# Improving Linux-Kernel Tests for LockDoc
with Feedback-driven Fuzzing

Alexander Lochmann  TU DortmundDepartment of
Computer Science 6Otto-Hahn-Str. 14DortmundGermany44227 ,  Robin Thunig  TU
DortmundDepartment of
Computer Science 12Otto-Hahn-Str. 16DortmundGermany44227 and  Horst Schirmeier
TU DortmundDepartment of
Computer Science 12Otto-Hahn-Str. 16DortmundGermany44227

(2020)

###### Abstract.

LockDoc is an approach to extract locking rules for kernel data structures
from a dynamic execution trace recorded while the system is under a benchmark
load. These locking rules can e.g. be used to locate synchronization bugs. For
high rule precision and thorough bug finding, the approach heavily depends on
the choice of benchmarks: They must trigger the execution of as much code as
possible in the kernel subsystem relevant for the targeted data structures.
However, existing test suites such as those provided by the _Linux Test
Project_ (LTP) only achieve – in the case of LTP – about 35 percent basic-
block coverage for the VFS subsystem, which is the relevant subsystem when
extracting locking rules for filesystem-related data structures.

In this article, we discuss how to complement the LTP suites to improve the
code coverage for our LockDoc scenario. We repurpose _syzkaller_ – a coverage-
guided fuzzer with the goal to validate the robustness of kernel APIs – to 1)
_not_ aim for kernel crashes, and to 2) maximize code coverage for a specific
kernel subsystem. Thereby, we generate new benchmark programs that can be run
in addition to the LTP, and increase VFS basic-block coverage by 26.1 percent.

Test Generation, Kernel Test Coverage, Basic-Block Coverage, syzkaller, Linux
Test Project, kcov

††conference: Herbsttreffen Fachgruppe Betriebssysteme; September 24–25, 2020;
Aaachen, Germany††doi: 10.18420/fgbs2020h-01

##  1\. Introduction

Over a period of more than a decade, the Linux kernel underwent a
transformation from Linux 2.0’s coarse-grained and sturdy Big Kernel Lock
Bovet and Cesati (2005) to more and more fine-grained synchronization on the
granularity of kernel subsystems and even single data structures Bovet and
Cesati (2005); Love (2010); Russell ([n.d.]). While reducing lock contention
and scaling better to multi- and many-core platforms, fine-grained locking is
error-prone and has led to numerous synchronization bugs in the past. This
situation is exacerbated by incomplete, inconsistent and in parts faulty
locking documentation.

Our LockDoc approach Lochmann et al. (2019) addresses these issues by tracing
locking patterns and data-structure accesses in a running Linux kernel under
load, and deriving locking rules – i.e., which locks in which particular order
must be taken to access a specific data-structure element – from this trace.
The derived locking rules can consequently be used to validate or generate
documentation, and to locate synchronization bugs. However, locking-rule
quality and the capability to find bugs also in remote parts of the kernel
heavily depends on how the system is put under load – i.e. on the choice of
benchmark programs that trigger the execution of kernel code by invoking
system calls. Focusing on the Linux kernel’s _Virtual File System_ (VFS)
subsystem in our LockDoc study Lochmann et al. (2019), we relied on a
filesystem-specific subset of the _Linux Test Project_ (LTP) Larson (2002);
Hrubis et al. ([n.d.]) benchmark suites to provoke lock operations for and
accesses to VFS data structures.

However, when we actually measure basic-block test coverage in Linux with kcov
Vyukov (2016) while running all LTP suites that even remotely seem to be
related to VFS, our results indicate that only about 35 percent of the
kernel’s basic blocks associated with the VFS subsystem are actually executed.
Although it is not reasonable to expect 100 percent coverage – e.g., depending
on the kernel configuration there may be several filesystems compiled in that
are not associated with an actual mount point on the test system – there is
certainly room for improvement.

In this article, we propose an approach to increase kernel-code coverage for
LockDoc: We repurpose _syzkaller_ Vyukov (2015), a coverage-guided fuzzer with
the goal to validate the robustness of kernel APIs, to not aim for kernel
crashes but only for basic-block coverage in a particular kernel subsystem.
The thereby generated new benchmark programs can be run in addition to the LTP
suites, and increase VFS basic-block coverage by 26.1 percent from 34.7
percent (LTP only) to 43.8 percent (LTP + generated benchmarks).

To summarize, the contributions of this article are:

  * •

A quantitative analysis of the LTP’s capability to trigger code execution in
Linux’s VFS subsystem (Sec. 3).

  * •

An approach to repurpose a coverage-guided kernel fuzzer to generate benchmark
programs that target a particular kernel subsystem and do not crash the system
(Sec. 3).

  * •

An evaluation demonstrating that the combination of LTP and generated
benchmark programs covers significantly more VFS basic blocks than LTP alone
(Sec. 4).

Sec. 2 discusses related work, and Sec. 5 concludes the paper.

##  2\. Related Work

Linux-kernel test coverage has been a research topic since Linux’s very early
days. Iyer Iyer (2002) analyzes the LTP’s coverage of Linux 2.4 kernel code
with GCOV, and reports that parts of the fs/ kernel source-code subtree have
line-coverage values between 0.0 (especially for most of the actual filesystem
implementations) and 29.5 percent (for the generic, filesystem-agnostic part).
Larson Larson et al. (2003) distills detailed HTML reports from GCOV results
obtained from Linux 2.5, reports that the LTP covers about 90 percent of all
kernel basic blocks that are executed by a much larger benchmark corpus, and
concludes that coverage results should drive further LTP development. Yoshioka
Yoshioka (2007) describes a Linux regression test framework named
_crackerjack_ and the accompanying branch-coverage test tool _btrax_ , and
demonstrates coverage advantages over LTP. The _Lachesis_ approach Claudi and
Dragoni (2011) by Claudi and Dragoni provides a test suite focusing on real-
time extensions for Linux.

While OS-kernel fuzzing approaches date back to at least 1991 with Le’s _tsys_
Le (1991) or to 2006 with _trinity_ by Jones et al. Jones et al. (2006),
modern kernel-fuzzing approaches like Vyukov’s _syzkaller_ Vyukov (2015) are
coverage-guided. For example, Nossum and Casasnovas Nossum and Casasnovas
(2016) port the prominent user-mode fuzzer AFL to the kernel and uncover
filesystem bugs. _DIFUZE_ by Corina et al. Corina et al. (2017) fuzzes kernel
drivers to detect bugs, and is aided by static analysis that determines the
necessary input structure. Schumilo et al.’s _kernel AFL_ (kAFL) Schumilo et
al. (2017) is a target-OS agnostic fuzzing approach based on a hypervisor and
hardware support in the form of Intel’s _processor trace_ feature. Shi et al.
Shi et al. (2019) demonstrate the practical application of existing kernel-
fuzzing tools to several Linux versions, and provide an overview of several
other kernel-fuzzing approaches.

To the best of our knowledge, the approach described in this paper is the
first to repurpose coverage-guided kernel fuzzing to generate benchmarks that
complement existing test suites.

##  3\. Approach

The quality of LockDoc’s results heavily depends on the number of observed
lock operations and data-structure accesses Lochmann et al. (2019). Due to
static-analysis limitations (e.g. pointer aliasing), it is generally
infeasible to statically identify all code locations that make such accesses.
For similar reasons it is generally infeasible to statically determine all
contexts from which these code locations are called, and consequently, which
locks are possibly held when the data-structure accesses are made. LockDoc
therefore resorts to dynamic analysis, i.e. the observation of the running
kernel under a benchmark load. As LockDoc focuses on the VFS subsystem to
determine locking rules e.g. for the _inode_ data structure, the problem at
hand therefore is to find and run benchmarks that maximize kernel-code
coverage for this particular subsystem.

The literature proposes several metrics for code coverage, e.g., path, branch
or line coverage Zhu et al. (1997); Myers et al. (2011). For this paper, we
chose basic-block coverage over line coverage, because it better captures the
actual fraction of the code that is being executed. One line of code, for
example, can be mapped to several basic blocks. Hence, having one particular
line covered does not necessarily mean all basic blocks are covered.
Inversely, covering all basic blocks means all lines of code that have been
compiled are covered.

For the Linux kernel, there is already a good starting point for executing a
large fraction of kernel code: the _Linux Test Project_ (LTP) Larson (2002);
Hrubis et al. ([n.d.]), of which we already used a VFS-related subset for
earlier work on LockDoc Lochmann et al. (2019). LTP’s aim is to _“validate the
reliability, robustness, and stability of Linux”_ Hrubis et al. ([n.d.]). It
consists of several individual tests that are grouped into test suites. Each
of these suites targets a particular subsystem or a particular kernel
functionality such as the IPC mechanism or the VFS subsystem. The scope of the
tests ranges from stress testing to regression testing. Since those tests are
manually composed, only a limited subset of each system call’s parameter space
can be covered, resulting in a limited amount of code coverage.

