA Wi-Fi RTT
Asset tags ✅ 15-month battery @ 5 Hz ✅ 12-month battery @ 1 Hz ❌ Not applicable
Staff badges ✅ Reliable ✅ Reliable ⚠️ Phone-based (privacy concerns)
Visitor tracking ❌ Requires tag distribution ❌ Requires tag distribution ✅ Use visitor’s phone

Step 4: Scalability and Tag Count

UWB:

  • TWR: < 50 tags
  • TDoA: 100-1,000+ tags
  • Requires infrastructure (anchors + sync)

BLE AoA:

  • 50-500 tags per gateway (limited by Bluetooth capacity)
  • Mesh: 1,000+ tags with multiple gateways

Wi-Fi RTT:

  • Phone-based: Unlimited (no tags)
  • Asset tags: Not commonly used (Wi-Fi too power-hungry)

Step 5: Security Requirements

Attack Vector UWB (STS) BLE AoA Wi-Fi RTT
Relay attack ✅ Prevents (time-of-flight) ❌ Vulnerable ❌ Vulnerable
Spoofing ✅ Crypto prevents ⚠️ Mitigation possible ⚠️ WPA3 helps
Eavesdropping ✅ AES-128 ⚠️ Optional encryption ✅ WPA2/3

Use Case Decision Tree:

START: What is your primary use case?
├─ Digital car keys / access control → UWB (relay-attack proof required)
├─ Warehouse asset tracking (< 50 cm accuracy) → UWB
├─ Hospital equipment (room-level is enough) → BLE AoA
├─ Retail customer analytics (zone-level) → BLE beacons (RSSI)
├─ Office hotdesking (desk-level) → BLE AoA or UWB
├─ Campus wayfinding (visitor phones) → Wi-Fi RTT
└─ Manufacturing safety zones (precise boundaries) → UWB

Real-World Example 1: Warehouse Asset Tracking

  • Need: Track 300 mobile carts with 50 cm accuracy
  • Environment: 50,000 sq ft, metal shelving
  • Update rate: 5 Hz (real-time)

Analysis:

  • BLE AoA: 1-3 m accuracy insufficient for shelf-level tracking
  • Wi-Fi RTT: Not designed for asset tags (power-hungry)
  • Decision: UWB with TDoA (only option meeting all requirements)

Real-World Example 2: Shopping Mall Customer Analytics

  • Need: Track ~5,000 visitors per day (which stores they visit)
  • Environment: 200,000 sq ft across 3 floors
  • Accuracy: Zone-level (10-20 ft zones)

Analysis:

  • UWB: Overkill (10-30 cm accuracy not needed), expensive ($200k+ infrastructure)
  • BLE AoA: Overkill (1-3 m accuracy exceeds requirement)
  • Decision: Wi-Fi RTT or BLE RSSI beacons — Use visitors’ smartphones, no tag distribution required, zone-level accuracy sufficient

Cost Comparison (500-tag deployment):

Component UWB BLE AoA Wi-Fi RTT
Anchors/Gateways 100 × $300 = $30k 50 × $200 = $10k 20 APs × $0 = $0
Tags 500 × $40 = $20k 500 × $30 = $15k N/A (phones)
Infrastructure Ethernet + PTP = $15k Ethernet/Wi-Fi = $5k Firmware = $0
Software Positioning engine = $50k Positioning engine = $30k Cloud service = $10k
TOTAL $115k $60k $10k

The Lesson: UWB provides the best accuracy (10-30 cm) but at the highest cost and deployment complexity. Use UWB only when centimeter-level precision is required or relay-attack prevention is critical (automotive, access control). For room-level tracking, BLE AoA provides 3-5× cost savings with acceptable accuracy. For zone-level tracking, Wi-Fi RTT leverages existing infrastructure at near-zero additional cost.

61.9 Knowledge Check

61.10 Hands-On Lab: UWB Ranging Simulation

Lab Overview

Objective: Simulate UWB Two-Way Ranging (TWR) protocol and trilateration positioning using ESP32 to understand time-of-flight measurements and multi-anchor positioning.

