Ultra-Wideband (UWB)

Quick Cap

Ultra-Wideband (UWB) is a short-range wireless technology that uses very short pulses (sub-nanosecond) spread across a wide bandwidth (500 MHz or more) to achieve centimeter-level ranging accuracy -- typically 10 cm or better. Unlike BLE and WiFi, which estimate distance from signal strength (RSSI), UWB measures the actual time of flight of radio pulses, making it fundamentally more accurate and resistant to multipath interference. UWB has emerged as the technology of choice for digital car keys, indoor positioning, asset tracking, and secure physical access control.

Interviewers test whether you understand why UWB achieves better positioning accuracy than BLE, the difference between TWR and TDoA ranging, the security advantages of time-of-flight over RSSI, and when UWB is the right choice vs simpler alternatives.

Key Facts:

• Bandwidth: 500 MHz or more (vs BLE's 2 MHz), enabling sub-nanosecond time resolution for precise ranging
• Accuracy: 10 cm typical, down to 2-3 cm in ideal conditions -- 10-100x better than BLE RSSI
• Standard: IEEE 802.15.4z (2020) defines enhanced ranging with security improvements (STS -- Scrambled Timestamp Sequence)
• Ranging methods: TWR (Two-Way Ranging) for peer-to-peer, TDoA (Time Difference of Arrival) for infrastructure-based tracking
• Security: Time-of-flight measurement prevents relay attacks that defeat BLE and NFC proximity systems
• Key chips: NXP SR150/Trimension, Qorvo (Decawave) DW3000, Apple U1/U2, Samsung Exynos Connect U100

Deep Dive

At a Glance

What Makes UWB Different

UWB achieves its precision through physics, not clever algorithms. Three properties set it apart from narrow-band radios like BLE and WiFi:

1. Wide bandwidth enables fine time resolution. The relationship between bandwidth and time resolution is fundamental: time resolution is approximately 1/bandwidth. UWB's 500 MHz bandwidth gives roughly 2 nanosecond time resolution, corresponding to 60 cm distance resolution before signal processing. With leading-edge detection and channel estimation, this refines to 10 cm or better. BLE's 2 MHz bandwidth gives roughly 500 nanosecond resolution -- 150 meters -- making direct time-of-flight impractical without signal processing tricks.

2. Short pulses resolve multipath. UWB pulses are so short (under 2 nanoseconds) that the direct path and reflected paths arrive at distinct, separable times. The receiver can identify the first-arriving pulse (the direct path) and ignore later reflections. Narrow-band signals like BLE cannot separate multipath components -- they add constructively or destructively, causing the well-known RSSI fluctuations that make BLE positioning unreliable indoors.

3. Low power spectral density. UWB spreads very low power across a very wide band -- typically -41.3 dBm/MHz (FCC Part 15 limit). This means UWB coexists with existing narrow-band systems without causing interference, but limits UWB's range compared to concentrated narrow-band transmissions.

IEEE 802.15.4z: Enhanced Ranging

The original UWB ranging standard (802.15.4a, 2007) defined the PHY but lacked security for ranging measurements. IEEE 802.15.4z (2020) added critical enhancements:

STS (Scrambled Timestamp Sequence) is the key security addition. It embeds a cryptographic sequence in the ranging packet that the receiver validates. An attacker cannot forge or replay a ranging packet because the STS changes with every exchange, tied to a shared secret. This prevents distance-reduction attacks where an attacker tries to make a device appear closer than it actually is.

Ranging Methods: TWR vs TDoA

UWB supports two primary ranging architectures, each suited to different deployments.

TWR (Two-Way Ranging)

In TWR, two devices exchange timestamped packets to measure the round-trip time of flight. The distance is calculated from the propagation delay.