The VFS-related LTP test suites generate a basic-block coverage of 34.7
percent for the VFS subsystem. We determined the coverage for each test
individually of the following test suites111We use git tag _20190115_ of the
LTP repository.: _dio_ , _fcntl-locktests_ , _filecaps_ , _fs_ , _fs_ext4_ ,
_fs_perms_simple_ , _fsx_ , _io_ , and _syscalls_. As the _fs_readonly_ suite
only runs a subset of _fs_ on a read-only mounted filesystem, we skipped it.
Tab. 1 shows the number of VFS basic blocks covered by each suite.

Test Suite | # Tests | Covered VFS BBs | (%)
---|---|---|---
dio | $30$ | $8312$ |  $11.0$%
fcntl-locktests | $1$ | $2420$ |  $3.2$%
filecaps | $1$ | $2518$ |  $3.3$%
fs | $65$ | $17\,495$ |  $23.2$%
fs_ext4 | $4$ | $13\,081$ |  $17.3$%
fs_perms_simple | $18$ | $5081$ |  $6.7$%
fsx | $1$ | $6572$ |  $8.7$%
io | $2$ | $6817$ |  $9.0$%
syscalls | $1181$ | $24\,217$ |  $32.1$%
Total | $1303$ | $26\,229$ |  $34.7$%
Table 1. Covered basic blocks for each LTP test suite in the VFS subsystem. In
total, our Linux 4.10 kernel build consists of 342,732 basic blocks, and the
VFS subsystem of 75,531 basic blocks, respectively.

The numbers indicate that there is still room for coverage improvement – and,
hence, higher LockDoc precision and bug-finding effectiveness. It turns out
that _fuzzing_ (see Sec. 2) in its coverage-guided feedback variant already
has coverage maximization as one of its main goals. A coverage-guided kernel
fuzzer that recently came to fame is Vyukov’s _syzkaller_ Vyukov (2015), which
fuzzes the Linux kernel by randomly generating user programs that use the
system-call interface. For each generated program (see an example in Listing
1), syzkaller determines the resulting basic-block coverage. Only programs
that cover at least one new basic block are stored in the database.
syzkaller’s objective is to trigger kernel bugs, and to minimize the program
that triggered the bug.

⬇

int main(void)

{

syscall(__NR_mmap, 0x1ffff000, 0x1000, 0, 0x32, -1, 0);

syscall(__NR_mmap, 0x20000000, 0x1000000, 7, 0x32, -1, 0);

syscall(__NR_mmap, 0x21000000, 0x1000, 0, 0x32, -1, 0);

*(uint32_t*)0x20002480 = 0x20000340;

memcpy((void*)0x20000340, "\x12", 1);

*(uint32_t*)0x20002484 = 1;

*(uint32_t*)0x20002488 = 0;

syz_read_part_table(0, 1, 0x20002480);

return 0;

}

Listing 1: An excerpt of a program generated by fuzzing the Linux Kernel using
Syzkaller (Vyukov, 2015).

We modified syzkaller to 1) ignore programs triggering a bug, and to 2) only
store programs that increase the coverage in the VFS subsystem. We furthermore
disabled a set of system calls that are not related to the VFS to improve
fuzzing speed. The resulting programs are intended to cover more code, and
thus cover more memory accesses, which in turn can be used by LockDoc. Note
that these generated benchmark programs cannot (directly) be used as
regression tests for the kernel, as they do not make any explicit output that
can be used to determine test success.

##  4\. Evaluation

In this section, we first present our evaluation setup in Sec. 4.1, and then
show our results in Sec. 4.2.

###  4.1. Setup

We conduct our experiments on an x86 64-bit Linux Kernel 4.10. The kernel is
built without module support, and uses a minimal kernel configuration: Network
support is active as well as the essential drivers for the root filesystem and
for running in a paravirtualized _QEMU_ -based virtual machine. To record the
executed basic blocks, we enabled a kernel feature called kcov Vyukov (2016),
which was initially introduced by syzkaller Vyukov (2015).

The syzkaller modifications222Our modifications are based on git commit
_056be1b9c8d0c6942412dea4a4a104978a0a9311_. mentioned in Sec. 3 include
disabling 191 system calls that are not related to VFS, e.g. those for process
control, memory operations, or network operations. Based on an example given
by syzkaller, we implemented a library that records the executed kernel basic
blocks during execution of an arbitrary program in 307 lines of _C++_ code.
Since the library hooks into the program under test via the _LD_PRELOAD_
mechanism, we collect covered basic blocks for a complete process hierarchy.
We used this library to gather the results presented in Sec. 3.

Whether one basic block belongs to the VFS subsystem or not is determined
using _addr2line_
333https://sourceware.org/binutils/docs/binutils/addr2line.html on the Linux-
kernel ELF image: It converts an address to one or more kernel source-file
names. Due to function inlining, it may return more than one source file for a
single address. If a source file matches the following regular expression, a
basic block is considered to belong to the VFS subsystem:
/fs/|/mm/|fs\\.h|mm\\.h. We also include the mm directory and header files
containing mm.h, because the file-I/O code is located there such as
mm/readahead.c or mm/page-writeback.c.

###  4.2. Results

During its 65-hour run, syzkaller generated 2278 programs that created a
basic-block coverage of 10.0 percent _for the whole kernel_ and 31.4 percent
_for the VFS subsystem_. Moreover, it covers 9.1 percent of VFS basic blocks
that are _not already covered by LTP_. Fig. 1 shows the development of these
three basic-block coverage numbers during syzkaller’s run: The basic-block
coverage increases quickly after the start, and slowly levels off afterwards.
The Y axis on the left-hand side of the plot shows the absolute amount of
basic blocks covered, the Y axis on the right side the percentage of VFS basic
blocks.

The relation between basic blocks belonging to the VFS subsystem, and those
covered by syzkaller’s generated programs and by LTP’s test suites, is
displayed in the area-equivalent Venn diagram in Fig. 2. The absolute numbers
shown for each area intersection are the absolute number of basic blocks
shared among all intersecting basic-block sets.

Figure 1. Development of the Linux-kernel basic-block coverage for the
programs generated by syzkaller. The dotted line shows the number of covered
basic blocks out of all 342,732 kernel BBs; the dashed line shows the fraction
of the 75,531 basic blocks of the VFS subsystem. The solid line shows the
number of VFS basic blocks covered by syzkaller-generated programs that are
not already covered by LTP.

To summarize, our results indicate that combining LTP and syzkaller’s programs
to one workload can significantly improve the overall code coverage for the
VFS subsystem by 9.1 percentage points from 34.7 to 43.8 percent.

Figure 2. Set relations between VFS-subsystem basic blocks, and basic blocks
covered respectively by syzkaller’s generated programs and by LTP’s test
suites.

##  5\. Conclusions

In this article, we showed that using LTP as the only benchmark source for
LockDoc yields limited kernel-code coverage, as it only covers 35 percent of
basic blocks for the VFS subsystem. We repurposed syzkaller to generate
programs that complement LTP to achieve better coverage, with the future-work
goal to improve LockDoc’s precision and bug-finding effectiveness. We were
able to increase the VFS basic-block coverage by 26.1 percent by combining LTP
and syzkaller.

As our next steps, we plan to optimize the resulting benchmark suite in terms
of runtime with near-zero coverage loss. We want to discard tests or programs
that do not add new coverage or incur too much runtime.

