Bluetooth Channel Sounding: Sub-Meter Ranging

Bluetooth Channel Sounding: Sub-Meter Ranging

Channel Sounding (CS), introduced in Bluetooth 6.0 (2024), enables two BLE devices to measure their physical separation with ±10–20 cm accuracy at typical indoor distances. Unlike RSSI-based proximity (±3–5 m accuracy) or AoA/AoD Advertising">direction finding, Channel Sounding uses time-of-flight (ToF) and phase-based ranging across multiple frequency hopping channels to defeat multipath.

Why Channel Sounding vs. RSSI

Channel Sounding eliminates the need for a separate UWB radio in cost-sensitive designs, making sub-meter ranging accessible in standard BLE SoCs.

Physical Layer Principles

Channel Sounding operates in two modes, often combined:

RTT (Round-Trip Time) — Measures the round-trip propagation delay of a tone sequence. Each frequency hop eliminates one multipath reflection scenario.

PBR (Phase-Based Ranging) — Measures the phase difference of a continuous wave tone across multiple frequencies. Phase rotation is proportional to distance: Δφ = 4πfd/c.

Combining RTT and PBR across 72+ frequency hopping channels (the full 2.4 GHz BLE band) statistically filters multipath to achieve sub-20 cm accuracy.

Initiator and Reflector Roles

Channel Sounding defines two roles:

The initiator-reflector assignment is independent of BLE Central/Peripheral roles. A phone (Central) is typically the Initiator; a digital key tag (Peripheral) is the Reflector.

Procedure Flow

Initiator                          Reflector
   |                                   |
   |-- LL CS Config Req -------------->|
   |<- LL CS Config Rsp --------------|
   |                                   |
   |-- CS Step (RTT tone at f1) ------>|
   |<- CS Step response (f1) ---------|
   |                                   |
   |-- CS Step (PBR tone at f2) ------>|
   |<- CS Step response (f2) ---------|
   |  ... (72 steps across channels)   |
   |                                   |
   |  [Initiator computes ToF + phase] |
   |  [Fuses results → distance]       |

A CS subevent contains 72 steps (configurable 2–160). Multiple subevents per connection event improve accuracy. The Bluetooth SIG specifies 15 dB minimum SNR for reliable sub-20 cm accuracy.

Security: Secure Ranging

Channel Sounding includes a mandatory security mode called Secure Ranging (CS Mode 3). It uses AES-CMAC-based random challenge-response to prevent relay attacks — critical for digital key applications where an adversary could relay CS tones from outside the vehicle to a phone inside.

CS_IV = AES-CMAC(CS_Key, Nonce_Initiator || Nonce_Reflector)
CS_Step_Timing = f(CS_IV, step_counter)  -- randomized per step

Without Secure Ranging, an attacker in the middle can delay responses to forge a false distance. Secure Ranging ensures the signal cannot be relayed faster than the speed of light.

Silicon Availability (2024–2025)

Use Cases

• Automotive digital keys (CCC Digital Key 3.0): Distance < 1 m unlocks, > 3 m locks
• Access control: Door unlocks only when authorized tag is on correct side of door (combined with direction finding)
• Inventory/retail: Shelf zone detection at ±20 cm resolution
• Wearable proximity: Child safety wearables with precise parent-child distance

Channel Sounding complements Auracast and BLE Mesh in the Bluetooth 6.0 feature set. Use the Range Calculator to compare RSSI, AoA, and CS accuracy profiles for your deployment.