"For fifteen years perception was a happy accident of channel equalization. The moment a committee gave it a name, a frame format, and a session-setup handshake, it stopped being a lab trick and started being a feature with a spec sheet, a threat model, and an off switch."
A Standards-Compliant AI Agent
Prerequisites
This section builds directly on the channel-state-information physics of Section 47.1: you should already know that a Wi-Fi receiver estimates a per-subcarrier complex channel \(H_k\) as a by-product of decoding, and that a moving body perturbs it. It leans on the sampling and Nyquist reasoning of Chapter 3, because the central design knob of a sensing standard is how often to measure the channel. No new mathematics is required beyond that. This section advances the measure verb: it is about the protocol that turns opportunistic CSI capture into a negotiated, interoperable measurement service, and about what that protocol does and does not solve. The activity, pose, vital-sign, and through-wall models that consume the measurements are the subject of Sections 47.2 through 47.4; the robustness and privacy consequences of making this ubiquitous arrive in Section 47.6 and Section 47.7.
Why an accident needs a standard
Everything in this chapter so far worked by abusing Wi-Fi. Researchers patched firmware, scraped proprietary CSI blobs off an Intel 5300, and prayed the next driver update would not break the byte layout. That is fine for a paper and hopeless for a product: two vendors' chips report incompatible CSI, a station cannot ask an access point to sense on its behalf, and there is no legal, documented way for a receiver to even expose the channel estimate. IEEE 802.11bf, the WLAN Sensing amendment developed by Task Group bf since 2020, closes that gap. It does not invent new physics and it does not add a sensing radio. It adds a procedure: a way for devices to negotiate a sensing session, agree on who transmits and who measures, schedule channel soundings at a chosen rate, and report the resulting CSI in a defined format, all on top of the existing 802.11ax/be radios below 7 GHz and the 802.11ad/ay radios at 60 GHz. This section explains that procedure, why each piece exists, the airtime it costs, and why a standard that finally makes RF sensing turnkey also makes its privacy and robustness problems everyone's problem at once.
What 802.11bf standardizes: a measurement service, not a modem
What the amendment defines is a set of frames and state machines that let compliant devices perform and share channel measurements for sensing. It deliberately reuses the physical layers already shipping. Below 7 GHz it borrows the sounding machinery of MIMO beamforming (the null-data-packet exchange that 802.11ac and 802.11ax already use to measure the channel for precoding) and repurposes the resulting estimate as a sensing product. At 60 GHz it reuses the directional beam-training of the DMG and EDMG modes from 802.11ad/ay, where the sensing signal is the beam-measurement sweep itself. Why reuse rather than invent: an amendment that required new silicon would never deploy, whereas one that adds firmware and a management-frame vocabulary can light up the installed base of a billion access points. The prize of standardization is threefold: interoperability (a phone from one vendor can sense against an access point from another), a defined measurement-exchange format (CSI you can parse without reverse-engineering), and explicit roles and consent points (a device must set up a session, which is exactly where policy and an off switch can live). Contrast this with the ranging story of Chapter 25, where 802.11mc/az standardized fine timing measurement for positioning; 802.11bf is the analogous move for perception, standardizing the exposure of the channel itself.
The standard turns a leaked diagnostic into a negotiated service
The single most important shift 802.11bf makes is architectural, not physical. Before it, CSI was a private internal quantity that a receiver happened to compute and that a hacker happened to extract. After it, CSI becomes a service with named participants, a setup handshake, a measurement schedule, and a teardown. That framing is why the standard matters even though it changes no wave equation: it creates the seam at which everything else in the chapter attaches. Interoperable products attach here. Regulation and consent (Section 47.7) attach at the session-setup frame, because a session is a thing that can be permissioned, logged, or refused. Cross-vendor benchmarks attach here, because a defined report format is what makes a leakage-safe cross-device evaluation (Chapter 5) even possible. Naming the accident is what industrializes it.
How a sensing session works: roles, setup, sounding, reporting
What the procedure looks like is a nested set of phases. It begins with roles. A sensing initiator starts and manages the measurement; a sensing responder participates. Orthogonally, a sensing transmitter emits the sounding signal and a sensing receiver measures the channel from it; a single station can play several roles. A crucial addition is sensing by proxy (SBP): a non-access-point station (a thermostat, a TV) that lacks the muscle to orchestrate sensing can request that the access point run the session on its behalf and hand back the results. Why the roles are factored this way is flexibility: the same vocabulary covers an access point sensing a room by itself, two access points sensing the bistatic link between them, and a battery-powered device outsourcing the work.
