Burst Mode Two-way Ranging with Cramér-Rao Bound Noise Performance
Steven Lanzisera and Kristofer S.J. Pister
Berkeley Sensor and Actuator Center
University of California, Berkeley
Berkeley, CA 94720, USA
Abstract — This paper addresses estimating the distance
between wireless nodes using a two-way ranging
technique that approaches the Cramér-Rao Lower Bound
(CRB) on ranging accuracy in a white noise environment.
Standard two-way ranging methods do not achieve this
bound because sampling artifacts limit resolution through
range binning, so multiple measurements are combined to
improve performance. Code modulus synchronization is
presented as an alternative that approaches the CRB. The
analytical results presented in this article are confirmed
by implementing the technique on a prototype wireless
system and measuring the performance in the presence of
noise.
Index Terms — Ranging, two-way ranging, real time
location systems.
I. INTRODUCTION
Wireless networks have become a standard part of daily
life, but these networks are almost universally unaware of
device location. A key part of location aware wireless
networks is the ability to perform ranging methods that are
simple to implement, have excellent noise performance, and
do not have excessive hardware requirements. Methods for
network location awareness have been proposed and
implemented but usually require time synchronized
infrastructure, fail to approach noise limits, or require
continuous time tracking which is bandwidth or power
prohibitive. Two-way ranging methods, such as two-way
time transfer (TWTT), address the time synchronization
concerns, but sampling artifacts dominate the noise
performance [1]. Burst mode systems have been presented to
reduce the network bandwidth usage or to reduce duty cycle.
This paper proposes a burst mode, two-way ranging
method that achieves the Cramér-Rao Lower Bound (CRB)
for ranging accuracy in a noise limited environment without
excessive signal over sampling. The code modulus
synchronization (CMS) method has a real time component
that takes advantage of Nyquist sampling to capture the
signal information content and an off-line component where
range extraction occurs. CMS relies on standard pulse
compression techniques to improve ranging accuracy, and is
not specific to an individual standard, modulation scheme,
bandwidth or RF platform. It can be implemented as an
addition to the digital baseband processor of a transceiver
adding time of flight (TOF) ranging capability to the system.
This material is based upon work supported by the National Science
Foundation under Grant No. EEC-0425914.
Multipath mitigation strategies such as the MUSIC or matrix-
pencil super resolution techniques can be used in conjunction
with CMS to improve accuracy in multipath environments
[2,3].
A prototype of the system was implemented using a
commercially available 2.4 GHz radio, analog to digital
interface electronics, and an FPGA. A 2 MHz bandwidth
frequency shift keying ranging scheme was implemented, and
measurements over a noisy channel show that the CRB is
nearly achieved at moderate signal to noise ratios.
Section II discusses the limits to range resolution in an
additive white Gaussian noise environment (AWGN). Section
III presents code modulus synchronization. Section IV
presents signal designs that are compatible with IEEE
802.15.4 and IEEE 802.11b wireless protocols, and section V
presents an implementation on a prototype reconfigurable
wireless device that achieves the performance predicted by
theory.
SECTION II. LIMITS TO RANGE RESOLUTION IN AWGN
The achievable accuracy of ranging systems is limited by
four primary factors: clock synchronization, noise, sampling
artifacts, and multipath channel effects. These factors
introduce random, time and spatially varying errors into the
estimate resulting in finite accuracy. Time synchronization
and frequency reference mismatch between the devices
impact ranging system accuracy significantly because radio
waves propagate so quickly that minute timing errors cause
huge measurement errors. Multipath effects are a serious
challenge in indoor environments, and significant work
towards providing reasonable accuracy is underway. It is
expected that bandwidths in the low MHz will be able to
provide 1 meter accuracy when suitable super resolution
techniques are applied [2,3]. This section will address the
factors other than multipath effects.
A. Clock Synchronization
Time of flight measurement systems must be able to
estimate the time of transmission and arrival using a common
time base for accurate measurements. When two wireless
devices, A and B, perform range estimation, the simplest
method is for B to measure the time of arrival of a signal sent
by A. If the clocks are not perfectly synchronized, however,
and B’s notion of
 0 is offset in time from A’s, then this
offset, ∆
, directly adds a bias to the measurement. The
required time synchronization (1ns for 30cm accuracy) is too
stringent for most systems.
 The two-way time transfer (TWTT) method is a two-way &&&
$ 
 $% 
&&&& 
 