## References

  * (1)
  * Bovet and Cesati (2005) Daniel Pierre Bovet and Marco Cesati. 2005.  _Understanding The Linux Kernel_ (3rd ed.).  O’Reilly Media Inc.
  * Claudi and Dragoni (2011) Andrea Claudi and Aldo Franco Dragoni. 2011.  Testing Linux-based real-time systems: Lachesis. In _Proceedings of the IEEE International Conference on Service-Oriented Computing and Applications (SOCA)_.
  * Corina et al. (2017) Jake Corina, Aravind Machiry, Christopher Salls, Yan Shoshitaishvili, Shuang Hao, Christopher Kruegel, and Giovanni Vigna. 2017\.  DIFUZE: Interface aware fuzzing for kernel drivers. In _Proceedings of the ACM SIGSAC Conference on Computer and Communications Security_. ACM Press, 2123–2138.
  * Hrubis et al. ([n.d.]) Cyril Hrubis et al. [n.d.].  Linux Test Project.  https://github.com/linux-test-project/ltp.  Accessed: 2020-08-20.
  * Iyer (2002) Manoj Iyer. 2002\.  Analysis of Linux Test Project’s kernel code coverage.  http://kernel.poly.ro/2.4/kernel%20docs/kernel_coverage.pdf.
  * Jones et al. (2006) David Jones et al. 2006\.  Trinity: Linux system call fuzzer.  https://github.com/kernelslacker/trinity.  Accessed: 2020-08-20.
  * Larson (2002) Paul Larson. 2002\.  Testing Linux with the Linux Test Project. In _Proceedings of the Ottawa Linux Symposium_. 265–273.
  * Larson et al. (2003) Paul Larson, Nigel Hinds, Rajan Ravindran, and Hubertus Franke. 2003\.  Improving the Linux Test Project with kernel code coverage analysis. In _Proceedings of the Ottawa Linux Symposium_. 275–289.
  * Le (1991) Tin Le. 1991.  tsys.  https://groups.google.com/g/alt.sources/c/V_B37EtnWKQ/m/NztsljVYV84J.  Accessed: 2020-08-20.
  * Lochmann et al. (2019) Alexander Lochmann, Horst Schirmeier, Hendrik Borghorst, and Olaf Spinczyk. 2019.  LockDoc: Trace-Based Analysis of Locking in the Linux Kernel. In _Proceedings of the 14th ACM SIGOPS/EuroSys European Conference on Computer Systems (EuroSys ’19)_ (Dresden, Germany). ACM Press, New York, NY, USA.  https://doi.org/10.1145/3302424.3303948
  * Love (2010) Robert Love. 2010\.  _Linux Kernel Development_ (3rd ed.).  Addison-Wesley, Boston, MA, USA.
  * Myers et al. (2011) Glenford J. Myers, Corey Sandler, and Tom Badgett. 2011\.  _The Art of Software Testing_ (3rd ed.).  Wiley Publishing.
  * Nossum and Casasnovas (2016) Vegard Nossum and Quentin Casasnovas. 2016.  Filesystem fuzzing with American Fuzzy Lop. In _Proceedings of the Linux Storage and Filesystems Conference (VAULT)_. USENIX Association.
  * Russell ([n.d.]) Rusty Russell. [n.d.].  Kernel Hacking Guides: Unreliable Guide To Locking.  https://www.kernel.org/doc/html/v4.15-rc9/kernel-hacking/locking.html.  Accessed: 2018-01-24.
  * Schumilo et al. (2017) Sergej Schumilo, Cornelius Aschermann, Robert Gawlik, Sebastian Schinzel, and Thorsten Holz. 2017\.  kAFL: Hardware-Assisted Feedback Fuzzing for OS Kernels. In _Proceedings of the 26th USENIX Security Symposium_. USENIX Association, Vancouver, BC, 167–182.  https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/schumilo
  * Shi et al. (2019) Heyuan Shi, Runzhe Wang, Ying Fu, Mingzhe Wang, Xiaohai Shi, Xun Jiao, Houbing Song, Yu Jiang, and Jiaguang Sun. 2019.  Industry Practice of Coverage-Guided Enterprise Linux Kernel Fuzzing. In _Proceedings of the 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering_ (Tallinn, Estonia) _(ESEC/FSE 2019)_. ACM Press, New York, NY, USA, 986–995.  https://doi.org/10.1145/3338906.3340460
  * Vyukov (2015) Dmitry Vyukov. 2015\.  Syzkaller: An unsupervised, coverage-guided kernel fuzzer.  https://github.com/google/syzkaller.  Accessed: 2020-08-20.
  * Vyukov (2016) Dmitry Vyukov. 2016\.  kcov: code coverage for fuzzing.  https://www.kernel.org/doc/html/latest/dev-tools/kcov.html.  Accessed: 2020-08-20.
  * Yoshioka (2007) Hiro Yoshioka. 2007\.  Regression Test Framework and Kernel Execution Coverage. In _Proceedings of the Linux Symposium_. 285–296.
  * Zhu et al. (1997) Hong Zhu, Patrick A. V. Hall, and John H. R. May. 1997\.  Software Unit Test Coverage and Adequacy.  _ACM Comput. Surv._ 29, 4 (Dec. 1997), 366–427.  https://doi.org/10.1145/267580.267590


# Ultra-Wideband Technology: Characteristcs, Applications and Challenges

Chutao Zheng

Yuchu Ge

Anfu Guo

###### Abstract

Ultra-wideband (UWB) technology is a wireless communication technology
designed for short-range applications. It is characterized by its ability to
generate and transmit radio-frequency energy over an extensive frequency
range. This paper provides an overview of UWB technology including its
definition, two representative schemes and some key characteristics
distinguished from other types of communication. Besides, this paper also
analyses some widely used applications of UWB technology and highlights some
of the challenges associated with implementing UWB in real-world scenarios.
Furthermore, this paper expands upon UWB technology to encompass terahertz
technology, providing an overview of the current status of terahertz
communication, and conducting an analysis of the advantages, challenges, and
certain corresponding solutions pertaining to ultra-wideband THz
communication.

###### Index Terms:

UWB communication, Positioning, Multipath interference, Ranging, Terahertz

##  I Introduction

Apple’s release of the iPhone 11 with an ultra-wideband (UWB) transceiver in
2019 has caused the ever-unknown ultra-wideband technology to receive
widespread attention. This technology provides users with the ability to
locate their position more accurately, allowing for much improved and expanded
applications in areas such as indoor navigation, indoor positioning, and
Internet of Things (IoT) connectivity. UWB is a wireless communication
technology characterized by transmitting data by transmitting a continuous
pulse signal in a very short period of time[1]. Initially, Ultra-Wideband
technology was primarily used in radar and military communications to play an
important role in stealth operations and precision ranging[2]. By 2002,
however, UWB technology was moving into the civilian world. In that year, the
U.S. Federal Communications Commission (FCC) allowed the use of UWB technology
in the broadband range, which promoted the development of UWB technology in
the field of communications. Due to its broadband nature, UWB technology can
offer higher data transfer rates and faster response times, making it one of
the ideal choices for future mobile devices.

With an extremely wide bandwidth and low power spectral density, UWB
communication can realize high data transmission rate, high confidentiality
communication, and accurate ranging and positioning ability, meanwhile, it
also has low interference to other frequency bands. However, because of
factors such as high price and limited distance, it is difficult to be very
widely used, thus its development is limited. Nowadays, as an enabler for
supporting Internet of Things (IoT) networks and applications[3], the fifth-
generation (5G) wireless network has been developed rapidly, thus contributing
to the development of the IoT. And the emergence of new IoT services and
applications, such as remote robotic surgery and flying vehicles, also
requires higher transmission rate to improve the quality of IoT service
delivery and business [4]. However, due to the limitations of the bandwidth,
Wi-Fi and Bluetooth will not be able to meet the transmission rate
requirements. On the contrary, UWB communication has a very wide bandwidth to
meet the rate requirement and will likely receive more attention. There are
also many other features such as low power consumption, low interference, high
interference immunity and high security. The detail of these characteristics
and corresponding principles will be discussed in SectionV and SectionVI. In
addition, with high confidentiality and precise accurate and positioning
ability, the use of UWB communication will also enhance the confidentiality
and accuracy of the IoT. Therefore, with the continuous development of IoT
technology, UWB communication will also be more widely used and rapidly
developed.

SectionII provides an overview of UWB technology, including its definition,
frequency range, and maximum radiated power, and compares UWB with narrowband
and broadband from the frequency domain and bandwidth perspectives. Then
SectionIII introduces IR-UWB, a representative of the implementation scheme of
UWB technology. This section firstly provides a general introduction of the
IR-UWB concept, then compares the conventional signaling techniques with
broadband signaling techniques, and finally describes the steps of the IR-UWB
scheme, including a basic overview of the key steps such as signal modulation,
pulse expansion, and so on.

Section IV describes another representative of the UWB technology
implementation scheme, MB-OFDM-UWB. This section begins with an overall
overview of the IR-UWB scheme. This section introduces the concept and vision
of MB-OFDM-UWB in general, then briefly describes the implementation
methodology of MB-OFDM-UWB, and finally describes its features, including
avoidance of used frequencies, strong multipath resistance, capture capability
and strong spectrum flexibility and coexistence. Section VII gives some widely
used ranging and positioning methods. For ranging, Two-Way Ranging (TWR) and
Double-side Two-Way Ranging (DS-TWR) are discussed to solve the error caused
by clock drift and time asynchronization. This section focus on the principle
and advantages and disadvantages of several basic geometry-based methods are
introduced. In addition, some advanced methods that can be used in NLOS
environment are mentioned. Finally, Section VIII gives a brief overview of the
current state of the UWB communication and THz band, then compares UWB-THz
communication with other communication methods, analyzes its advantages, and
introduces some challenges faced in long-distance communication and
corresponding solutions.

##  II Overview of UWB

###  II-A Definition of UWB

According to ITU-R SM.1755-0 recommendation, UWB communication technology is
defined as follows: UWB technology is a wireless communication technology
specifically designed for short-range applications. It encompasses the
intentional generation and transmission of radio-frequency energy, which
propagates over an extensive frequency range and is potentially coexistent
with multiple frequency bands allocated for radiocommunication services. UWB-
enabled devices commonly feature antenna radiation intentionally designed to
exhibit a minimum –10 dB bandwidth of 500 MHz or a –10 dB fractional bandwidth
exceeding 0.2[5].

According to FCC rules, UWB operates in a frequency ranging from 3.1 GHz to
10.6 GHz, with a bandwidth of 7.5 GHz[6].