What You’ll Learn:

  • How TWR protocol calculates distance from time measurements
  • Time-of-flight to distance conversion using speed of light
  • Multi-anchor trilateration for 2D position estimation
  • Effects of timing precision on ranging accuracy
  • Geometric dilution of precision (GDOP) impact

Hardware: ESP32 microcontroller (simulated via Wokwi)

Duration: 30-45 minutes

61.10.1 Lab Setup

This lab simulates UWB ranging concepts using an ESP32. While real UWB uses specialized chips (like DW3000), this simulation demonstrates the mathematical principles of TWR and trilateration that underpin all UWB positioning systems.

61.10.2 Pre-Built Simulation Code

The simulation includes: - 4 Virtual Anchors: Placed at known positions (corners of 10m x 10m space) - 1 Virtual Tag: Mobile device being tracked - TWR Protocol: Simulated message exchange with realistic timing - Trilateration: Calculate tag position from ranges to 4 anchors - Error Simulation: Add timing jitter to show real-world effects - OLED Display: Visualize tag position and ranging data

#include <Wire.h>
#include <Adafruit_GFX.h>
#include <Adafruit_SSD1306.h>
#include <math.h>

// OLED display configuration
#define SCREEN_WIDTH 128
#define SCREEN_HEIGHT 64
#define OLED_RESET -1
Adafruit_SSD1306 display(SCREEN_WIDTH, SCREEN_HEIGHT, &Wire, OLED_RESET);

// UWB Constants
const float SPEED_OF_LIGHT = 299792458.0;  // m/s
const float UWB_TIMING_PRECISION = 65e-12; // 65 picoseconds (500 MHz bandwidth)
const int NUM_ANCHORS = 4;

// Anchor positions (in meters) - corners of 10m x 10m space
struct Anchor {
  float x, y;
  char id;
};

Anchor anchors[NUM_ANCHORS] = {
  {0.0, 0.0, 'A'},   // Bottom-left
  {10.0, 0.0, 'B'},  // Bottom-right
  {10.0, 10.0, 'C'}, // Top-right
  {0.0, 10.0, 'D'}   // Top-left
};

// Tag state
struct Tag {
  float actual_x, actual_y;      // True position (for simulation)
  float estimated_x, estimated_y; // Trilateration result
  float ranges[NUM_ANCHORS];      // Measured ranges to each anchor
  bool ranging_active;
} tag;

// TWR timing structure
struct TWRMeasurement {
  unsigned long T1; // Tag sends poll (nanoseconds)
  unsigned long T2; // Anchor receives poll
  unsigned long T3; // Anchor sends response
  unsigned long T4; // Tag receives response
};

// Simulation parameters
float timing_jitter = 0.2;  // nanoseconds (adjustable for accuracy demo)
int current_anchor = 0;
unsigned long last_update = 0;
int animation_phase = 0;

// Button pins for interactive control
#define BUTTON_INCREASE_JITTER 13
#define BUTTON_DECREASE_JITTER 12
#define BUTTON_RESET_STATS 14
#define BUTTON_CHANGE_MODE 27

// Simulation modes
enum SimMode {
  MODE_NORMAL,      // Tag moves in circle
  MODE_STATIC,      // Tag stays at center
  MODE_RANDOM,      // Tag moves randomly
  MODE_POOR_GDOP    // Anchors in poor geometry
};
SimMode current_mode = MODE_NORMAL;

// Statistics tracking
struct Statistics {
  float avg_range_error;
  float avg_position_error;
  float max_position_error;
  int num_samples;
  float gdop;  // Geometric Dilution of Precision
} stats;

// ... (Full code available in lab simulation)

61.10.3 Understanding the Code

Key Components:

