59 UWB Ranging Techniques
Sammy the Sensor was curious: “How does UWB know exactly how far away something is?” Max the Microcontroller explained: “Imagine you shout ‘HELLO’ across a canyon and time how long the echo takes. UWB does the same thing with radio waves! I send a pulse, you send one back, and I measure the round trip. Since radio travels at the speed of light, even a tiny time difference – just a few billionths of a second – tells us the distance to within centimeters!” Bella the Battery asked: “But what if I have to talk to lots of anchors? That uses power!” Max nodded: “That is why big systems use TDoA – you just shout once, and all the anchors listen. They compare when they heard you and figure out where you are. You save battery because you only transmit once!” Lila the LED added: “It is like clapping once in a room full of microphones – each mic records when it heard the clap, and a computer figures out where you were standing!”
59.2 Learning Objectives
By the end of this chapter, you will be able to:
- Derive distance from TWR timestamp measurements using the round-trip time formula
- Differentiate TWR, TDoA, and DS-TWR based on clock synchronization, scalability, and power trade-offs
- Explain how Angle of Arrival (AoA) complements time-based ranging to reduce anchor requirements
- Select the appropriate ranging technique for a given deployment based on tag count, power budget, and infrastructure constraints
UWB ranging measures the exact distance between two devices by timing ultra-short radio pulses. The main techniques are TWR (Two-Way Ranging, like shouting and timing the echo) and TDoA (Time Difference of Arrival, using multiple receivers). These techniques enable the centimeter-level accuracy that makes UWB special.
59.3 Introduction
UWB’s primary advantage is precise distance measurement through time-of-flight calculations. Several ranging techniques exist, each with different trade-offs for accuracy, scalability, power consumption, and infrastructure complexity.
This chapter covers the three main UWB ranging approaches: Two-Way Ranging (TWR), Time Difference of Arrival (TDoA), and Angle of Arrival (AoA).
TWR is simpler (no sync required) but scales poorly. TDoA scales to thousands of tags but requires synchronized anchors. Choose based on deployment size: TWR for <50 tags, TDoA for larger deployments.
59.4 Two-Way Ranging (TWR)
Two-Way Ranging is the most common UWB ranging technique, measuring round-trip time to eliminate clock synchronization requirements.
TWR Process:
- Poll Message: Device A (initiator) sends a poll message at time T1
- Response Delay: Device B (responder) receives at T2, processes, then responds at T3
- Response Reception: Device A receives response at T4
- Calculate Distance:
- Round trip time: RTT = (T4 - T1) - (T3 - T2)
- Distance = (RTT × speed of light) / 2
TWR eliminates clock offset by subtracting processing delay. The distance formula is:
\[d = \frac{c}{2} \times \left[(T_4 - T_1) - (T_3 - T_2)\right]\]
Example: Tag sends poll at \(T_1 = 0\) ns, receives response at \(T_4 = 220\) ns. Anchor receives at \(T_2 = 10\) ns, sends response at \(T_3 = 210\) ns. Round-trip time = \((220 - 0) - (210 - 10) = 220 - 200 = 20\) ns. Distance = \(\frac{3 \times 10^8 \times 20 \times 10^{-9}}{2} = 3\) meters. The key: \((T_3 - T_2)\) removes anchor processing delay, so RTT measures only signal flight time. With 65-ps timing precision, distance precision is \(\frac{3 \times 10^8 \times 65 \times 10^{-12}}{2} = 0.97\) cm.
Key Advantages:
- No clock synchronization needed between devices
- Works with just two devices
- Simple implementation
- High accuracy (10-30 cm typical)
Limitations:
- Requires active exchange (power consumption)
- Scales poorly with many devices (each pair needs exchange)
- Double the radio time compared to one-way
This variant shows UWB ranging through a technology comparison lens - useful for understanding why UWB achieves centimeter-level precision compared to other indoor positioning technologies.
This variant helps you determine when UWB is the right positioning technology:
UWB excels at cm-level precision, secure ranging (access control), and high update rates (10-100 Hz). For room-level accuracy or lower budgets, consider Wi-Fi RSSI or BLE alternatives.
This variant shows where UWB is being deployed across industries:
UWB has found major adoption in automotive (secure keyless entry), consumer (item finding), industrial (asset tracking, safety), and healthcare (equipment/staff location). The common thread: applications requiring centimeter-level precision or secure ranging.