###  II-B Maximum Radiated Power

To protect other radio services from UWB interference, the FCC has assigned
conservative emission masks for UWB devices. Within the frequency range of 3.1
GHz to 10.6 GHz, the provisions outlined by these regulations enforce
constraints on the maximum radiated power exhibited by UWB signals under
various operational scenarios. Fig.1 illustrates the emission limits imposed
by these regulations on the UWB devices employing indoor and outdoor
implementations[6].

Figure 1: FCC emission limits[6].

The template that restricts the spectrum occupancy of UWB communication
systems is commonly referred to as the UWB spectrum mask. Its formulation in
different countries ensures that UWB systems do not cause strong interference
to neighboring frequency bands when utilizing the spectrum.

Figure 2: UWB spectrum mask in China[1].

Fig.2 presents the UWB spectrum mask adopted in China. In the UWB spectrum
mask, the horizontal axis represents frequency, typically measured in
gigahertz (GHz), while the vertical axis represents power, commonly measured
in decibel milliwatts (dBm). In Fig.2, the “DAA” stands for “Detection and
Avoidance”, which represents a requirement within the UWB spectrum mask. It
indicates that UWB devices must possess the capability to detect and avoid
interfering with other wireless systems when utilizing the spectrum.

###  II-C Comparison with Narrowband and Broadband

In terms of the frequency domain, UWB signals are significantly different from
traditional narrowband and broadband signals due to their wider bandwidth. A
signal with a relative bandwidth of less than 1$\%$ is deemed narrowband if we
use relative bandwidth as the measure. Broadband signals have a relative
bandwidth of between 1$\%$ and 20$\%$. UWB signals have a relative bandwidth
larger than 20$\%$ or absolute bandwidth higher than 500MHz[7].

Besides, UWB signals exhibit a distinct characteristic of having a wide
frequency spectrum with energy distributed uniformly across the entire
frequency range, resulting in a flat spectral profile. In contrast, narrowband
signals possess a narrower frequency bandwidth and typically exhibit prominent
power peaks concentrated around their center frequency, indicating discrete
spectral peaks. While broadband signals generally have a wider frequency
bandwidth, they do not match the spectral spread achieved by UWB
transmissions. This is because UWB signals can span a frequency spectrum width
exceeding 500 megahertz (MHz), extending over several GHz. Consequently, UWB
signals surpass the conventional notion of broadband transmissions in terms of
spectral width.

The Fig.3 provides a rough illustration of the relative bandwidth and power
spectral density for the three communication forms mentioned above.

Figure 3: Comparation among three communication forms.[8]

##  III Impulse Radio UWB (IR-UWB)

###  III-A IR-UWB Technology

Impulse radio refers to the wireless technology that utilizes impulse pulses
(ultra-short pulses) as information carriers. The modulation of extremely thin
pulses (often less than 1 ns) to get wide bandwidth data for transmission is
the primary aspect of this technique. IR-UWB is a representative
implementation scheme in the field of UWB[8].

###  III-B Comparison between IR-UWB Signals and Traditional Communication
Signals

Traditional communication systems use continuous wave transmissions, which are
generated by a local oscillator and consist of a continuous high-frequency
carrier wave. Information is transmitted by modulating the carrier wave with
techniques such as amplitude modulation (AM) and frequency modulation (FM) and
then delivering it via an antenna. This technique of wireless communication is
used by current wireless broadcasting, 4G communication, and Wi-Fi. Fig.4
depicts the production of a continuous wave signal for use in amplitude
modulated voice transmission.

Figure 4: An amplitude-modulated signal.

IR-UWB transmissions, on the other hand, do not necessitate the production of
continuous high-frequency carrier waves. At the most basic level, they just
need to generate pulses with durations as short as nanoseconds, which will
subsequently be sent via an antenna. Information can be loaded by varying the
amplitude, length, and phase of the pulses, resulting in information
transmission. The Fig.5 depicts the generation of an IR-UWB signal for
conveying binary zero code via phase modulation[9].

Figure 5: A phase-modulated IR-UWB signal.

###  III-C Implementation Approach of IR-UWB

The following is the Implementation Approach of IR-UWB’s steps.

####  III-C1 Selection of pulse shape

IR-UWB signals employ pulse signals as the fundamental modulation waveform.
Commonly used pulse shapes include Gaussian Pulses, Binomial Pulses, etc. To
effectively radiate the signal energy through the antenna, certain
requirements are placed on the frequency spectral characteristics of the
chosen pulse waveform (i.e., absence of DC component, minimal presence of low-
frequency components, with predominant signal energy concentrated in the RF
region). Therefore, pulse radio utilizes derivatives of Gaussian functions as
the transmitted pulse waveform, allowing for different bandwidths and center
frequencies to be achieved by selecting the pulse width and sequence.

####  III-C2 Generation of pulse sequence

The pulse sequence essentially represents the discrete form of the IR-UWB
signal. Hence, it is necessary to generate the pulse sequence based on the
digital information to be transmitted and associate each pulse with its
corresponding binary bit in the subsequent steps.

####  III-C3 Modulation of pulse sequence

Modulation of the pulse sequence essentially involves loading the digital
information into the pulse sequence through the specific modulation method.
Information transfer is achieved by directly modifying the amplitude,
duration, and phase of the pulses for information loading.

Then four common modulation methods will be presented: Pulse Position
Modulation (PPM), Pulse Amplitude Modulation (PAM), On-Off Keying (OOK) and
Binary Phase Shift Keying (BPSK) [9]. PPM represents digital information by
adjusting the position of the pulse, while PAM represents digital information
by adjusting the amplitude of the pulse. On-Off Keying (OOK) represents
digital information by adjusting the presence or absence of the pulse, whereas
Binary Phase Shift Keying (BPSK) represents digital information by adjusting
the phase of the pulse. The Fig.6 provides a rough illustration of these
modulation techniques[9].

Figure 6: Four common modulation methods for IR-UWB signals[9].

####  III-C4 Amplitude adjustment

Amplitude adjustment refers to the process of adjusting the amplitude of the
modulated pulse sequence to meet the transmission requirements. By modifying
the amplitude of the pulse, the energy level of the signal can be changed,
thereby enhancing the transmission distance of the signal. Increasing the
amplitude of the pulse can provide stronger energy transmission, enabling the
signal to be received at greater distances. Therefore, controlling the
transmission power is crucial in certain applications such as wireless sensor
networks or energy-constrained devices. In addition, by adjusting the
amplitude of the pulse, the power level of the signal can be controlled
according to system requirements. This helps reduce energy consumption,
prolong battery life, and meet specific transmission needs.

####  III-C5 Pulse extension

Pulse extension refers to the process of extending the pulse width of the
signal from the original narrow pulse to a wider pulse signal. Common pulse
extension techniques include chip extension and filtering extension. Chip
extension involves performing mathematical operations between the original
narrow pulse and a longer pseudo-random sequence (known as a chip sequence) to
generate a wider expanded pulse. As a result, the expanded pulse has a broader
bandwidth in the frequency domain, making it easier for the receiver to
distinguish the signal and enhancing the signal’s immunity to interference.
Another technique is filtering extension, which utilizes filtering operations
to widen the pulse signal.

Pulse extension is a commonly used technique in IR-UWB systems to increase the
temporal duration and energy of the pulse signal, thereby improving the
transmission distance and resistance to multipath interference. It helps
mitigate the effects of multipath interference. In terms of long-distance
transmission, pulse extension offers better transmission distances. The
increased energy and improved interference resistance of the extended pulse
enable the signal to be transmitted over longer distances, mitigating the
effects of signal attenuation.

####  III-C6 Transmission of pulse signals

The modulated pulse sequence is transmitted through the antenna, forming a
wireless signal. This signal propagates through the air and can be captured by
the receiver.

####  III-C7 Signal reception

The receiver antenna of the IR-UWB system receives the transmitted pulse
signal from the transmitter. The received RF signal is amplified by the
receiver for subsequent processing. In an IR-UWB system, the received signal
is often weak, and therefore, it needs to be amplified to an appropriate
signal level by the RF front-end amplifier for subsequent demodulation and
processing.

####  III-C8 Signal demodulation

After amplification by the RF front-end, the signal needs to be demodulated
and filtered to extract the pulse signal. Common demodulation techniques for
Differential Binary Phase Shift Keying (DBPSK) include Energy Detection Based
Demodulation (EDD) Technique, Correlator Detection Based Demodulation (CDD)
Technique and Windowing Detection Based Demodulation (WDD) Technique[10].
Common demodulation schemes for PPM include Energy Detection Scheme, Energy
Detection Scheme, Correlator Scheme and Windowing Scheme[11].

####  III-C9 Filtering

After demodulation, the resulting baseband signal may contain noise. Filtering
operations are performed to remove these unwanted components. Different types
of filters can be selected, such as low-pass filters to remove high-frequency
noise or band-pass filters to select signals within specific frequency
ranges[12].

