Tag: defense

In January 2015, SpaceX publicly announced its plan to launch Starlink: a mega constellation of nearly 12,000 satellites in low-Earth orbit (LEO) to provide global broadband internet service. In May 2019, the first batch of 60 operational satellites were launched.

In October 2025, Starlink surpassed 10,000 satellites (see Figure 1). This remarkable achievement means that Starlink has more satellites than all other constellations have ever launched into LEO combined.

SpaceX is redefining global connectivity, delivering high-speed, low-latency internet anywhere on the planet¹. Its civilian system, Starlink, is bridging the digital divide by providing reliable broadband in remote and underserved regions, enabling education, telemedicine and economic growth. Its defense and government variant, Starshield, is offering secure, resilient communications and rapid data transfer for military operations.

In the midst of the COVID pandemic, in a quiet campus building, the ASPIN Laboratory was busy researching Starlink’s mysterious proprietary signals and the satellites’ poorly known orbits. Having demonstrated the first experimental unmanned aerial vehicle (UAV)² and ground vehicle³ navigation using Orbcomm LEO satellites, the team’s next grand objective was to exploit Starlink’s signals of opportunity for positioning, navigation, and timing (PNT). At the 2021 ION GNSS+ Conference, the team announced a new era of LEO PNT: the first successful exploitation of Starlink for PNT⁴. The team designed a cognitive software-defined receiver (SDR) capable of tracking the carrier phase ⁵ and Doppler⁶ of Starlink’s so-called pilot tones along with ephemerides error correction algorithms⁷. The SDR and algorithms were put into test to localize a stationary receiver. Starting from an initial estimate nearly 180 km away, listening to six Starlink satellites resulted in localizing the receiver to within 10 m. This led to worldwide research to study Starlink for PNT, from deciphering Starlink’s downlink orthogonal frequency-division multiplexing (OFDM) signals^8,9, to analyzing its ephemerides and timing^10,11, to studying the achievable PNT performance^12,13.

This article presents the most advanced LEO PNT results to date with Starlink on four mobile platforms at geographically dispersed locations:

1. Ground vehicle in Pennsylvania

2. UAV in Ohio

3. Extremely high-altitude balloon in New Mexico

4. Maritime vessel in the Arctic near Greenland

Exploiting Starlink LEO for PNT: The enablers

SDR and signal analysis

Unlike GNSS, non-cooperative LEO satellites such as Starlink do not publicly disclose the structure of their downlink signals, so users must build their own “LEO PNT Interface Control Document (ICD)”¹⁴. This can be achieved via “reverse-engineering” the signal. A more powerful approach to “reverse-engineering” is via cognitive SDRs, which employ blind signal processing techniques to learn the signals on-the-fly, regardless of the adopted modulation and multiple-access scheme¹⁵.

The most comprehensive characterization to date of Starlink’s downlink signals for PNT was unveiled in¹⁶, utilizing the cognitive SDR approach, in which:

1. The full OFDM beacon was revealed.

2. Theoretical and experimental description for exploiting Starlink for PNT was provided, showing the maximum achievable carrier-to-noise density ratio (C/N₀) under different scenarios: (i) pilot tones versus OFDM-based beacons and (ii) low-gain versus high-gain reception captures.

3. A Starlink LEO PNT SDR was designed, yielding the first successful extraction of navigation observables (carrier phase, Doppler shift and code phase) from Starlink’s OFDM signals.

4. A detailed analysis of the quality of Starlink navigation observables, including (i) signal activity and power levels and (ii) timing corrections that contaminate extracted observables along with mitigation strategies.

---

Ephemeris and timing error correction

Unlike GNSS, non-cooperative LEO satellites, such as Starlink, do not broadcast ephemeris and clock data, so users rely on public sources, such as two-line element (TLE) files. However, this data degrades over time due to orbital perturbations, limiting their effectiveness for PNT. Recent research addressed this challenge through five main approaches:

1. Differential LEO^17,18

2. Machine learning-based orbit prediction^19,20

3. Measurement error correction^21,22

4. Closed-loop ephemeris tracking^23,24

5. Equivalent timing error compensation^25,26

The next sections will showcase experimental LEO PNT results with Starlink signals of opportunity. All experiments utilized the SDR developed in¹⁶ and the ephemerides and timing correction methods developed in^26-28.

---

Ground vehicle navigation in Pennsylvania

The experiment was conducted in June 2025. The ground vehicle navigated for 3 km in 120 seconds on Interstate 79 by Pittsburgh, Pennsylvania. GNSS signals were available for the first 30 seconds but were virtually cut off for the last 90 seconds, during which the vehicle traversed a 2.25 km trajectory. The vehicle was equipped with a VectorNav VN-310 dual GNSS/INS operating with real-time kinematic (RTK) corrections and a tactical-grade inertial measurement unit (IMU), from which the vehicle’s ground truth was generated. Starlink signals were captured over all eight Ku-band downlink channels using an upward low-noise block with feed-horn (LNBF) and processed at 2.5 MSps via two NI X410 USRPs.