59.4.1 Double-Sided Two-Way Ranging (DS-TWR)
An enhanced version performs TWR in both directions and averages results, compensating for clock drift:
- Device A → B → A (first exchange)
- Device B → A → B (second exchange)
- Average both measurements
- Accuracy improves to ~5-10 cm
59.4.2 Why UWB Uses 500 MHz of Bandwidth Just to Measure Distance
UWB’s defining characteristic is its enormous bandwidth – typically 500 MHz per channel, compared to 1 MHz for Bluetooth or 2 MHz for Zigbee. This seems wasteful for a technology that transmits almost no data. The reason is that bandwidth determines time resolution, and time resolution determines ranging accuracy.
The fundamental relationship is simple. A radio pulse’s duration is inversely proportional to its bandwidth. A 500 MHz UWB pulse lasts approximately 2 nanoseconds (1/500 MHz = 2 ns). During those 2 ns, light travels 60 cm. This means the receiver can resolve the arrival time of a pulse to within roughly 2 ns, giving a theoretical ranging resolution of about 60 cm – before any signal processing improvements.
Compare this to narrowband alternatives:
| Technology | Bandwidth | Pulse Duration | Time Resolution | Theoretical Ranging Precision |
|---|---|---|---|---|
| Wi-Fi RSSI | 20 MHz | 50 ns | ~50 ns | ~15 m |
| Bluetooth (channel sounding) | 1-2 MHz | 500 ns-1 us | ~500 ns | ~150 m |
| Wi-Fi FTM (802.11mc) | 40-80 MHz | 12-25 ns | ~12 ns | ~3.6 m |
| UWB (802.15.4z) | 500 MHz | 2 ns | ~2 ns | ~60 cm |
Signal processing pushes accuracy further. The 60 cm figure is the raw resolution. UWB receivers use leading-edge detection on the channel impulse response (CIR) to identify the first arriving pulse (the line-of-sight path) among multipath reflections. With CIR analysis and oversampling (using the full 500 MHz bandwidth), practical accuracy reaches 5-15 cm for TWR and 30-50 cm for TDoA at scale.
Why not use even more bandwidth? Some UWB modes use 1,354 MHz (Channel 15, 9.0-10.6 GHz), achieving sub-5 cm accuracy. But wider bandwidth means higher sampling rates in the receiver ADC, which increases power consumption quadratically. The 500 MHz sweet spot (Channel 5 at 6.5 GHz or Channel 9 at 8.0 GHz) balances accuracy against the 10-50 mW power budget of battery-operated tags.
59.5 Time Difference of Arrival (TDoA)
TDoA is preferred for systems with many tags because it’s more scalable.
TDoA Architecture:
- Multiple anchors with synchronized clocks (typically 4+ anchors)
- Tag transmits a single blink message
- All anchors record precise arrival time
- Central positioning engine compares time differences
- Hyperbolic trilateration determines position
Mathematical Basis:
If a signal arrives at Anchor 1 at time t1 and Anchor 2 at time t2:
\[ d_2 - d_1 = c \cdot (t_2 - t_1) \]
This defines a hyperbola. With 4 anchors, you get 3 independent hyperbolas that intersect at the tag’s position.
Advantages:
- Tag only transmits once (low power)
- Scales to thousands of tags
- Tag can be very simple (no ranging computation)
Disadvantages:
- Requires infrastructure (synchronized anchors)
- More complex backend processing
- Anchor synchronization critical
59.6 Angle of Arrival (AoA)
While less common in UWB, Angle of Arrival uses antenna arrays to determine the direction of incoming signals.
AoA Principle:
- Multiple antennas with known spacing
- Phase difference indicates arrival angle
- Combined with ranging for 3D position
- Reduces number of anchors needed (2-3 vs 4+)
Trade-offs:
- Requires more complex antenna arrays
- More expensive hardware
- Good complement to ranging (angle + distance = position)
59.7 Technique Comparison
| Factor | TWR | TDoA | AoA |
|---|---|---|---|
| Clock Sync Required | No | Yes (critical) | No |
| Tag Complexity | Active (ranging) | Passive (blink only) | Active |
| Tag Power | Higher | Lower | Medium |
| Scalability | ~50-100 tags | 1000s of tags | Medium |
| Infrastructure | Simple | Complex (sync) | Complex (arrays) |
| Best For | Small deployments | Large deployments | Reduced anchors |
59.8 Worked Example: UWB Two-Way Ranging Distance Calculation
Scenario: A UWB digital car key system performs Two-Way Ranging (TWR) to verify the smartphone is within 2 meters of the driver’s door before unlocking.