####  III-C10 Reconstruction of short pulse sequences

Based on the demodulated signal, the original short pulse sequence can be
reconstructed using signal processing algorithms. This may involve using
threshold detectors or energy detectors to extract the pulses and performing
further processing and recognition as required.

##  IV MB-OFDM-UWB

###  IV-A MB-OFDM-UWB Technology

With the development of UWB technology, new UWB techniques have emerged, among
which multi-band technology is the most representative. Multiband Orthogonal
Frequency Division Multiplexing UWB (MB-OFDM-UWB) is a prime example that
combines this technique. In an MB-OFDM-UWB system, the available UWB spectrum
is divided into several subbands, each with a width no less than 500 MHz.
During communication, a portion or all of the subbands can be dynamically
utilized based on the information rate, system power consumption requirements,
coexistence with other systems, etc., to improve the spectrum utilization by
simultaneously transmitting UWB signals in different frequency bands. These
UWB signals do not interfere with each other because they have different
frequencies [12].

Due to its significant similarities with traditional technologies, this paper
mainly introduces the general scheme and characteristics of the MB-OFDM-UWB
technology, without delving into specific implementation steps.

###  IV-B MB-OFDM-UWB Scheme

The MB-OFDM-UWB scheme adopts a multi-band approach, as illustrated in Fig.7.
The 3.1 GHz to 10.6 GHz frequency range is divided into 14 subbands (Bands),
with each subband of 528 MHz used to transmit OFDM signals consisting of 128
subcarriers. Each subcarrier occupies a bandwidth of 4.125 MHz. The 14
subbands are further divided into 5 subband groups (Band Groups), with each
group containing three or two subbands, enabling frequency diversity through
hopping between different subbands[1].

Figure 7: MB-OFDM-UWB scheme[1].

The MB-OFDM-UWB scheme possesses three main characteristics:

  * •

Avoidance of Used Frequencies:

MB-OFDM-UWB divides the spectrum into multiple subbands and utilizes
orthogonal frequency division multiplexing (OFDM) on each subband. As
different subbands are orthogonal to each other, they can simultaneously
transmit independent data streams without mutual interference within the same
spectrum. This design enables MB-OFDM-UWB to be flexible in spectrum
selection, allowing it to avoid frequencies already in use by other wireless
technologies and reducing interference with other systems[8].

  * •

Strong Multipath Resistance and Capture Capability:

The multi-band and orthogonal frequency division multiplexing techniques
employed in MB-OFDM-UWB allow for the utilization of multipath propagation
during transmission. As the different subbands are orthogonal, the different
signals formed by multipath propagation within them cancel each other out,
reducing the impact of multipath interference on the system. Moreover, MB-
OFDM-UWB exhibits good resolution in the time domain, enabling it to better
distinguish different paths in multipath propagation. This enhances the
system’s capability to capture and resolve multipath signals, improving
resistance to multipath interference.

  * •

Strong Spectrum Flexibility and Coexistence:

The multi-band and orthogonal frequency division multiplexing techniques in
MB-OFDM-UWB provide strong spectrum flexibility. Different subbands can be
flexibly configured according to various application requirements and
environmental conditions. Furthermore, due to the orthogonality between
subbands, multiple MB-OFDM-UWB devices can coexist in relatively close
proximity without interfering with each other. This results in good
coexistence capabilities in multi-user scenarios, making MB-OFDM-UWB suitable
for high-density wireless communication environments[1].

However, the MB-OFDM-UWB scheme does have its limitations. It utilizes
conventional OFDM technology instead of the pulse-based technology, which
leads to higher power consumption compared to IR-UWB. Additionally, it lacks
the penetrating capabilities and high security features of IR-UWB[1].

##  V Key Characteristics of UWB Technology

In this section, some features of UWB will be further discussed. These
characteristics make UWB technology have strong prospects for applications in
certain specific fields.

####  V-1 Low power consumption

Pulse-based UWB technology often utilizes intermittent pulse transmission for
data communication. In UWB positioning systems, the operating cycles are
typically in the range of 0.2 ns to 1.5 ns, resulting in low power
consumption. In high-speed communications, UWB devices consume only tens to
hundreds of watts [13, 14]. Therefore, compared to conventional wireless
devices, UWB positioning devices offer better battery life and lower
electromagnetic radiation.

####  V-2 Minimal interference with other devices

UWB technology shares spectrum resources with other wireless communication
systems. It utilizes a spectrum ranging from 3.1 GHz to 10.6 GHz, with a
bandwidth of up to 7.5 GHz, without requiring dedicated or proprietary
frequency bands. By limiting the transmission power, UWB also avoids causing
interference with other systems. This flexible spectrum utilization is one of
the main reasons for the significant development of UWB technology, especially
in situations where spectrum resources are scarce[7, 15].

####  V-3 Strong interference (from other devices) resistance

Due to the wide frequency spectrum distribution of UWB signals, which occupy a
large frequency range, UWB signals exhibit unique characteristics in the
frequency domain and possess strong resistance to narrowband interference
signals. The signal energy is spread across the frequency spectrum, making it
more resilient against interference[13].

####  V-4 High data rates

$C=Blog_{2}{(1+\frac{S}{N})}$ (1)

As the Shannon Formula shows above, the maximum achievable data rate or
channel capacity ($C$) of a communication channel can be calculated using
Shannon’s channel capacity formula, where $B$ represents the channel
bandwidth, $N$ represents the Gaussian white noise power spectral density, and
$S$ represents the average signal power. By increasing the transmission
bandwidth, UWB technology achieves extremely high data rates. Typically, the
maximum data transmission speed can reach from several tens of megabits per
second to several hundreds of megabits per second.

####  V-5 High security

Compared to non-UWB radio communication signals, UWB signals may be more
discreet and harder to detect[7]. This is because UWB signals occupy a wide
frequency band and can resemble noise-like signals. In other words, within
such a wide frequency range, UWB signals are masked by ambient noise, making
them difficult to detect. Each bit is typically represented by a large number
of very low amplitude pulses (often below the noise level). These
characteristics enable secure transmission with low detection probability
(LPD) and low intercept probability (LPI).

####  V-6 Time resolution and robustness against multipath interference

In traditional wireless communication systems, most RF signals are continuous
waveforms, resulting in the effects of multipath propagation on signal quality
and transmission rate. With UWB wireless transmission, short-duration periodic
pulses are used, typically with pulse widths ranging from a few nanoseconds to
a few tens of picoseconds. These pulses have small duty cycles and low work
periods, preventing overlap of multipath signals in time domain. However, due
to the extremely short pulse width, UWB signals appear as highly sharp pulses
in the time domain. The signals reflected from surfaces between the
transmitter and receiver are unlikely to overlap in time[16]. By using time-
domain processing techniques, UWB receivers can distinguish between direct and
reflected signals, effectively mitigating the adverse effects of multipath
interference[13].

####  V-7  Low signal attenuation and strong penetration

IR-UWB signals cover a wide frequency spectrum. This implies that IR-UWB
signals simultaneously utilize a broad range of frequency resources during
transmission. Compared to traditional narrowband signals, the energy of IR-UWB
signals is more dispersed across the spectrum, resulting in relatively lower
signal power at individual frequencies and reducing the impact of frequency
selective fading[5].

TABLE I: Comparison of Different Wireless Communication Technologies[17] Technology |  Data Rate |  Range |  Accuracy |  Network Topology |  Complexity |  Power Consumption |  Typical Applications
---|---|---|---|---|---|---|---
Bluetooth |  1 Mbits/s |  10 meters |  Several meters |  Ad-hoc; very small networks |  High |  Medium |  Wireless connectivity between devices such as phones, PDA, laptops, headsets
Wi-Fi |  11 & 54 Mbits/s |  50-100 meters |  Several meters |  Point to hub |  High |  High |  Wireless LAN connectivity; broadband Internet access
ZigBee |  20, 40 and 250 Kbits/s |  10-100 meters |  0.5 meters |  Ad-hoc; peer to peer star; mesh |  Low |  Very low |  Industrial control and monitoring; sensor networks; building automation; home control; automation, toys, games
UWB |  50-100Mb/s, $>$500Mb/s expected in future |  170 meters |  5 to 10 cm |  Point to point |  Medium |  Low |  Industrial control and monitoring; sensor networks; building automation; home control streaming video; home entertainment applications
|  |  |  |  |  |  |

##  VI Comparison with Other Short-range Wireless Technologies

The advantages of UWB can be observed by comparing it with commonly used
short-range wireless technologies. The specific comparisons are presented in
the Table.I. The advantages of UWB in terms of accuracy are evident. UWB
technology exhibits a remarkable capability to measure distance and location
with an impressive accuracy range of 5 to 10 cm. In contrast, wireless systems
such as Wi-Fi, Bluetooth, and others can only achieve accuracy at the level of
several meters.