How the frames flow follows a clean lifecycle. (1) Sensing session setup establishes that two or more devices will sense and negotiates capabilities. (2) Measurement setup pins down the parameters: which band, sub-7 GHz or 60 GHz, the bandwidth, the antenna configuration, the measurement rate, and whether the CSI is reported in full or compressed. (3) One or more measurement instances then repeat on a schedule, each with a sounding phase in which the transmitter sends a null data packet (an NDP: a preamble with known training fields and no payload, so it is pure channel probe) and a reporting phase in which each receiver returns its CSI. Below 7 GHz the sounding can be trigger-based (the access point sends a trigger frame that solicits synchronized soundings from several responders at once, the same uplink-multiuser trick 802.11ax uses) or non-trigger-based. (4) Finally measurement-setup termination and session teardown close it down. The measurement rate chosen in step 2 is the design decision that governs everything, and it is a straight application of the Nyquist reasoning of Chapter 3: to see respiration near 0.3 Hz a few soundings per second suffice, but to catch the micro-Doppler of a fast gesture or a fall you need tens to a hundred per second, the same rate that lets the radar of Chapter 44 resolve motion.
def sensing_overhead(rate_hz, ndp_us=60, n_responders=3, feedback_us=200, trigger_us=30):
"""Fraction of channel airtime consumed by an 802.11bf sub-7 GHz sensing schedule.
One trigger-based measurement instance = trigger frame + NDP sounding
+ one CSI feedback per sensing receiver."""
per_instance_us = trigger_us + ndp_us + n_responders * feedback_us
busy_us_per_second = rate_hz * per_instance_us
return busy_us_per_second / 1e6 # 1.0 == fully saturated
for rate in (5, 30, 100): # breathing, gesture, fall-grade
frac = sensing_overhead(rate)
print(f"{rate:3d} Hz sensing -> {frac*100:5.1f}% of channel time")
Running the block prints roughly 0.3%, 2%, and 6% of channel time for 5, 30, and 100 Hz sensing with three receivers. That is the quiet tension the standard has to manage: the network's day job is carrying data, and every sounding is airtime stolen from throughput. The scheduling and rate-negotiation machinery exists precisely so a sensing application can buy exactly the temporal resolution it needs and no more, which is why the measurement rate is a negotiated parameter rather than a fixed constant.
Smart building: one mesh, many sensing tenants
A commercial-building integrator deploys a Wi-Fi 7 mesh across three floors for connectivity and wants to resell presence and fall detection to tenants without adding PIR sensors or cameras. Pre-802.11bf this was a research project per vendor. With the amendment, each ceiling access point acts as a sensing initiator and transmitter; neighboring access points act as sensing receivers, giving bistatic coverage of every corridor. A low-power occupancy panel in each suite uses sensing-by-proxy: it cannot sound the channel itself, so it asks the nearest access point to run a 5 Hz session and return coarse presence, which costs well under 1% of airtime by the model above. When a suite requests fall detection, the integrator raises just that access point's rate to 50 Hz during occupied hours, trading a few percent of throughput for the micro-Doppler resolution a fall needs. The point the standard makes possible: a single interoperable mesh serves multiple sensing tenants at different fidelities, each an explicit, revocable session rather than a firmware hack, and each billable because it is a defined service. The robustness catch, that a model tuned in one corridor may not transfer to the next, is exactly the subject of Section 47.6.
Two bands, two sensing physics under one amendment
What the amendment covers is deliberately two very different regimes, unified by the same session vocabulary. The sub-7 GHz mode (built on 802.11ax/be) delivers the CSI you met in Section 47.1: wide coverage, through-wall reach, but coarse native resolution because a 20 to 160 MHz channel resolves delay only to \(c/(2B)\), meters at best. Sensing here works by tracking change in the aggregate channel, not by imaging. The 60 GHz DMG/EDMG mode (built on 802.11ad/ay) is a different animal: with up to 2 GHz of bandwidth it approaches genuine radar-grade range resolution of centimeters, and its narrow steerable beams give angular selectivity, at the price of short range and no wall penetration. Why keep both under one amendment is that they serve complementary jobs, whole-home presence versus in-room high-fidelity gesture, and a device that speaks both can pick the right instrument. How the sounding differs reflects the physics: sub-7 GHz reuses NDP channel sounding, whereas 60 GHz sensing rides on the beam-refinement sweeps the directional PHY already performs, reading motion from how the beam pattern's measurements evolve. The 60 GHz path is, in effect, the FMCW-style resolution logic of Chapter 44 arriving inside a Wi-Fi standard.