Given:
- UWB channel 9 (7.9872 GHz center frequency)
- Bandwidth: 500 MHz
- Tag (smartphone) initiates ranging to Anchor (car door)
- Measured timestamps:
- T1 (Tag sends Poll): 0.000000000 seconds
- T2 (Anchor receives Poll): 0.000000008 seconds (anchor clock)
- T3 (Anchor sends Response): 0.000000108 seconds (100ns processing delay)
- T4 (Tag receives Response): 0.000000116 seconds
- Speed of light: 299,792,458 m/s
Steps:
- Calculate round-trip time (RTT):
- Total elapsed at Tag: T4 - T1 = 0.000000116 - 0 = 116 ns
- Processing delay at Anchor: T3 - T2 = 108 - 8 = 100 ns
- RTT = (T4 - T1) - (T3 - T2) = 116 - 100 = 16 ns
- Calculate one-way time of flight (ToF):
- ToF = RTT / 2 = 16 ns / 2 = 8 ns
- Convert time to distance:
- Distance = ToF x c = 8 x 10^-9 s x 299,792,458 m/s
- Distance = 2.398 meters
- Apply error bounds:
- UWB timing precision: +/-65 picoseconds (from 500 MHz bandwidth)
- Distance precision: +/-65ps x c = +/-0.019 meters (+/-1.9 cm)
- Measured distance: 2.398 +/- 0.019 meters
- Security check for relay attack:
- Maximum legitimate distance for unlock: 2.0 meters
- Measured: 2.398 meters > 2.0 meters
- Decision: DENY unlock (phone too far from door)
Result: The measured distance of 2.40 meters exceeds the 2.0 meter threshold, so the car door remains locked. This prevents accidental unlock when passing by and relay attacks where attackers amplify signals.
Key Insight: UWB’s nanosecond timing precision translates directly to centimeter distance accuracy. A relay attack that adds even 10 nanoseconds of delay (from signal amplification electronics) would add 3 meters to the calculated distance, making it trivially detectable. This physics-based security is why UWB is replacing traditional keyless entry systems vulnerable to relay attacks.
59.9 Knowledge Check
59.10 Real-World Deployment: BMW Digital Key Plus and Volkswagen Factory Tracking
59.10.1 BMW Digital Key Plus: Secure Vehicle Access via DS-TWR
BMW introduced UWB Digital Key Plus in the 2022 iX, using NXP SR150 chipsets with IEEE 802.15.4z HRP (High Rate Pulse) mode. By 2024, the system was standard across 14 BMW models with 2.8 million UWB-equipped vehicles on the road.
How BMW Uses DS-TWR for Secure Unlock
Each vehicle has 4 UWB anchors (one per door pillar) performing DS-TWR against the owner’s iPhone or Samsung Galaxy. The system runs 10 ranging rounds per second, requiring:
- Round-trip measurement time: 2.4 ms per anchor (including 100 ns processing delay)
- 4 anchors x 2.4 ms = 9.6 ms per cycle (well within the 100 ms budget)
- Averaging 10 rounds reduces noise from multipath: single-round accuracy of +/-15 cm improves to +/-4.2 cm after 10-round averaging
- Final position accuracy: 8 cm lateral, 12 cm longitudinal (outdoor parking lot, line-of-sight)
Why DS-TWR and Not TDoA
BMW evaluated TDoA during prototyping but chose DS-TWR for three reasons:
- No anchor synchronization needed: Vehicle anchors run on independent clocks. TDoA would require sub-nanosecond synchronization across 4 anchors – adding a $12/vehicle synchronization bus and creating a single point of failure
- Bidirectional security: DS-TWR requires the phone to respond, proving physical presence. TDoA’s passive tag model only proves the tag transmitted – a sophisticated relay attack could replay the blink
- Multipath resilience: DS-TWR’s bidirectional exchange enables channel impulse response (CIR) analysis on both devices, detecting non-line-of-sight conditions with 97.3% accuracy
Relay Attack Detection Performance
The critical security metric is distinguishing legitimate proximity from relay-amplified signals. BMW published results from 12,000 attack simulations:
| Attack Type | Detection Rate | False Rejection Rate | Method |
|---|---|---|---|
| Amplifier relay (analog, adds 8-15 ns delay) | 100% | 0% | Distance exceeds threshold by 2.4-4.5 m |
| Digital relay (capture-and-replay, adds 50-200 ns) | 100% | 0% | Distance exceeds threshold by 15-60 m |
| Wormhole relay (fiber-optic, adds 1-3 ns) | 99.7% | 0.02% | CIR analysis detects non-physical channel characteristics |
| Legitimate approach in rain/snow | N/A | 0.3% | Multipath from wet surfaces occasionally triggers false alarm |
Common Pitfalls
SS-TWR’s accuracy degrades linearly with clock offset and round-trip time. At 20 ppm and 5 ms response delay, the ranging error is ~30 cm. Fix: use DS-TWR or SDS-TWR for deployments where clock quality cannot be guaranteed or response times are long.