Initiator                    Responder
     |                            |
     |------- Poll (t1) --------->|
     |                            | (t2)
     |                            |
     |<------ Response (t3) ------|
     |  (t4)                      |
     |                            |
     |------- Final (t5) -------->|
     |                            | (t6)

  DS-TWR (Double-Sided TWR):
  ToF = ((t4-t1) * (t6-t3) - (t3-t2) * (t5-t4)) / (t4-t1 + t6-t3 + t3-t2 + t5-t4)
  Distance = ToF * c  (speed of light)

Single-Sided TWR (SS-TWR): Uses one round trip (Poll + Response). Simpler but sensitive to clock drift between devices -- a 1 ppm clock offset causes roughly 30 cm error at 10 m distance.

Double-Sided TWR (DS-TWR): Uses three messages (Poll, Response, Final) to cancel out clock drift errors. More accurate but takes longer and uses more power.

TDoA (Time Difference of Arrival)

In TDoA, the tracked device (tag) transmits a single UWB blink, and multiple fixed anchors record the arrival time. The infrastructure computes the tag's position from the time differences between anchors.

Anchor A ─────────┐
          |               |
          |    Tag ◉      |  (Tag transmits one blink)
          |   /    \      |
       Anchor B   Anchor C─┘

  TDoA = (t_B - t_A), (t_C - t_A)
  Position solved by hyperbolic multilateration

Advantages of TDoA: The tag only transmits, never receives -- much lower power. Scales to thousands of tags because tags do not need to coordinate with anchors. Ideal for warehouse asset tracking.

Disadvantages of TDoA: Requires time-synchronized infrastructure anchors (typically via wired backbone or UWB-based synchronization). Minimum 3 anchors for 2D position, 4 for 3D. Infrastructure cost is higher than TWR peer-to-peer.

UWB vs BLE for Positioning

This comparison is a common interview question because both technologies claim "indoor positioning" capabilities but achieve vastly different results.

Use Cases for Embedded UWB

Digital Car Keys: UWB enables secure, precise vehicle access. The car and phone perform DS-TWR ranging to verify the phone is within 1-2 meters before unlocking. Unlike BLE-based car keys, UWB's time-of-flight measurement prevents relay attacks where attackers extend the BLE signal to unlock the car from a distance. The Car Connectivity Consortium (CCC) Digital Key 3.0 specification mandates UWB for secure ranging.

Indoor Positioning Systems (IPS): Warehouses, hospitals, and factories use UWB TDoA infrastructure to track assets, personnel, and equipment in real time with sub-meter accuracy. A typical deployment uses 4-8 anchors per 1,000 square meters with wired Ethernet synchronization.

Asset Tracking: Apple AirTag, Samsung SmartTag+, and Tile Ultra use UWB for "precision finding" -- guiding the user to the exact location of a tagged item within a room. The phone performs TWR ranging and displays a directional arrow with distance.

Secure Physical Access Control: Office buildings and data centers use UWB to verify a person's phone is physically at the door before granting access. Unlike NFC (requires physical tap) or BLE (susceptible to relay attacks), UWB provides both hands-free convenience and cryptographic distance verification.

Embedded UWB Chips

Integration pattern for embedded: Most designs pair a UWB chip (DW3000 or SR150) with a host MCU (Nordic nRF52840, STM32, ESP32). The UWB chip handles PHY and ranging via SPI commands; the host MCU runs the application, BLE stack (for device discovery), and position computation. The DW3000 draws approximately 31 mA during TX and 52 mA during RX, with sleep current under 1 uA -- making duty-cycled ranging feasible on battery-powered devices.

Security: Why Time-of-Flight Matters

UWB's security advantage over BLE and NFC is fundamental, not just incremental. It stems from the physics of time-of-flight measurement.

Relay attacks are the primary threat to proximity-based access systems. In a relay attack, an attacker uses two devices to extend the wireless range -- one near the car, one near the owner's phone -- making the car believe the phone is nearby when it is actually far away.

• NFC: Relay attacks proven with off-the-shelf hardware (extend NFC over TCP/IP). NFC has no ranging -- it assumes proximity from successful communication.
• BLE: RSSI can be amplified or relayed. BLE has no secure distance measurement -- any received signal is considered "in range."
• UWB with 802.15.4z STS: The ranging measurement includes cryptographically timestamped pulses. A relay adds propagation delay (at minimum, the speed-of-light delay through the relay path). The UWB receiver detects this added delay and rejects the ranging measurement. An attacker cannot "speed up" the signal to compensate because radio signals cannot travel faster than light.