Furthermore, UWB stands out with significantly lower power consumption
compared to Wi-Fi. However, it is worth noting that one tradeoff of UWB is its
limited compatibility and interaction capabilities with contemporary
smartphones and tablets, where Wi-Fi and Bluetooth-enabled devices excel.
Nevertheless, certain companies are proactively adopting UWB by developing
hybrid devices that integrate both UWB and either Wi-Fi or Bluetooth
technologies, aiming to combine the best features and advantages of each
technology.

##  VII Applications of UWB Technology

UWB technology is considered as one of the most promising radio technologies
due to its ultra-wide signal bandwidth, low transmit power consumption and
high data rate. Currently, IR-UWB technology is widely used in applications
related to precise ranging, positioning, and data transferring.

Indoor scenarios make UWB technology more competitive in positioning and
ranging. Compared to outdoor environments, indoor settings are more complex
due to the presence of numerous objects that cause signal reflections,
resulting in multipath and delay issues. Additionally, the indoor environment
often leads to non-line-of-sight (NLoS) propagation, where some signals cannot
directly propagate from the transmitter to the receiver in a line-of-sight
path, leading to inconsistent time delays at the receiver. UWB transmission
involves very short pulses, providing an advantage in the resolvability of
multipath components and can partially alleviate multipath interference.

In this section, some methods addressed to ranging and positioning are
introduced, and the advantages and weaknesses of UWB technology compared with
other technologies are analyzed.

###  VII-A UWB Ranging Techniques

(a)

(b)

Figure 8: Two types of two way ranging.

In distance measurement, the “Two Way Ranging” algorithm is proposed to
calculate the time of flight ($T_{f}$). By combining the signal’s velocity in
the environment, the distance between the target and the base station can be
accurately determined. Assuming that the device in tag processes information
for a time period $T_{p}$ and the base station experiences a time period
$T_{tot}$ from transmitting the signal to receiving the response signal, the
round-trip time between the localization tag and the base station can be
represented as

$\hat{T_{f}}=\frac{(T_{tot}-T_{p})}{2}.$ (2)

The distance between the tag and the base station, denoted as D, is calculated
as $D=v\times T_{f}$, where $v$ represents the speed of electromagnetic wave
propagation in the air. Getting a TOF with high precision requires strict
synchronization between the transmitter and receiver (located within the base
station) and often necessitates the transmission of timestamps along with the
signals (depending on the underlying communication protocol)[18].

In the process of measuring the Time of Flight ranging using this method, the
biggest advantage is that both time differences ($T_{tot},T_{P}$) are
calculated based on the local clock. That means, the local clock errors can be
compensated for, but there may be slight clock frequency drift between
different devices. Assuming that the frequency drift for the base station and
the target are denoted as $e_{A}$ and $e_{B}$, respectively. Consequently, the
measuring error of $T$ will increase with the increase of $T_{p}$. The
equation for the ranging error can be expressed as follows[19]:

$e=\hat{T_{f}}-T_{f}=\frac{(e_{A}-e_{B})\times T_{p}}{2}+e_{A}\times T_{f}.$
(3)

Furthermore, some additional improvements can be made to the computation of
$T_{f}$ to further reduce errors. For instance, the previously mentioned
approach can be modified by adopting a method called Double-sided Two-way
Ranging (DS-TWR). This method mitigates the effect of clock drift by
leveraging an additional message transmitted from the anchor to the tag again,
as depicted in Fig.8b. By mathematically simplifying the process, we can
derive the following computation results:[19]

$T_{f}=\frac{T_{tot1}\times T_{tot2}-T_{p1}\times
T_{tot2}}{T_{tot1}+T_{tot2}+T_{p1}+T_{p2}}$ (4)

The error is determined by one of the following two factors, depending on
which side has a smaller clock drift:[19]

$T_{f}=e_{A}\times T_{f}\qquad T_{f}=e_{B}\times T_{f}$ (5)

By comparison, both conventional TWR and the proposed alternative method (DS-
TWR) aim to reduce errors caused by clock drift. However, the advantage of the
latter is that the error only relies on the clock drift of a single device. If
one device has a significantly better time reference compared to the other, it
will enhance performance[19].

The key factors influencing TWR accuracy are signal bandwidth and sampling
rate. Low sampling rates (in the time domain) decrease the TWR resolution as
the signal may arrive between sampling intervals. Frequency-domain super-
resolution techniques are commonly used to achieve high-resolution TWR from
the channel frequency response. In indoor environments with multipath, larger
bandwidth leads to higher TWR estimation resolution. Although larger bandwidth
and super-resolution techniques can enhance TWR performance, they cannot
eliminate significant positioning errors when there is no direct line of sight
between the transmitter and receiver. This is because obstacles cause signal
deviation, resulting in longer signal paths and increased signal flight
time[18].

Therefore, when addressing non-line-of-sight issues, utilizing machine
learning to distinguish line-of-sight signals and correcting errors to enhance
ranging accuracy can be of some progress. For instance, employing machine
learning in conjunction with Multiple-Input Multiple-Output (MIMO) systems
enables optimization of the signal transmission process. Reinforcement
learning algorithms can adjust antenna directions and power weights to achieve
improved transmission performance[20]. Besides, leveraging machine learning
models to analyze and exploit the multipath propagation characteristics of
signals in non-line-of-sight transmission can further enhance performance. In
scenarios where signals may be subject to interference and damage during non-
line-of-sight transmission, machine learning algorithms can aid in data
recovery and error correction. By learning signal patterns and features, these
algorithms aim to restore and repair the damaged data as accurately as
possible.

###  VII-B UWB-based Positioning Techniques

When applicating UWB in positioning and ranging, geometric-based methods
including Time of Arrivals(TOA) positioning, Time Difference of Arrival (TDOA)
(positioning, Angle of Arrival (AOA) positioning, and Two-Way Ranging (TWR)
positioning are widely used to achieve the goal. In practice, people also
combine multiple geometric algorithms for localization, enhancing both
accuracy and interference resistance[20]. However, this comes at the expense
of increased equipment costs. Next, the principles of several fundamental
algorithms will be introduced[21, 22, 20].

####  VII-B1 TOA

The TOA algorithm utilizes the time information of the signals received by the
base stations to perform calculations. For two-dimensional(2-D) positioning,
this algorithm requires a minimum of three coordinated base stations for its
application. By utilizing three sets of arrival times, we can calculate the
distances between the target and the three base stations, enabling determine
the target’s location, as Fig.9 illustrates. This method necessitates strict
synchronization of the clocks between the target and the three base stations
because the UWB technology used in this approach employs narrow pulse signals
that can achieve sub-nanosecond accuracy. Even a clock drift of 1 nanosecond
can result in a coordinate error exceeding 30 centimeters (assuming signal
propagation at the speed of light in the environment)[18].

####  VII-B2 TDOA

The TODA algorithm reduces the requirements for clock synchronization by only
necessitating time synchronization among base stations, without any specific
requirements for the target. The working principle of it is to calculate the
time difference for the arrival of signals from base stations to the target.
And using this time difference to determine the difference in distances. As
Fig.10 shows, by considering any two base stations, a set of possible
trajectories (hyperbolic curves) where the target may be located can be
derived. Furthermore, by identifying the intersection points of these
hyperbolic curves, the position of the target can be estimated[23].

Figure 9: TOA based positioning. Figure 10: TDOA based positioning.

####  VII-B3 AOA

The AOA algorithm is based on methodologies that leverage antenna arrays
integrated into the receiver to ascertain the angle at which the transmitted
signal intersects with the receiver. This estimation is accomplished by
exploiting and computing the time difference of arrival at individual elements
of the antenna array. One notable advantage of AOA is its capability to
estimate the location of a device or user using a minimal number of monitors,
namely two in a 2-D environment or three in a 3-D environment, respectively.
Despite its potential for accurate estimation when the transmitter-receiver
distance is short, AoA necessitates intricate hardware and meticulous
calibration in comparison to Received Signal Strength (RSS) techniques[24].
Additionally, its accuracy diminishes as the distance between the transmitter
and receiver increases, whereby even a slight error in the angle of arrival
calculation results in a substantial deviation in the actual location
estimation.

$\left\\{\begin{aligned} \tan\theta_{1}&=&\frac{y-y_{1}}{x-x1}\\\
\tan\theta_{2}&=&\frac{y-y_{2}}{x-x2}\end{aligned}\right.$ (6)

Assuming the positions of the two base stations are
$(x_{1},y_{1}),(x_{2},y_{2})$, respectively. $\theta_{1}$, $\theta_{2}$ are
the Angle at which the tag signal arrives at the base station. If there is a
geometric relationship, the following equations can be obtained.

##  VIII From UWB to Terahertz Technology

The UWB technology can be traced back to the 1960 and the research on UWB
technology has gradually matured. With an extremely wide spectrum
characteristic, UWB communication allows data transmission across a wide range
of frequency bands. Consequently, it could realize an extremely high
transmission rate. However, since the frequency of UWB communication is
limited to the range of 3.1GHz to 10.6GHz, and the bandwidth is also limited
to the order of gigahertz, the transmission rate and development of UWB
communication are subject to certain limitations.