Treating NLOS range measurements as LOS measurements shifts the estimated position towards the obstructed anchor. Fix: implement NLOS detection (CIR analysis or consistency checking) and either exclude NLOS measurements or apply a bias correction factor.
Requesting 100 range measurements per second per tag with 8 anchors requires 800 UWB packets per second, which may exceed the MAC throughput. Fix: calculate the required ranging rate × anchor count × packet overhead and verify it is below the MAC layer capacity before system design is finalised.
59.11 Summary
UWB ranging techniques provide the foundation for precise indoor positioning. The choice between TWR and TDoA depends primarily on deployment scale and infrastructure constraints.
Key Takeaways:
TWR (Two-Way Ranging): Simple, two-device, no synchronization required - ideal for small deployments (<50 tags) and peer-to-peer applications
TDoA (Time Difference of Arrival): Scalable to thousands of tags with low tag power, but requires synchronized anchor infrastructure
DS-TWR: Enhanced TWR with bidirectional ranging improves accuracy to 5-10 cm by compensating for clock drift
AoA: Useful complement to ranging when anchor count must be minimized
Selection Criteria: Consider tag count, power budget, infrastructure complexity, and update rate requirements
59.12 Concept Relationships
Understanding how UWB ranging techniques connect to broader positioning and security concepts:
Builds Upon:
- Wireless Communication Fundamentals: UWB uses ultra-wide bandwidth (500 MHz) for nanosecond timing precision
- Time Synchronization: TDoA requires synchronized anchors, similar to WirelessHART TDMA
Enables:
- UWB Positioning Systems: Ranging techniques (TWR, TDoA) are the foundation for trilateration-based positioning
- Secure Ranging: TWR with cryptographic timestamps prevents relay attacks in automotive keyless entry
Compares With:
- Wi-Fi RTT (802.11mc): Uses round-trip time like TWR but at 40-80 MHz bandwidth (vs UWB’s 500 MHz), achieving 1-2m accuracy instead of 5-15cm
- BLE Channel Sounding: Bluetooth’s answer to UWB ranging, using phase-based distance measurement
Key Insight: TWR requires no infrastructure synchronization (ideal for peer-to-peer), while TDoA scales to thousands of tags but demands synchronized anchor network (Ethernet + PTP).
59.13 See Also
Related Ranging Technologies:
- RFID Proximity Detection: Near-field detection without precise distance measurement
- Bluetooth RSSI: 2-3m accuracy using signal strength (vs UWB’s 5-15cm with time-of-flight)
- GPS Positioning: Similar trilateration concept but satellite-based (3-5m accuracy outdoors)
Commercial UWB Chipsets:
- Qorvo DW3000: IEEE 802.15.4z compliant, ~10cm ranging accuracy, used in industrial tracking
- NXP Trimension SR150: Integrated in Samsung phones, BMW digital keys, secure ranging
- Apple U1/U2: Consumer UWB in iPhone 11+, AirTags (~50 billion potential devices)
Standards and Protocols:
- IEEE 802.15.4a/z: UWB PHY and MAC specifications for ranging and positioning
- FiRa Consortium: Secure UWB ranging specifications for automotive and mobile
Academic and Industry Resources:
- “UWB Ranging and Indoor Positioning” (Decawave Application Note APS006)
- IEEE 802.15.4z-2020: Enhanced Impulse Radio standard with scrambled timestamp sequences
- FiRa MAC Technical Requirements: TDoA and TWR implementation guidelines
59.14 Try It Yourself
59.14.1 Challenge 1: Calculate TWR Distance with Clock Drift
Scenario: Two UWB devices perform Double-Sided TWR. Both have imperfect clocks with drift.
Given:
- Device A clock: +20 ppm (faster)
- Device B clock: -15 ppm (slower)
- Measured timestamps:
- T1 (A sends): 0 ns (A’s clock)
- T2 (B receives): 10 ns (B’s clock)
- T3 (B sends): 110 ns (B’s clock)
- T4 (A receives): 120 ns (A’s clock)
- Speed of light: 0.3 m/ns
Your Tasks:
- Calculate RTT using standard TWR formula
- Estimate the error introduced by clock drift
- Explain how Double-Sided TWR compensates
Hint: Clock drift affects the elapsed time measurements. DS-TWR averages both directions to cancel drift effects.
