How to Inspect Ultra-Wideband (UWB) Ranging Sessions on Android Using ADB dumpsys uwb

Modern flagship Android devices feature dedicated Ultra-Wideband (UWB) radio hardware designed for high-precision centimetre-level spatial positioning, digital car key unlocking, secure peer-to-peer device targeting, and indoor radar sensing. Android manages these radio transactions through the platform uwb system service, implementing specifications governed by the Fine Ranging (FiRa) Consortium and the Car Connectivity Consortium (CCC). When debugging digital vehicle key handshakes, Quick Share spatial awareness, or bespoke spatial positioning applications, engineers can inspect internal transceiver states, active ranging sessions, and cryptographic configurations using Android Debug Bridge (ADB). This article explains how to inspect UWB hardware state, channel parameters, and live ranging sessions using adb shell dumpsys uwb.

Understanding Android Ultra-Wideband Architecture and System Services

Unlike conventional Bluetooth Low Energy (BLE) or Wi-Fi Round Trip Time (RTT), Ultra-Wideband transmits nanosecond radio pulses across wide radio spectrum channels (typically 500 MHz wide on Channels 5, 8, or 9). This enables the hardware to compute Time of Flight (ToF) and Angle of Arrival (AoA) with high spatial accuracy, resilient against multi-path reflections and relay attacks.

The Android operating system integrates UWB via the com.android.server.uwb system service, interfacing with vendor hardware abstraction layers (HALs) manufactured by suppliers such as NXP and Qorvo. The service regulates:

• Hardware Power and Adapter States: Governing radio state across airplane mode, battery saver restrictions, and country code regulatory policies (since UWB transmissions are legally restricted in certain international jurisdictions).
• Ranging Sessions: Managing concurrent multi-client sessions initiated by system applications or third-party apps holding the UWB_RANGING permission.
• Cryptographic Security: Enforcing Scrambled Timestamp Sequence (STS) modes—including Static, Dynamic, and Provisioned STS—to prevent distance-spoofing and relay attacks during digital car key exchanges.
• Radar and Spatial Sensing: Managing raw pulse reflections for gesture detection and presence tracking where supported by hardware.

Connecting to ADB and Querying dumpsys uwb

To inspect UWB subsystems, connect your Android device to a computer via USB or wireless debugging, verify connectivity with adb devices, and execute the basic service dump:

adb shell dumpsys uwb

To capture the output cleanly for diagnostic analysis or filter specific operational sections, execute:

adb shell dumpsys uwb > uwb_diagnostics.txt

If your device does not have physical UWB hardware or the kernel driver is uninitialised, the service returns Service uwb does not exist or reports an uninitialised adapter state.

Inspecting UWB Adapter State and Regulatory Restrictions

At the top of the dumpsys uwb telemetry, examine the global adapter state and regulatory configuration:

adb shell dumpsys uwb | grep -A 15 "UwbInjector:"

Key adapter status indicators include:

• mAdapterState: Reports whether the radio is STATE_ENABLED_INACTIVE (powered on and ready), STATE_ENABLED_ACTIVE (actively transmitting ranging pulses), or STATE_DISABLED.
• mCountryCode: Displays the ISO two-letter country code applied by telephony basebands or Wi-Fi beacons (e.g. GB, US, DE). Because UWB spectrum allocations vary globally, entering an unsupported regulatory zone causes the service to disable the transceiver automatically.
• mIsRestricted: Indicates whether administrative enterprise policies or user restrictions have locked down spatial radio hardware.

To inspect supported UWB profiles and chip capabilities, check the specification flags:

adb shell dumpsys uwb | grep -i "capability"

This displays whether the underlying chipset supports FiRa 1.0/2.0 specifications, CCC Digital Key 3.0, AoA azimuth and elevation calculation, and radar functionality.

Analysing Active and Historical Ranging Sessions

The core of dumpsys uwb detailing application activity is the session tracking table. To view currently active and recently terminated ranging sessions, run:

adb shell dumpsys uwb | grep -A 25 "UwbSessionNotificationManager"

A representative session dump displays configuration parameters structured as follows:

SessionId: 1048576, Uid: 10214, Package: com.google.android.gms
  SessionType: FIRA_RANGING_SESSION
  DeviceType: CONTROLLER, DeviceRole: INITIATOR
  Channel: 9, PreambleCodeIndex: 10, SlotDurationRstu: 2400
  RangingIntervalMs: 200
  MacAddressMode: 2_BYTE, DestAddress: [1A:2B]
  StsMode: DYNAMIC_STS
  MultiNodeMode: ONE_TO_MANY

Reviewing these parameters clarifies how the connection operates:

• SessionId and Uid: Uniquely identifies the session and binds it to the calling application process (e.g. Google Play Services for Fast Pair or Quick Share).
• DeviceType and DeviceRole: Confirms whether the phone acts as the CONTROLLER (orchestrating slot scheduling and timing) or CONTROLEE, and whether it acts as the transmission INITIATOR or RESPONDER.
• Channel: Identifies the operational RF channel. Channel 5 (6.489 GHz) and Channel 9 (7.987 GHz) are the most common international allocations.
• StsMode: Verifies cryptographic protection. A value of DYNAMIC_STS or PROVISIONED_STS confirms that timestamps are cryptographically randomised to prevent replay attacks during vehicle unlocking.
• RangingIntervalMs: The frequency of positioning frames (e.g. 200 ms for active navigation, or 1000 ms for passive background proximity).

Inspecting Ranging Measurements and Angle of Arrival (AoA)

Within active sessions, the dump outputs the most recent measurement data processed by the UWB subsystem:

adb shell dumpsys uwb | grep -A 12 "Latest Ranging Result"

Examine the calculated spatial telemetry:

• distance_cm: The computed line-of-sight distance in centimetres between the Android device and the target responder.
• aoa_azimuth_deg: The horizontal angle of arrival relative to the device’s front plane (-90° to +90°).
• aoa_elevation_deg: The vertical angle of arrival, indicating whether the target node is positioned above or below the phone.
• los (Line of Sight): A binary or probability flag indicating whether the direct radio path is unobstructed or subject to non-line-of-sight (NLoS) attenuation.
• fom (Figure of Merit): An indicator of measurement confidence and signal quality (ranging from 0 to 100). Low FoM values indicate high multi-path noise or physical RF interference.

Monitoring Live UWB State Transitions in Real Time

To observe dynamic session creation, ranging pulses, and transceiver sleep cycles while initiating a digital key or file transfer action, filter logcat output alongside the service dump:

adb logcat -s UwbSessionManager:V UwbService:V UwbAdaptation:V

Combining live logcat traces with periodic snapshots from adb shell dumpsys uwb provides complete visibility into Android UWB hardware orchestration, ensuring robust spatial tracking and secure automotive communications.