Currently, the fifth-generation (5G) wireless network has been deployed in
certain regions around the world, and it is expected to be fully used
worldwide after a few years. However, although the 5G communication systems
have offered significant improvements over the existing systems, they will not
be able to fulfill the demands of future emerging intelligent and automation
systems after ten years [25, 26]. Additionally, the capacity of 5G is
anticipated to reach its limit by 2030 [27, 28]. As a result, the terahertz
frequency band, which possesses wide bandwidth resources, has become a new
research hotspot in global communication research and is recognized as the key
component of future 6G wireless communication systems [29, 30]. Ultra-wideband
terahertz communication (UWB-THz communication) is possible to realize the
extremely high transmission rate by providing extremely wide bandwidth,
reaching several hundred Gbps or even few Tbps. So this technology can meet
the data rate requirements of future wireless local area network (WLAN) and
wireless personal area network (WPAN) systems [31, 32], having great potential
and development value.

###  VIII-A Characteristics of Ultra-wideband Terahertz

As shown in Fig.11, the terahertz band is situated between two well-developed
spectra: the electronic spectrum and the photonic spectrum. And its frequency
is from 0.1 THz to 10 THz, while its wavelength is from 30 micrometers to 3
millimeters. Due to the lack of efficient terahertz sources and detection
techniques in the past, and people were unable to produce efficient
transceivers and antennas at terahertz frequencies, there is limited knowledge
and use of this frequency band. Therefore the band used to be called “THz
Gap”. However, in the past decade, the rapid development of laser technology
has provided stable and reliable excitation sources for generating terahertz
waves. Additionally, research on terahertz wave detection techniques and their
applications has been vigorously developed [33], leading to continuous
advancements in the research and application of the terahertz band.

Figure 11: Electromagnetic spectrum[34].

With an extremely wide bandwidth range, the frequency bandwidth of UWB-THz
communication can cover a range from several GHz to several THz, which is much
wider than traditional UWB communication. So UWB-THz communication can support
data transmission rates of several hundred Gbps or even several Tbps, which is
much faster than that of microwave communication and traditional UWB
communication. And it will have strong anti-interference ability.

Considering traditional IR-UWB communication has the characteristics of strong
anti-interference ability, strong confidentiality ability, high multipath
resolution, and high transmission rates for its pulse width is very short,
while the time of Terahertz pulse can reach the picosecond lever, which is
shorter than the traditional UWB pulse, so the IR-UWB-THz communication has
stronger anti-interference ability, stronger confidentiality ability, higher
time resolution and higer multipath resolution.

In addition to the advantages of UWB communication, UWB-THZ communication also
possesses some unique characteristics due to the unique characteristics of the
terahertz band.

  * •

Due to the wide frequency range of the terahertz band, and the fact that a
large portion of it remains unallocated, UWB-THz communication benefits from
abundant band resources. And the use of the terahertz band for communication
can also effectively alleviate the increasingly tense spectrum resources and
the capacity constraints of current wireless systems.

  * •

Because of the higher frequency and shorter wavelength of terahertz, UWB-THz
communication have better directionality and are less susceptible to free-
space diffraction than microwave and millimeter wave.

  * •

Due to the shorter wavelength of terahertz waves, antennas can be made in
small, and other system structures can be made simpler and more economical
while achieving the same functionality.

  * •

Terahertz photon energy is lower than that of optical communication, about
1/40th of the photon energy, therefore, UWB-THz communication is more energy
efficient than optical communication.

  * •

Due to the free space loss and molecular absorption phenomenon in the wireless
space transmission process, UWB-THz communication can only be received at
close range, making them more secure.

  * •

Terahertz waves have good penetrability to many dielectric materials and non-
polar substances, and UWB-THz communication has a good ability to penetrate
sand, dust and smoke, so it can carry out normal communication work in harsh
environments with heavy dust and smoke.

###  VIII-B Challenges and Solutions

####  VIII-B1 Challenges

Despite the abundant band resources and high transmission rates, UWB-THz
communication faces several challenges due to the limitations of the terahertz
band:

Free space loss: Compared to the microwave band, the terahertz band has a
higher frequency and shorter wavelength, leading to greater free space loss
during wireless transmission, which not only restricts the transmission
distance of terahertz communication, but also reduces the signal-noise ratio
(SNR) of the system, thus affecting data capacity.

Molecular absorption: As most of the polar molecules’ and organic molecules
vibration and rotation energy level spacing are located in the terahertz band,
especially water vapor in the air, in the terahertz band will show strong
absorption and resonance phenomenon, the so-called molecular absorption, which
will not only degrade the received power, but it can also intensify the
noise[35], greatly limiting the transmission distance of UWB-THz
communication.

####  VIII-B2 Solutions

Due to the prominent effects of free space loss and molecular absorption in
the wireless space transmission process, the communication distance is
limited. As a result, researchers in various countries have tried to take
several measures to address this challenge.

High gain antenna: The problem of larger path loss in the terahertz band can
be solved by effective antenna technology and power control. Antenna
technology is an important support in wireless communication to improve signal
quality, reduce interference, generate diversity and reduce transmit power,
which can concentrate the transmit power in the desired direction and can
enhance the received signal-to-noise ratio of the receiver. Although higher
transmission power can be achieved through power amplifiers, terahertz power
amplifiers generally require significant direct current power consumption.
Therefore, from the perspectives of energy efficiency and performance
enhancement, adopting efficient antenna technology is more suitable for
terahertz wireless communication systems. And due to the extremely high
frequency and extremely short wavelength of terahertz waves, it is possible to
deploy multiple antennas in the same physical area. Moreover, the deployment
of high gain antennas in terahertz communication can further enhance the
ability to combat high path loss[36].

Figure 12: THz communications assisted by IRS[37].

Intelligent reflecting surfaces(IRS): As shown in Fig.12, an IRS consisting of
a large number of reconfigurable passive elements can be applied to change the
propagation direction and enhance the signal strength by adjusting the phase
or amplitude of the IRS elements, thereby improving the coverage of the THz
signals[38].

Fiber-THz-fiber communication system: In view of the inflexibility and high
price of the optical fiber communication system, UWB-THz communication can
become an attractive complementary technology to the optical fiber
connections[39, 40]. As shown in Fig.13, the ultrahigh-speed fiber-THz-fiber
communication system based on the photonic upconversion and hybrid
optoelectronic down-conversion techniques can enable the collaborative work
between terahertz and fiber optic communications [41], which can not only
expand the coverage and application scenarios of UWB-THz communication, but
also enhance the flexibility of optical fiber communication.

Figure 13: Fiber-THz-Fiber seamlessly communication system[41].

##  IX Conclusion

UWB technology is a promising wireless communication solution that boasts
distinctive features and vast potential for diverse applications. By
generating and transmitting radio-frequency energy across an extensive
frequency range, UWB achieves high data rates and precise ranging and
positioning capabilities, making it suitable for indoor positioning,
communication systems, that’s sort of things.

Looking ahead, the demand for greater frequency bandwidth is undeniably set to
increase as we venture into higher and broader frequency bands to support
faster data transmission and accommodate a wide array of applications.
Alongside the progress in wireless communication technology and the relentless
pursuit of improved communication performance, the integration of UWB
technology has also given rise to Terahertz communication in various fields.
However, this upward trend presents its own set of obstacles, such as signal
attenuation and reduced penetration capabilities in higher frequency ranges,
as well as challenges associated with limited coverage areas. Overcoming these
hurdles will necessitate relentless technological innovation.

Overall, UWB, as an exemplary communication technology, offers a plethora of
advantages with its wide bandwidth, and its continuous evolution through
synergizing with other technologies promises to unlock new value in the
future.