Solution
- RTT calculation:
- Elapsed at A: T4 - T1 = 120 - 0 = 120 ns
- Processing at B: T3 - T2 = 110 - 10 = 100 ns
- RTT = 120 - 100 = 20 ns
- Distance = (20 ns × 0.3 m/ns) / 2 = 3.0 meters
- Clock drift error:
- A’s clock runs 20 ppm fast: 120 ns × (20/10^6) = 2.4 ps overestimate
- B’s clock runs 15 ppm slow: 100 ns × (15/10^6) = 1.5 ps underestimate
- Net error: ~1 ps → 0.3 mm (negligible for this measurement)
- DS-TWR compensation:
- Perform second exchange with roles reversed (B→A→B)
- Average both RTT measurements
- Clock drift errors cancel out (one overestimates, one underestimates)
- Achieves 5-10cm accuracy vs 10-30cm for single-sided TWR
59.14.2 Challenge 2: TDoA Anchor Synchronization Requirements
Scenario: A TDoA system needs 10cm positioning accuracy. Anchors are synchronized via Ethernet PTP.
Calculate:
- Maximum allowable time sync error between anchors
- Corresponding PTP accuracy requirement
- Impact if one anchor drifts by 5 ns
Given:
- 1 ns timing error = 30 cm position error (speed of light)
- Target accuracy: 10 cm
Hint: Time error translates directly to distance error via c = 3×10^8 m/s.
Solution
- Max sync error: 10 cm / (0.3 m/ns) = 0.33 ns between any two anchors
- PTP requirement: IEEE 1588 PTP over Ethernet achieves <100 ns sync typically. Need <0.33 ns → requires PTP with hardware timestamping + UWB-specific calibration (wireless anchor-to-anchor ranging to measure and compensate residual offset).
- 5 ns drift impact: Position error = 5 ns × 0.3 m/ns = 1.5 meters. This is catastrophic! System would report wrong position by 1.5m, making it unusable for precision applications.
Key Insight: TDoA is extremely sensitive to anchor synchronization. Even nanosecond-level drift destroys accuracy. This is why enterprise TDoA systems use wired Ethernet + PTP + wireless calibration packets.
59.14.3 Challenge 3: Ranging Technique Selection
Scenario: You must choose between TWR and TDoA for three different applications.
Applications:
- Smartphone-to-Smartphone Ranging (Apple AirDrop-like feature): 2 devices, ad-hoc, no infrastructure
- Warehouse Asset Tracking: 5,000 pallets, 10 Hz updates, battery tags
- Automotive Keyless Entry: Car (4 anchors) verifies phone proximity, <100ms latency required
For Each Application:
- Choose TWR or TDoA
- Justify based on infrastructure, scalability, power, latency
Solution
- Smartphone-to-Smartphone → TWR
- No infrastructure available (ad-hoc peer-to-peer)
- TDoA requires synchronized anchors (not possible)
- TWR works between any two devices with no setup
- Latency: ~40ms for 3-hop TWR exchange (acceptable)
- Warehouse Asset Tracking → TDoA
- 5,000 tags would saturate TWR (each tag × 4 anchors × 10 Hz = 200,000 exchanges/sec = impossible)
- TDoA: each tag transmits 1 blink/100ms = 50,000 blinks/sec = 50% channel utilization (feasible)
- Battery: TDoA tags only transmit once (10× longer battery vs TWR)
- Infrastructure cost justified by scale
- Automotive Keyless Entry → TWR (specifically DS-TWR)
- 1 phone, 4 car anchors = small scale (TWR handles easily)
- DS-TWR provides bidirectional verification (prevents relay attacks)
- Latency: 4 × 2.4 ms = 9.6 ms per anchor (all 4 in <40ms)
- No sync infrastructure needed in car (cost saving)
59.15 What’s Next?
| Chapter | Description |
|---|---|
| UWB Positioning Systems | Design complete indoor positioning systems with anchor placement, GDOP analysis, and architecture selection |
| UWB Applications and Security | Automotive digital keys, industrial tracking, and secure ranging against relay attacks |
| UWB Fundamentals | Core UWB radio principles including impulse radio, channel structure, and IEEE 802.15.4z |
| NFC Fundamentals | Near-field communication as a complementary short-range technology at 13.56 MHz |
| RFID Standards and Protocols | ISO standards and EPC Gen2 protocol comparison with UWB ranging |