UltraWideLock v0.4.0
UWB · NFC · Matter

UltraWideLock

Walk up. It Unlocks.

Get started Read the guides Open the digital twin
DS-TWR round live measurement drag the phone · or use the slider
A double-sided two-way ranging round A lock on the left and a phone on a distance scale, with the three ranging messages below: poll from the lock, response from the phone, and final from the lock. The measured distance, its tick count and the unlock decision are given as text beneath the diagram. 0 1 2 3 m unlock bound · 1.00 m lock phone 0.82 m poll response final
measured 0.82m ticks 154 time of flight 2.73ns unlock

One timestamp tick is 15.65 ps, which light crosses in 4.692 mm. The bound is ULTRAWIDELOCK_UNLOCK_RANGE_CM. A relay can add delay and nothing else, which is why arming one moves the measurement away from the door rather than toward it.

4.692 mmper ranging tick
7,524host tests, no hardware
0cloud dependencies
01

Install

A C compiler and python3 run the whole host suite. Nothing phones home.

shellno hardware
git clone https://github.com/ultrawidelock/ultrawidelock.git
cd ultrawidelock
make check                  # 7 suites, about 2 minutes

With a Qorvo DWM3001CDK plugged in, five commands take you from clone to a lock on the bench:

shellDWM3001CDK
make dfu-key                # once per clone   · image-signing key
make bootstrap              # once per machine · NCS v3.3.0
make build                  # -> build/cdk-matter
make flash                  # over the on-board J-Link
make monitor                # console, over RTT

No board on hand? The web flasher writes a prebuilt ESP32 image over WebSerial, straight from the browser.

02

How a door opens

Five steps, in the order they happen. The bolt moves on the last one.

  1. 1BLE the phone finds the credential service 0xFFF2
  2. 2auth AUTH0, AUTH1, EXCHANGE — both ends now hold the URSK
  3. 3UWB key ladder to STS, then the DS-TWR round above
  4. 4gate range consistency agrees, and the bolt moves
  5. 5Matter lock state over Thread, into Apple Home
note

Local only. No app, no account, no cloud round trip. The credential is verified on the lock itself, so there is no remote verifier to compromise.

03

All of it on one nRF52833

512 KB of flash and 128 KB of RAM carry the reader, the DW3110 radio, an OpenThread MTD and a hand-written Matter node at the same time. The Matter node is written by hand rather than built on CHIP, which is what makes it fit.

  • readerAUTH0 / AUTH1 / EXCHANGE, key ladder, STS, DS-TWR
  • matterhand-written node, not CHIP
  • threadOpenThread MTD, joins a real network
  • classifierline-of-sight vs obstructed, 776 B of flash
Flash 91.63% 397,360 / 433,664 B
RAM 92.12% 120,740 / 131,072 B

Both bars are amber because both are tight. That is the point of the number, not a warning about it.

ToolchainNCS v3.3.0, Zephyr 4.3.99
SigningECDSA-P256, verified by MCUboot
warn

Repository defaults are bench defaults. Keys and identities in the tree are for development. Do not secure valuables with it.

04

Is the door in the way?

Distance alone cannot tell a phone in your hand from a phone through a wall. Both can measure one metre. What separates them is the shape of the arrival: a direct path lands as one sharp edge, while a path through a door arrives late, spread and weaker.

A decision tree reads the DW3000's own receive diagnostics and answers, in 776 bytes of flash with no interpreter and no allocation.

Modeldepth-2 decision tree, generated by emlearn
Cost776 B flash, 0 B RAM, 28 B stack
Inputfive CIA registers plus the measured range
Gatethe host suite certifies the C matches the trained model
Two channel impulse responses compared A direct path arrives as a single narrow peak at the leading edge. An obstructed path arrives later, lower and spread across several samples, which is what the classifier reads. TIME → AMPLITUDE first path late, spread
What the CIA registers see. The mint trace is a hand holding a phone. The amber trace is the same one-metre reading measured through a door. The range agrees; the arrival does not.
05

Hardware targets

ApplicationHardwareConnectivity
dwm3001cdk-lockDWM3001CDK, nRF52833 + DW3110UWB, Matter over Thread
dwm3001cdk-lock-freertosthe same board, no ZephyrUWB, Matter over Thread
nrf5340dk-locknRF5340 DK, DWM3000EVB, NFC12A1UWB and NFC, Matter over Thread
esp32-matter-lockESP32-S3 / C5 / C6 with DWM3000EVBUWB, Matter over Wi-Fi
06

Try it without hardware

runs the firmware
Digital twin

The ranging stack itself, compiled to WASM and running in the page. Walk a phantom phone at the lock, add noise, spoof a relay, and single-step a real DS-TWR round.
WebSerial
Web flasher

Plug an ESP32-S3, C5 or C6 into USB and install a merged image from this page. No ESP-IDF, no command line. The page detects which chip you plugged in.

writing app partition62%
07

Specification

UWBDS-TWR under an STS session, channels 5 and 9
Resolutionone tick is about 15.65 ps, roughly 4.692 mm
BLEcredential service 0xFFF2, AUTH0 / AUTH1 / EXCHANGE
NFCECP, on the nRF5340 DK target
Matterhand-written node over Thread, or over Wi-Fi on ESP32
Updatessigned delta over BLE, applied from inside MCUboot
PortsZephyr, ESP-IDF, and a Zephyr-free FreeRTOS port
LicenseISC. The vendored Qorvo UWB driver is LicenseRef-QORVO-2
Read the source ISC license Port it to a board