(4)
 
ranging (TWR) method that mitigates the effect of clock
synchronization error [4]. This method allows the time offset
where $&&& &&&&
 is the average signal power,  is the noise power,


 is the signal duration during which the bandwidth, , is

between A and B to be ignored. Both A and B are responsible
for measuring a time delay accurately using a local clock. A
must measure the time that it takes for the signal it sends to
return to it, and B must measure the time that the signal
spends at B accurately. If the time A sends the signal is
 ,
the time B receives the signal from A is
 , the time B
replies to A is
 , the time A receives the signal is back
from B is
 such that
 
 
 
 then A
measures
 

 and B measures
 

 . By
combining these two measurements together both the time of
flight (̂
and clock offset (∆
̂) can be estimated.
1 that exhibit this property are pseudorandom number (PN)
∆
̂  
 

2
(1)
1 same bandwidth as the constituent sub-symbols, and are often
̂  


2
(2)
One problem with two-way ranging is that the measurement
takes place over a relatively long period of time such that if
the reference frequencies at the two nodes are not identical,
an unknown bias will be added to the signal. This clock
frequency offset (also called clock drift) error must be
mitigated in some fashion [5]. Methods have been used to
mitigate the impact of frequency offsets in wireless systems
[6], and an implementation of an algorithm is required for
TWR to be viable.
B. Noise
The effect of white noise processes such as thermal and
electronic noise is well understood and can be quantified. A
range measurement degraded only by noise is limited in
accuracy by the signal energy to noise ratio at the receiver
and the occupied bandwidth. A ranging system suffers in low
signal to noise ratio (SNR) environments because the exact
time of an event cannot be resolved precisely in the presence
of noise. Radio waves move at the speed of light (3  10
m/s) meaning that a distortion in detection time of just 10 ns
results in 3 m of measurement error.
The mathematical expression that links SNR and
bandwidth together to give a bound on ranging performance
occupied. In many common signals, the bandwidth and
duration or tied together such that
  ' 1. Therefore, the
 / ratio is approximately equal to the SNR. By
exchanging the locations of the factors in (4),


  · $%
(5)
one advantage of having a
  product greater than 1
becomes clear. Signals with this property would exhibit better
noise performance at lower SNR values. One class of signals
sequences that result in long duration while retaining the
called pulse-compressed waveforms [7]. For a fixed signal
energy and noise density, increasing the bandwidth provides
significant improvements in noise performance. This fact is
one argument for increasing the bandwidth of RF based
ranging systems, but the bandwidth required to achieve
reasonable noise performance is not very large. The CRB can
be closely approached in many cases where  / ) 1, and
this is the intended target area for most communication
*
systems. It is also worth noting that 1  term in (3)
+, /-.
contributes very little to the CRB, and it is commonly ignored
for  / ) 1. Both bandwidth and  / play significant
roles in determining noise limited performance.
In two-way ranging systems such as radar or TWTT, the
noise limit is reduced by the round trip nature of the
measurement. In radar systems a single measurement is made
that represents twice the desired range thus reducing ̂ by a
factor of 4. In TWTT two measurements are made and then
averaged to get the one way range estimate resulting in a ̂
reduction of 2. These effects simply add constants to the
denominator of (3).
Figure 1 shows the CRB as a function of bandwidth for
 / of 10 dB and 26 dB. Signals with
  products of 10
10
3

can be derived from the CRB. Ranging is a parameter

estimation problem that has been studied in the context of 10
2

radar and sonar applications for decades, and the CRB under
1
a variety of conditions has been calculated. For a one way 10
time ranging system, the CRB can be used to calculate a
CRB (m)

lower bound for the variance of the estimate for the range, ̂ ,
0
10
10 dB
as
 1
-1 26 dB Es / N0