## References

  * [1] Q. Tian, I. Kevin, K. Wang, and Z. Salcic, “A low-cost INS and UWB fusion pedestrian tracking system,” _IEEE Sensors Journal_ , vol. 19, no. 10, pp. 3733–3740, 2019.
  * [2] S. M.-S. Sadough, “A tutorial on ultra wideband modulation and detection schemes,” _Shahid Beheshti Univ. Fac. Electr. Comput. Eng, Tehran, IR Iran, no. April_ , pp. 1–22, 2009.
  * [3] D. C. Nguyen, M. Ding, P. N. Pathirana, A. Seneviratne, J. Li, D. Niyato, O. Dobre, and H. V. Poor, “6G internet of things: A comprehensive survey,” _IEEE Internet of Things Journal_ , vol. 9, no. 1, pp. 359–383, 2021.
  * [4] W. Saad, M. Bennis, and M. Chen, “A vision of 6G wireless systems: Applications, trends, technologies, and open research problems,” _IEEE network_ , vol. 34, no. 3, pp. 134–142, 2019.
  * [5] A. Subbarao and S. Raghavan, “A novel ultra-wideband planar antenna with rejection of WLAN and ITU bands,” _The Applied Computational Electromagnetics Society Journal (ACES)_ , pp. 821–828, 2013.
  * [6] R. J. Fontana, “Recent system applications of short-pulse ultra-wideband (UWB) technology,” _IEEE Transactions on microwave theory and techniques_ , vol. 52, no. 9, pp. 2087–2104, 2004.
  * [7] Z. Zaichen and B. Guangguo, “On the analysis of UWB key technologies and development strategy,” _Journal of EEE_ , vol. 6, pp. 6–10, 2004.
  * [8] Z. Sahinoglu, S. Gezici, and I. Guvenc, “Ultra-wideband positioning systems,” _Cambridge, New York_ , 2008.
  * [9] B. Pattan, “A brief exposure to ultra-wideband signaling.” _Microwave Journal_ , vol. 46, no. 12, 2003.
  * [10] B. Jajodia, R. A. Shaik, and A. Mahanta, “PPM demodulation schemes for IEEE 802.15. 6 IR-UWB WBAN receivers,” in _2015 IEEE International Conference on Signal Processing, Informatics, Communication and Energy Systems (SPICES)_. IEEE, 2015, pp. 1–5.
  * [11] Y. Ying, M. Ghogho, and A. Swami, “A new non-coherent demodulation scheme for IR-UWB,” in _2007 IEEE 8th Workshop on Signal Processing Advances in Wireless Communications_. IEEE, 2007, pp. 1–5.
  * [12] Y. Zhu, _Ultra-wideband pulse generation, detection and filtering using distributed architectures and circuit techniques_. University of Rochester, 2008.
  * [13] X. Chen, M. Fu, Z. Liu, C. Jia, and Y. Liu, “Harris hawks optimization algorithm and bp neural network for ultra-wideband indoor positioning,” _Mathematical Biosciences and Engineering_ , vol. 19, no. 9, pp. 9098–9124, 2022.
  * [14] Z. Zhao, Z. Lou, R. Wang, Q. Li, and X. Xu, “I-WKNN: Fast-speed and high-accuracy WIFI positioning for intelligent sports stadiums,” _Computers & Electrical Engineering_, vol. 98, p. 107619, 2022.
  * [15] R. Wang, M. A. Kishk, and M.-S. Alouini, “Evaluating the accuracy of stochastic geometry based models for LEO satellite networks analysis,” _IEEE Communications Letters_ , vol. 26, no. 10, pp. 2440–2444, 2022.
  * [16] A. Alarifi, A. Al-Salman, M. Alsaleh, A. Alnafessah, S. Al-Hadhrami, M. A. Al-Ammar, and H. S. Al-Khalifa, “Ultra wideband indoor positioning technologies: Analysis and recent advances,” _Sensors_ , vol. 16, no. 5, p. 707, 2016.
  * [17] M. V. N. Katare, “Comparative analysis and interpretation of various short-range wireless technologies,” _International Journal of Scientific & Engineering Research_, vol. 3, no. 8, pp. 775–779, 2012.
  * [18] M. Qian, K. Zhao, B. Li, and A. Seneviratne, “An overview of ultra-wideband technology and performance analysis of uwb-twr in simulation and real environment,” in _CEUR Workshop Proceedings_ , vol. 3248, 2022, p. 2022.
  * [19] D. Neirynck, E. Luk, and M. McLaughlin, “An alternative double-sided two-way ranging method,” in _2016 13th workshop on positioning, navigation and communications (WPNC)_. IEEE, 2016, pp. 1–4.
  * [20] H. Chen, H. Sarieddeen, T. Ballal, H. Wymeersch, M.-S. Alouini, and T. Y. Al-Naffouri, “A tutorial on terahertz-band localization for 6G communication systems,” _IEEE Communications Surveys & Tutorials_, vol. 24, no. 3, pp. 1780–1815, 2022.
  * [21] F. Zafari, A. Gkelias, and K. K. Leung, “A survey of indoor localization systems and technologies,” _IEEE Communications Surveys & Tutorials_, vol. 21, no. 3, pp. 2568–2599, 2019.
  * [22] Z. Xiao and Y. Zeng, “An overview on integrated localization and communication towards 6g,” _Science China Information Sciences_ , vol. 65, pp. 1–46, 2022\.
  * [23] Y. Wu, W. Wang, H. Xu, and H. Kang, “Research on indoor sports positioning algorithm based on uwb,” in _2021 International Conference on Control, Automation and Information Sciences (ICCAIS)_. IEEE, 2021, pp. 638–643.
  * [24] P. Loahavilai, C. Thanapirom, P. Rattanawan, T. Chulapakorn, S. Yanwicharaporn, C. Kingkan, K. Prasertsuk, and N. Cota, “Rapid deployment of ultra-wideband indoor positioning system,” in _2021 18th International Joint Conference on Computer Science and Software Engineering (JCSSE)_. IEEE, 2021, pp. 1–6.
  * [25] R. Wang, M. A. Kishk, and M.-S. Alouini, “Resident population density-inspired deployment of K-tier aerial cellular network,” _IEEE Transactions on Wireless Communications_ , 2023.
  * [26] ——, “Ultra-dense LEO satellite-based communication systems: A novel modeling technique,” _IEEE Communications Magazine_ , vol. 60, no. 4, pp. 25–31, 2022.
  * [27] Q. Huang, B. E. Y. Belmekki, A. M. Eltawil, and M.-S. Alouini, “System-level metrics for non-terrestrial networks under stochastic geometry framework,” _arXiv preprint arXiv:2302.03376_ , 2023.
  * [28] R. Wang, M. A. Kishk, and M.-S. Alouini, “Stochastic geometry-based low latency routing in massive LEO satellite networks,” _IEEE Transactions on Aerospace and Electronic Systems_ , vol. 58, no. 5, pp. 3881–3894, 2022.
  * [29] Z. Lou, B. E. Y. Belmekki, and M.-S. Alouini, “Coverage analysis of hybrid RF/THz networks with best relay selection,” _IEEE Communications Letters_ , 2023.
  * [30] R. Wang, M. A. Kishk, and M.-S. Alouini, “Reliability analysis of multi-hop routing in multi-tier LEO satellite networks,” _arXiv preprint arXiv:2303.02286_ , 2023.
  * [31] Z. Chen, X. Ma, B. Zhang, Y. Zhang, Z. Niu, N. Kuang, W. Chen, L. Li, and S. Li, “A survey on terahertz communications,” _China Communications_ , vol. 16, no. 2, pp. 1–35, 2019.
  * [32] R. Wang, A. Talgat, M. A. Kishk, and M.-S. Alouini, “Conditional contact angle distribution in LEO satellite-relayed transmission,” _IEEE Communications Letters_ , vol. 26, no. 11, pp. 2735–2739, 2022.
  * [33] K. Suto and J.-I. Nishizawa, “Developments of terahertz wave generation technologies,” in _Micro-and Nanoelectronics 2003_ , vol. 5401. SPIE, 2004, pp. 311–317.
  * [34] I. F. Akyildiz, A. Kak, and S. Nie, “6G and beyond: The future of wireless communications systems,” _IEEE access_ , vol. 8, pp. 133 995–134 030, 2020\.
  * [35] Z. Lou, A. Elzanaty, and M.-S. Alouini, “Green tethered UAVs for EMF-aware cellular networks,” _IEEE Transactions on Green Communications and Networking_ , vol. 5, no. 4, pp. 1697–1711, 2021.
  * [36] S. Xie, L. LI HR _et al._ , “Survey of terahertz communication technology,” _Journal on Communications_ , vol. 41, no. 5, pp. 168–186, 2020\.
  * [37] H. Sarieddeen, M.-S. Alouini, and T. Y. Al-Naffouri, “An overview of signal processing techniques for terahertz communications,” _Proceedings of the IEEE_ , vol. 109, no. 10, pp. 1628–1665, 2021.
  * [38] W. Hao, F. Zhou, M. Zeng, O. A. Dobre, and N. Al-Dhahir, “Ultra wideband THz IRS communications: Applications, challenges, key techniques, and research opportunities,” _IEEE Network_ , vol. 36, no. 6, pp. 214–220, 2022.
  * [39] H.-J. Song and T. Nagatsuma, “Present and future of terahertz communications,” _IEEE transactions on terahertz science and technology_ , vol. 1, no. 1, pp. 256–263, 2011.
  * [40] Q. Huang, W. Alkhayer, M. E. Fouda, A. Celik, and A. M. Eltawil, “Wearable vital signal monitoring prototype based on capacitive body channel communication,” in _2022 IEEE-EMBS International Conference on Wearable and Implantable Body Sensor Networks (BSN)_. IEEE, 2022, pp. 1–5.
  * [41] M. Zhu, J. Zhang, B. Hua, M. Lei, Y. Cai, L. Tian, D. Wang, W. Xu, C. Zhang, Y. Huang _et al._ , “Ultra-wideband fiber-THz-fiber seamless integration communication system toward 6G: architecture, key techniques, and testbed implementation,” _Science China Information Sciences_ , vol. 66, no. 1, p. 113301, 2023.