Debugging Story: The Anchor Synchronization Drift

An indoor positioning system deployed 24 UWB anchors across a 3,000 square meter warehouse floor using TDoA to track 500 asset tags. Initial testing showed 15 cm accuracy, but after 48 hours of operation, accuracy degraded to 1-2 meters. Recalibrating the anchors restored accuracy, but it degraded again within hours.

The root cause was clock synchronization drift between anchors. The TDoA system required all anchors to share a common time reference with sub-nanosecond precision. The anchors used a wireless UWB-based synchronization protocol (instead of wired PTP over Ethernet). Temperature variations in the warehouse -- 15 C near loading docks, 25 C in interior -- caused the crystal oscillators in the anchors to drift at different rates. The wireless sync protocol compensated for average drift but could not track the rapid temperature-induced frequency changes at the dock-side anchors.

The fix was twofold: (1) switch dock-side anchors to wired Ethernet synchronization using IEEE 1588 PTP (Precision Time Protocol), which provided sub-nanosecond accuracy independent of temperature; (2) for the remaining wireless-synced interior anchors, increase the sync rate from once per second to 10 times per second to track temperature-induced drift more closely.

Lesson: TDoA anchor synchronization is the hardest engineering problem in UWB positioning systems. Time errors of 1 nanosecond translate to 30 cm position error. Wired synchronization (PTP/Ethernet) is more reliable than wireless, especially in environments with temperature gradients. Always budget for the synchronization infrastructure, not just the anchors themselves.

What interviewers want to hear: You understand that UWB achieves precision through wide bandwidth and time-of-flight measurement, not signal strength. You can explain the TWR vs TDoA trade-off (peer-to-peer vs infrastructure). You know that 802.15.4z STS provides cryptographic ranging security that prevents relay attacks -- something BLE and NFC cannot do. You can articulate when UWB is worth its cost premium over BLE (precise positioning, secure access) vs when BLE is sufficient (room-level presence, basic proximity).

Interview Focus

Classic Interview Questions

Q1: "Why is UWB more accurate than BLE for indoor positioning?"

Model Answer Starter: "UWB achieves centimeter-level accuracy because it measures the time of flight of radio pulses directly. Its 500 MHz bandwidth gives sub-nanosecond time resolution, and its short pulses (under 2 ns) can resolve multipath -- separating the direct path from reflections. BLE estimates distance from RSSI, which varies unpredictably with multipath, body shadowing, and environmental changes. A person walking between a BLE beacon and receiver can cause 10+ dBm RSSI variation, equivalent to meters of distance error. UWB's time-of-flight measurement is immune to these effects."

Q2: "What is the difference between TWR and TDoA ranging?"

Model Answer Starter: "TWR (Two-Way Ranging) is peer-to-peer -- two devices exchange timestamped packets and compute distance from the round-trip propagation time. DS-TWR uses three messages to cancel clock drift. No infrastructure is needed, but both devices must transmit and receive. TDoA (Time Difference of Arrival) uses infrastructure anchors -- the tag transmits a single blink, multiple anchors record the arrival time, and a server computes position from the time differences. TDoA is better for tracking many assets because tags only transmit, but it requires time-synchronized anchors and at least 3 anchors for 2D positioning."

Q3: "How does UWB prevent relay attacks that affect BLE car keys?"

Model Answer Starter: "UWB measures the actual time of flight of radio pulses using cryptographically secured timestamps (STS in 802.15.4z). A relay attack adds physical distance -- the signal must travel from the car to the attacker's device, through a communication link to the second attacker's device near the owner, and back. This added distance creates a measurable time delay. Since radio cannot travel faster than the speed of light, the attacker cannot compensate for this delay. The UWB receiver detects that the measured distance exceeds the expected maximum and rejects the ranging result. BLE has no equivalent -- it uses RSSI, which can be amplified to simulate proximity."