̂    !1  "
10
E s / N0
4   /  /
(3)
where ̂ is the variance of the range estimate,  is the speed
-2
10

of light,  is the occupied signal bandwidth in Hertz, and -3

 /# is the signal energy to noise density ratio [7]. The

10 5 6 7 8 9
10 10 10 10 10
SNR is related to  /# in that
Signal Bandwidth (Hz)
Fig 1. Cramer Rao Bound as a function of bandwidth.
to 1000 can enable large  / in communication systems. It bandwidth down to  / of about 3 dB.  / is typically
is interesting to note that that noise alone does not prevent 1 higher than 16 dB in 802.11b or 9 dB in 802.15.4 systems for
m accuracy for bandwidths down to a few megahertz. successful communication, and ranging signals can further
increase  / to meet performance requirements.
If the signal is sampled above Nyquist (4/0123 7 2),
C. Sampling Artifacts
It is commonly believed that the resolution with which one then the entire information content of the signal is captured in
can resolve the time of arrival in a sampled system depends the sampling process. Therefore, it should be possible to
directly on the sampling rate. This effect, known as range extract better time resolution than /0123 . Interpolation
binning [8], occurs when a matched filter is used to estimate between samples can yield significant improvements in
the time of arrival with a sampling rate of up to twice the resolution [5], but a major challenge is that many systems
signal bandwidth resulting in time resolution of 1/2. This would need to perform this interpolation in real time
sampling adds error to the estimate because the estimate increasing system complexity and power consumption
space is divided up into range bins that are /2 wide. The beyond reasonable limits [9].
error associated with this process is uniformly distributed
inside the range bin. By using the variance of the uniform SECTION III. CODE MODULUS SYNCHRONIZATION
distribution, the impact of sampling can be calculated. A round trip time of flight method known as code modulus

/0123


synchronization (CMS) takes advantage of Nyquist sampling
12 · 4/0123
 (6)
to mitigate the effect of sampling. CMS emulates a full
In the case of the IEEE 802.15.4 example, with sampling at duplex ranging system where the repeating node is
1/ the variance due to sampling can be calculated. retransmitting the signal that it is receiving from the first
 node without any delay. In CMS, however, half duplex radios
/0123

  436 
12 · 2  105 
such as those used in WSNs are used so the delay between
reception and retransmission must be managed carefully.
Because these measurements need to be performed in a burst
CMS as implemented uses a short PN code modulating an RF
rather than in continuous tracking, filtering (or averaging) to
carrier as the ranging signal. Figure 3 shows the basic
improve the resolution through the use of an error nulling
operation of the CMS. The first node, A, generates a local
loop is not bandwidth or power efficient solution. Using just
code that is synchronized with a local clock called the event
averaging, over 1000 measurements are required to achieve a
variance of 16  , and an improved TWTT method would
clock that has the same period as the PN code. This code is
used to modulate the carrier and is transmitted to the second
require over 30 measurements [1]. To reduce this error, the
node, B. B has a local event clock with the same period as at
signal can be over sampled. Figure 2 shows the CRB for a 2
MHz bandwidth signal with  / of 26 dB, the standard
A, but the phase of the clocks are offset. As a result, B knows
the length of the incoming PN code. B samples and
deviation of the range error due to sampling, and the
demodulates this signal, and exactly one circularly shifted
combined effect of both error sources as a function of
copy of the code is stored in memory. At this point, B has a
sampling frequency. This plot shows the sampling rate must
local copy of the code that is an average of multiple
be much higher than Nyquist to ensure that the error is not
receptions and that is circularly shifted due to the event clock
dominated by sampling. It is clear that one must sample very
phase offsets between A and B. After A has sent the code and
fast to have the error dominated by the CRB rather than
sampling when  / is at the high values possible in
B has received the code, the transceivers switch states, and B
communications. As the  / is reduced, the sampling
is now the source of the code. Starting on its event clock
rising edge, it transmits the circularly shifted code it received
speed required remains higher than twice the signal
back to A. On the next rising edge of its event clock, A starts
to record exactly one copy of the code. Because of the
1
10 roundtrip nature of the system, the circular shift that occurred
going from A to B is exactly undone going from B to A.
After A has received and accumulated the desired number of
code copies, the transceivers are shut off, and all of the real
σ of estimate (m)

0
10

-1
10 7 8 9
10 10 10
Sampling Frequency
Fig 2. Comparison of CRB to sampling induced error as a function of
sampling frequency. Fig 3. Code modulus synchronization with zero time of flight
 
 
time processing is completed. A then computes the cross
8    /
correlation between the code it recorded and the code that it (9)
sent, and the measured code offset is the time of flight. we find that CMS has an improved single measurement
Because this system relies on sampling the signal above variance.
Nyquist, the received code can be interpolated to improve ,DEF
 34/0123