Right tool: capture platforms and simulators, not a hand-rolled state machine
Implementing the 802.11bf session lifecycle, capability negotiation, trigger-based sounding, and CSI-feedback parsing from the raw draft is on the order of a few thousand lines of management-frame handling and per-vendor quirk-chasing, and it changes with every draft revision. In practice research and prototyping ride on existing tooling: capture-and-orchestration platforms in the PicoScenes lineage already expose NDP-style sounding and normalized CSI across AX210-class hardware, and network simulators such as ns-3 ship WLAN-sensing modules that model the measurement procedure and airtime so you can study scheduling and overhead without silicon. Using them collapses the protocol plumbing into configuration and hands you the same \([\text{time} \times \text{subcarrier} \times \text{antenna}]\) tensor your models already expect, so your effort goes into the perception model rather than into re-deriving a state machine the committee already wrote.
What the standard fixes, and what it leaves wide open
What 802.11bf genuinely solves is the plumbing: interoperable capability negotiation, a defined sounding-and-reporting exchange, sensing-by-proxy, dual-band coverage, and a session object that consent and security can hook into. Why that is transformative is that it removes the single largest barrier to shipping RF sensing, the absence of a legal, portable way to obtain CSI. What it pointedly does not solve is everything above the measurement layer. It standardizes how to obtain the channel, not how to interpret it: no reference model, no accuracy floor, no cross-environment generalization guarantee. A session negotiated flawlessly can still feed a classifier that collapses when the furniture moves, which is why the layout-and-environment robustness problem of Section 47.6 is untouched by the amendment. Nor does the standard resolve the deeper tension it creates: by making channel measurement a first-class, interoperable, always-available service, it turns every compliant access point into a potential motion sensor for anyone who can open a session, which is the consent and surveillance problem Section 47.7 confronts and which the responsible-deployment frameworks of Chapter 70 will have to govern. Standardization is a lever, not an answer; it makes the good and the dangerous equally easy.
Frontier: from a ratified procedure to sensing-native networks
As of this writing 802.11bf has moved through task-group drafting toward ratification in the mid-2020s, and the open work has shifted from "can we specify a sensing exchange" to "what do we do with a network that senses natively." Three threads are live. First, joint communication and sensing (JCAS): designing waveforms and schedules that carry data and probe the channel in the same transmission so sensing costs near-zero extra airtime, the sub-7 GHz cousin of the integrated-sensing-and-communication work in 6G. Second, learned encoders over standardized CSI: with a portable report format, the self-supervised and cross-modal pretraining of Chapter 17 can finally train on multi-vendor corpora rather than one lab's chip, chasing the cross-device foundation encoder that survives new hardware. Third, privacy-preserving sensing: on-device processing, session-level consent tokens, and differential-privacy or federated schemes (Chapter 64) that let a building sense occupancy without exporting a raw motion trace. The standard is the substrate; the frontier is the network that treats perception as a designed capability rather than an exploited accident.
Exercise: size the airtime budget for a real deployment
Extend the sensing_overhead model. (1) Plot channel occupancy versus sounding rate from 1 to 200 Hz for one, three, and eight sensing receivers, and mark the rate at which sensing consumes 10% of airtime in each case. (2) A respiration monitor needs to resolve breaths up to 0.5 Hz; using the Nyquist rule from Chapter 3, pick a defensible minimum sounding rate and report its airtime cost. (3) A fall detector needs micro-Doppler up to 20 Hz of body-part motion; repeat. (4) Argue in two sentences why the standard makes measurement rate a negotiated per-session parameter rather than fixing one rate for all sensing.
Self-check
1. 802.11bf adds no new radio and no new physics. What, precisely, does it add, and why is that enough to industrialize Wi-Fi sensing? 2. Name the four roles a station can play in a sensing measurement and explain what sensing-by-proxy lets a low-power device do. 3. The sub-7 GHz and 60 GHz modes live under one amendment but sense very differently; contrast their resolution and coverage, and say which you would pick for whole-home presence versus in-room gesture. 4. Give one important problem in RF sensing that ratifying 802.11bf does not solve, and name the section of this chapter that addresses it.
What's Next
In Section 47.6, we confront the gap the standard leaves open: a sensing session can be negotiated perfectly and still feed a model that falls apart when the sofa moves or the deployment crosses into a new room. Robustness across layouts and environments is the difference between a demo that works in the training apartment and a product that ships, and it is where the leakage-safe evaluation discipline of the whole book earns its keep.