  1. Anchor Configuration: 4 anchors at known positions forming a 10m x 10m square
    • Each anchor has x, y coordinates and an identifier (A-D)
    • Backup anchors allow switching between good and poor geometry
    • In POOR_GDOP mode, anchors become collinear to demonstrate geometry impact
  2. TWR Protocol Simulation (performTWR function):
    • T1: Tag transmits poll at time 0
    • T2: Anchor receives poll (T1 + time-of-flight + jitter)
    • T3: Anchor transmits response (T2 + 100ns processing delay)
    • T4: Tag receives response (T3 + time-of-flight + jitter)
    • RTT = (T4 - T1) - (T3 - T2)
    • Distance = RTT × c / 2
    • Timing jitter simulates real-world clock drift and noise
  3. Trilateration Algorithm (calculatePosition function):
    • Solves system of circle equations: (x-x_i)² + (y-y_i)² = r_i²
    • Uses linearized least-squares approach with 3 anchors
    • Fourth anchor provides redundancy for error checking
    • Detects degenerate geometry (collinear anchors) and warns user
  4. GDOP Calculation (calculateGDOP function):
    • Builds geometry matrix H from anchor-to-tag unit vectors
    • Computes H^T × H and its determinant
    • GDOP = sqrt(trace / determinant)
    • Low GDOP (< 2.0) indicates good geometry, high GDOP (> 5.0) indicates poor geometry
  5. Interactive Controls:
    • GPIO13: Increase timing jitter (simulate poor clock quality)
    • GPIO12: Decrease timing jitter (simulate better clock quality)
    • GPIO14: Reset statistics to start fresh measurement session
    • GPIO27: Cycle through simulation modes (Normal, Static, Random, Poor GDOP)

61.10.4 Challenge Exercises

Challenge 1: Anchor Geometry Impact

Task: Modify anchor positions to be collinear (all on a line) and observe the effect on accuracy.

Steps:

  1. Change anchor positions to: (0,5), (3,5), (6,5), (9,5)
  2. Run simulation and note position errors
  3. Explain why collinear anchors cause poor GDOP

Expected Outcome: Position errors increase dramatically due to poor geometric diversity.

Challenge 2: Timing Precision vs Accuracy

Task: Vary the timing_jitter parameter and measure position accuracy.

Steps:

  1. Set timing_jitter = 0.1 (100 picoseconds) - excellent UWB timing
  2. Set timing_jitter = 1.0 (1 nanosecond) - degraded timing
  3. Set timing_jitter = 5.0 (5 nanoseconds) - poor timing
  4. Record average position errors for each case

Expected Outcome: Position accuracy degrades linearly with timing precision. This demonstrates why UWB’s sub-nanosecond timing is critical.

Challenge 3: 3D Positioning

Task: Extend the system to 3D by adding anchor height (z-coordinate).

Steps:

  1. Add z field to Anchor struct
  2. Place anchors at varying heights (0m, 0m, 3m, 3m)
  3. Add actual_z and estimated_z to tag
  4. Modify trilateration to solve for 3D position (requires 4+ anchors)

Expected Outcome: Working 3D positioning system showing centimeter accuracy in all three dimensions.

Challenge 4: NLOS Error Simulation

Task: Simulate Non-Line-of-Sight (NLOS) conditions where some ranges are corrupted.

Steps:

  1. Add function to detect if LOS exists between tag and anchor (e.g., check for obstacles)
  2. For NLOS ranges, add 1-3 meter bias error (signal bounces off walls)
  3. Implement NLOS detection: Compare measured range to expected range
  4. Implement NLOS mitigation: Exclude corrupted ranges from trilateration

Expected Outcome: System detects and rejects corrupted NLOS measurements, improving position accuracy.