,8988
 4    /
resolution up to the noise limit of the system. The correlation (10)

Substituting for 4/0123 the factor G where G represents

and code offset estimation are not done in real time enabling
the computation to be done at any time using any method the
user desires. This system can approach the CRB in a single how much faster the sampling is than the signal bandwidth,
measurement as long as the sampling rate of the received we find that if
code is above Nyquist, substantially improving over other G  2H /3 (11)
two-way ranging methods. then CMS provides better performance than TWTT. This
Multiple copies of the code can be sent one directly after result is directly in line with figure 2 where signals must be
another in order to increase the signal energy further. The highly oversampled to achieve performance approaching the
receiving system can accumulate multiple copies of the code CRB unless CMS is used.
in order to improve SNR, but they are all exactly one copy of
the code that is circularly shifted in exactly the same way as SECTION IV. SIGNAL DESIGNS FOR IEEE
the other received copies. This averaging of multiple copies is 802.15.4 AND IEEE 802.11B
important for achieving good noise performance. Two standards that are relevant to ad hoc wireless networks
In TWTT, the time of arrival must be determined at both are the IEEE 802.15.4 wireless sensor network and the IEEE
nodes involved in the range estimation, but in CMS only one 802.11b wireless LAN standards. The 802.15.4 standard is
node performs this calculation. Therefore while CMS reduces intended for low data rate (250kbps) ad-hoc networks, and
the required real time processing enabling better sampling the signal occupies a 2MHz RF bandwidth. The 802.11b
performance, the full processing gain of the system is not standard is also capable of ad-hoc networking but at higher
realized at the second node in CMS. This causes an apparent data rates (11Mbps) and occupies 11 MHz of RF bandwidth.
noise penalty. At the same time, CMS consists of a single Table I summarizes characteristics of these protocols.
range estimate just like in radar resulting in the same factor of Because the baseband SNR is large in both cases, the CRB is
2 noise benefit compared to TWTT. Ignoring the impact of a good bound on the noise performance of a ranging system.
the transmitter and receiver transfer functions for simplicity, After combining (3) and (5) and solving for
 , the required
the effective  / for TWTT is pulse compression factor, P, can be calculated.
 &&&
$ 
! "   · :; I 
    
 8988 &&&&  8  $%̂
(7) (12)
where : is the number of code copies averaged and ; is the The required values for P to achieve a 1m CRB are 1 and 64
code length. The time of arrival is not estimated at mote B in for 802.11b and 802.15.4 respectively. A signal consisting of
CMS, and the signal sent from B to A contains noise from the ;  8 chips will be used, and :  8 copies of this signal will
first leg of the trip. For CMS, then,  / is be averaged to ensure the required values of P are achieved
  : while maintaining at least equivalent performance to TWTT.
! " ·
  8988  Table II shows the CRB for these signals showing that short
<1  =:$&&&
  &&&&
 >
(8)
signals are required to achieve reasonable noise limited

performance along with the value of G that would be required
The last factor in (8) represents the noise penalty where : is to achieve the same performance using TWTT.
the number of code copies averaged over, and ; is the length
of the code. This term is minimized at high values of SNR

where it is approximately :/?1  √:A when the total power
TABLE I
IEEE standard characteristic summary
received is a constant function of SNR. For : values greater Standard Data rate Bandwidth Typical SNR
than 6, this term is always greater than ½, and this factor is 802.15.4 250 kbps 2 MHz >6 dB
effectively cancelled by the factor of 2 difference between the 802.11b 11 Mbps 11 MHz >10 dB
TWTT averaging effect and the CMS single measurement Table II
effect. CMS and TWTT provide comparable noise Ranging signal parameters and CRB
performance, but CMS avoids the sampling penalties G Req. for
common in TWTT by requiring only a single range Standard P
 CRB (60 )
TWTT
estimation calculation. 32JK
After a single measurement the variance,  , for TWTT or
802.11b 64 0.02 64
802.15.4 64 32JK 1.0 44
the enhanced version of TWTT presented in [1] is given by
(6). Comparing (6) to the CMS bound, given by
 Fig 4. Photograph of the Waldo RF prototyping platform.