Q4: "When would you choose BLE over UWB for a positioning application?"

Model Answer Starter: "I choose BLE when room-level or zone-level accuracy (1-5 meters) is sufficient, cost is the primary constraint, and I need massive scale. BLE beacons cost $1-3 each and the infrastructure is simple -- just broadcast iBeacon or Eddystone packets. For an application like museum exhibit proximity or retail aisle detection, BLE is adequate and far cheaper. I choose UWB when I need sub-meter accuracy (warehouse bin-level tracking), security (car keys, access control where relay attacks are a concern), or real-time tracking of moving assets. The cost premium of UWB ($3-8 per module plus infrastructure) is justified only when precision or security are hard requirements."

Q5: "What are the main challenges of deploying a UWB indoor positioning system?"

Model Answer Starter: "Three challenges dominate. First, anchor synchronization -- TDoA requires all anchors to share a time reference with sub-nanosecond precision, which typically means wired Ethernet with PTP. Wireless sync works but drifts with temperature and is harder to maintain. Second, infrastructure cost -- you need 4-8 anchors per 1,000 square meters, each with power and often Ethernet. Third, NLOS (non-line-of-sight) conditions -- UWB can range through walls and obstacles, but accuracy degrades from 10 cm to 30-100 cm depending on the material. Concrete and metal cause the most degradation. Careful anchor placement and NLOS detection algorithms are essential."

Trap Alerts

• Don't say: "UWB replaces BLE" -- UWB and BLE are complementary. Most UWB products use BLE for device discovery and session setup, then switch to UWB for precise ranging. Apple AirTag uses both.
• Don't forget: TDoA requires synchronized infrastructure -- it is not a "deploy and forget" technology. Anchor synchronization is the hardest part of a UWB deployment.
• Don't ignore: Power consumption -- UWB ranging events draw 30-50 mA. For battery-powered devices, the ranging rate must be carefully managed (e.g., range every 100 ms instead of continuously).

Follow-up Questions

• "How does DS-TWR cancel out clock drift between two devices?"
• "What is the relationship between UWB bandwidth and ranging accuracy?"
• "How does Apple's Nearby Interaction framework use UWB?"
• "What materials cause the most degradation for UWB ranging accuracy?"

Practice

Real-World Tie-In

Automotive Digital Key -- A luxury car manufacturer implemented CCC Digital Key 3.0 using NXP SR150 UWB and BLE 5.0 in both the car and the owner's smartphone. BLE handled device discovery and session establishment at 10+ meters. When the phone came within 3 meters, UWB DS-TWR ranging activated to determine the phone's precise position relative to the car -- enabling hands-free unlock of the nearest door and push-button start only when the phone was inside the cabin. The UWB-based anti-relay protection prevented a class of attacks that had affected the previous BLE-only key system.

Hospital Asset Tracking -- A 500-bed hospital deployed a Qorvo DW3000-based TDoA system with 180 ceiling-mounted anchors synchronized via wired PTP over Ethernet. Tags attached to wheelchairs, infusion pumps, and portable monitors reported position every 2 seconds with 30 cm accuracy. The system reduced "asset search time" from an average of 12 minutes to under 30 seconds, saving nursing staff an estimated 45 minutes per shift. The main deployment challenge was anchor placement in radiology rooms -- lead-lined walls blocked UWB signals entirely, requiring anchors inside each shielded room.

Smart Factory Zone Control -- A semiconductor fab used UWB to enforce access zones around sensitive equipment. Workers wore UWB-enabled badges that ranged against anchors at each restricted zone entrance. Unlike the previous BLE-based system (which had 2-3 meter accuracy and frequently triggered false alarms at adjacent zones), UWB's 10 cm accuracy precisely determined whether a worker was inside or outside a 1-meter safety perimeter. The system integrated with the factory's PLC network to automatically disable equipment startup when unauthorized personnel were within the safety zone.