61.10.5 Expected Outcomes

After completing this lab, you should observe:

  1. TWR Distance Calculation:
    • Round-trip time accurately measures distance
    • Sub-centimeter ranging accuracy with good timing precision
    • Timing jitter directly impacts ranging error
  2. Trilateration Position Fix:
    • 4 anchors provide redundant 2D position solution
    • Position accuracy depends on geometric dilution of precision (GDOP)
    • Good anchor geometry (spread out, not collinear) is critical
  3. Error Propagation:
    • Ranging errors of ±5cm can produce position errors of ±10-15cm
    • GDOP amplifies ranging errors in poor geometry
    • More anchors improve robustness but require careful placement
  4. Real-Time Performance:
    • ESP32 can perform TWR calculations at 10+ Hz update rate
    • Trilateration computation is lightweight (~1ms per fix)
    • Suitable for real-time tracking applications

61.10.6 Connection to UWB Theory

This lab demonstrates the core principles of commercial UWB systems:

  • Time-of-Flight: Speed of light × time = distance (fundamental ranging principle)
  • TWR Protocol: Eliminates clock synchronization requirement between devices
  • Trilateration: Geometric solution to position from multiple ranges
  • GDOP: Why anchor placement matters for accuracy
  • Error Budget: How timing precision translates to position accuracy

Real UWB systems (DW3000, NXP Trimension) use the same mathematics but with: - 500+ MHz bandwidth for sub-nanosecond timing - Specialized RF front-ends for clean pulse transmission - IEEE 802.15.4z security features (STS) - Dedicated hardware accelerators for real-time processing

Practice Exercise

Design a UWB positioning system for a specific application:

  1. Choose an environment (office, warehouse, hospital, retail store, manufacturing floor)
  2. Define requirements (accuracy, update rate, number of assets)
  3. Calculate anchor count and placement
  4. Select TWR vs TDoA and justify
  5. Estimate total system cost
  6. Identify key challenges and mitigation strategies

Share your design for feedback in the course forums!

61.11 Concept Relationships

Application-to-technology mapping:

Digital Car Keys → Require: <1m accuracy + relay-attack protection → UWB + STS
Warehouse Tracking → Require: 30cm accuracy + 100s of tags → UWB + TDoA
Smart Home → Require: Device direction + proximity → UWB + AoA
Safety Zones → Require: Precise geofences + real-time → UWB + high update rate

Security layer dependencies:

  • Time-of-flight (physical law) → relay detection (speed-of-light limit)
  • STS crypto → ranging authentication (prevents spoofing)
  • Mutual auth → access control (both sides verified)

Prerequisite knowledge:

Foundation for:

  • Secure system deployment
  • Application-specific UWB design
  • Integration with access control and tracking systems

61.12 See Also

Security topics:

Application domains:

  • Automotive IoT - Digital keys, fleet
  • Logistics - Warehouse, supply chain
  • Healthcare - Equipment, patient tracking

Technology alternatives:

Development resources:

61.13 Summary

UWB enables unique applications requiring centimeter-level precision and secure ranging. From automotive digital keys to warehouse asset tracking, UWB’s combination of accuracy and security makes it the technology of choice for critical positioning applications.

Key Takeaways:

  1. Applications: Automotive (digital keys), logistics (asset tracking), smart home (spatial awareness), industrial (safety zones), healthcare (equipment tracking)

  2. Security: IEEE 802.15.4z STS provides cryptographic protection; time-of-flight physics prevents relay attacks

  3. Cost Model: Enterprise deployments typically $4-8 per m² with 12-18 month ROI

  4. Pitfalls: Avoid collinear anchors, account for NLOS conditions, use TDoA for large deployments

  5. Hands-On: TWR protocol and trilateration can be simulated to understand core positioning principles

61.15 What’s Next?

Now that you understand UWB applications and security, continue exploring related topics:

Next Chapter Why It Matters
UWB Fundamentals Review the physics (time-bandwidth principle) that underpin the applications covered here
UWB Ranging Techniques Deepen your understanding of TWR, TDoA, and AoA methods used in the applications above
UWB Positioning Systems Learn complete system design including anchor placement and deployment planning
Bluetooth Fundamentals Compare BLE 5.1 AoA positioning trade-offs against UWB for cost-sensitive deployments
IoT Device Security Extend UWB secure ranging into broader device hardening and threat modelling