SECTION V. PROTOTYPE MEASUREMENT RESULTS

A reconfigurable hardware platform, dubbed Waldo, has been
developed to study location aware network devices, and it is
shown in figure 4. A 2.4 GHz radio that provides access to
the baseband analog signals is connected to an FPGA through
analog to digital and digital to analog converters, and other
support hardware not critical to this work is also included. A
CMS based ranging system was implemented on this
hardware, and the test signal occupies a 2 MHz RF
bandwidth using binary frequency shift keying with a
deviation of ±0.75 MHz at 1 Mchip/s. The received signal is
sampled at a low IF of 5 MHz and demodulated in the digital
domain. The demodulated data is limited to 2MHz bandwidth
and is sampled at 16 MHz yielding range bins of 19 m. After
demodulation, 8 copies of the 8 chip signal are averaged for a

  product of 64 while maintaining code modulus
synchronization. After the real time CMS operations are
completed, the received signal is further analyzed in
MATLAB. The cross correlation between the transmitted
code and the received code is calculated, and the resulting
correlation function is low pass interpolated up to a sample
rate of 512 MSps. The peak location is estimated to find the
time of flight. A test setup where the RF signal is passed
through coaxial cables and a variable attenuator was used to
verify performance in a noisy channel. Figure 5 shows the
standard deviation of ranging measurements as a function of
baseband signal to noise ratio along with the CRB for this
system. At high values of SNR, the system does not achieve
the CRB because of the limited dynamic range of the digital
baseband processor. CMS performs within a factor of 2 of
the CRB demonstrating that at SNR of 6dB ( / = 24dB)
equivalent performance using TWTT would have required G
of 29 (a sampling rate of 57MHz) for a 2MHz bandwidth
signal. Table III shows a comparison of this work with the
prior art in two way ranging techniques including the number
TABLE III
Comparison of this work to prior art
 for single
Number of measurements
Ref
measurement (m) for 1m accuracy
[4]   /12 L 4/0123

352 York : McGraw-Hill. 2005.
[1]   /12 L 4/0123

19 [9] S. Srirangarajan, A. Tewfik, “Localization in Wireless Sensor

  /4  
This
1 the IEEE Global Communications Conference, 2005.
Work
Fig. 5. Measured noise performance as a function of SNR
of measurements required to achieve the same performance
as CMS under the same sampling rate and  / conditions.
SECTION VI. CONCLUSIONS
Code modulus synchronization (CMS), a burst mode, two-
way ranging method, approaches the CRB without excessive
over sampling in contrast to previously published methods. In
communication systems where the  / is typically large,
the effect of sampling has dominated noise induced error in
two-way ranging systems, but CMS avoids this pitfall by
requiring signal processing at only one of the two nodes
involved. This method was tested in a hardware prototype,
and performance within a factor of two of the CRB was
measured. When coupled with super resolution methods for
multipath mitigation, ad hoc networks can achieve multipath
limited accuracy in ranging using CMS.
ACKNOWLEDGMENT
The authors would like to thank D. Zats and G. Shaw for help
debugging the Waldo platform.
REFERENCES
[1] K. Ahmed, G. Heidari-Bateni, “Improving Two-Way Ranging
Precision with Phase-offset Measurments,” Proceedings of the
IEEE Global Communications Conference, 2006.
[2] N. Dharamdial, R. Adve, R. Farha. “Multipath Delay Estimations
using Matrix Pencil.” Proceedings of the IEEE Wireless
Communication and Networking Conference, 2003.
[3] K. Pahlavan, L. Xinrong, J.P. Makela. “Indoor Geolocation
Science and Technology.” IEEE Communications Magazine, Feb.
2002, pp112-118.
[4] D. Kirchner, D. (1991) “Two-way time transfer via
communication satellites.” Proceedings of the IEEE. Vol 79 No 7,
July 1991, pp 983-990.
[5] S. Lanzisera, D. Lin, K. Pister, "RF Time of Flight Ranging for
Wireless Sensor Network Localization," Workshop on Intelligent
Solutions in Embedded Systems (WISES), June 2006.
[6] Nanotron Technologies GmbH. “Real Time Location Services
(RTLS).” URL: www.nanotron.com/EN/docs/WP/WP_RTLS.pdf
[7] H.L. Van Trees, Detection, Estimation, and Modulation Theory,
Part III. New York: Wiley, 1968.
[8] M. Richards, M. Fundamentals of Radar Signal Processing. New
Networks under Non line-of-sight Propagation,” Proceedings of