The vehicle navigated by fusing Doppler shift measurements from 11 Starlink satellites in a tightly-coupled fashion to aid the IMU, while altimeter measurements were fused in a loosely-coupled fashion. IMU updates were performed at a rate of 200 Hz. Starlink Doppler measurement updates were performed at a rate of 1 Hz with measurement noise variance inversely related to the received C/N₀, ranging between 0.05 (m/s)² and 6.5 (m/s)², while altimeter updates were performed at a rate of 10 Hz with a measurement noise variance of 3 m². The vehicle-mounted receiver and LEO satellites’ oscillator qualities were assumed to be that of an oven-controlled crystal oscillator (OCXO). A prior for the vehicle’s position and velocity was obtained from the on-board GNSS system. Starlink LEO satellites’ ephemeris errors were corrected via the equivalent timing error compensation technique in an online fashion as described in²⁸. Each satellite’s equivalent timing error state was initialized with 0, while the relative clock drift state was initialized as the difference between the measured and predicted pseudorange rate.

An extended Kalman filter (EKF) was used to estimate the state vector, consisting of the vehicle’s orientation, 3D position, 3D velocity and the IMU’s 3D gyroscope and accelerometer biases along with the relative clock drift error between the receiver and each LEO satellite. The Starlink satellites’ orbits were generated by propagating TLE files with SGP4 for the duration of the experiment. The navigation solution was generated using three approaches:

1. Unaided IMU: The vehicle navigates via open-loop IMU measurements when GNSS measurements are unavailable.

2. LEO-aided IMU with TLE+SGP4 ephemerides: The vehicle fuses LEO measurements with IMU and altimeter measurements while incorporating TLE+SGP4 ephemerides in the navigation filter.

3. LEO-aided IMU with online ephemerides corrections: The vehicle fuses LEO measurements with IMU and altimeter measurements. Starting with TLE+SGP4 ephemerides, the navigation filter estimates an equivalent timing error for each satellite as described in²⁸.

---

UAV navigation in Ohio

The experiment was conducted in August 2025. A DJI M600 UAV navigated for 500 m in 75 seconds in Columbus, Ohio. GNSS signals were available for the first 20 seconds of the experiment but were virtually cut off for the last 55 seconds, during which the UAV traversed a 370 m trajectory. The UAV was equipped with a VectorNav VN-310 dual GNSS/INS operating with RTK corrections and a tactical-grade IMU, from which the UAV’s ground truth was generated. Starlink signals were captured from the 4 low-side Ku-band channels using an upward LNBF and processed at 2.5 MSps via an NI 2955 USRP. Figure 4 shows the UAV’s hardware setup.

The UAV navigated by fusing Doppler shift measurements from nine Starlink satellites in a tightly-coupled fashion to aid the IMU, while altimeter measurements were fused in a loosely-coupled fashion. IMU updates were performed at a rate of 200 Hz. Starlink Doppler measurement updates were performed at a rate of 1 Hz with measurement noise variance inversely related to the received C/N₀, ranging between 0.09 (m/s)²  and 6.75 (m/s)², while altimeter updates were performed at a rate of 10 Hz with a measurement noise variance of 3 m². The UAV-mounted receiver and LEO satellites’ oscillator qualities were assumed to be that of an OCXO. A prior for the UAV position and velocity was obtained from the UAV’s on-board GNSS system. Starlink LEO satellites’ ephemeris errors were corrected via the equivalent timing error compensation technique in an online fashion as described in ²⁸. Each satellite’s equivalent timing error state was initialized with 0, while the relative clock drift state was initialized as the difference between the measured and predicted pseudorange rate.

An EKF was used to estimate the state vector, consisting of the UAV’s orientation, 3D position, 3D velocity and the IMU’s 3D gyroscope and accelerometer biases, along with the relative clock drift error between the receiver and each LEO satellite. The Starlink satellites’ orbits were generated by propagating TLE files with SGP4 for the duration of the experiment. The navigation solution was generated using the three approaches described in Section II.

Figure 5 shows the Starlink satellite trajectories, as well as the UAV’s ground truth and estimated trajectories with the three different navigation approaches. The unaided IMU solution drifted to a 3D position RMSE of 46.51 m from the truth trajectory. The LEO-aided IMU solution that incorporated the erroneous TLE+SGP4 ephemerides resulted in a 3D position RMSE of 17.82 m, while the navigation solution employing the online ephemeris correction method resulted in an RMSE of 8.15 m. Table 2 summarizes the navigation results.

---

High-altitude balloon navigation in New Mexico

The experiment was conducted in July 2024²⁹. The balloon was launched from the Moriarty Municipal Airport in Moriarty, New Mexico, and landed just south of Mountainair, New Mexico, traveling a horizontal distance of about 105 km south with a 3D distance of about 119 km. The balloon reached a peak altitude of about 25.3 km (83,128 ft) above sea level. A specific time period was studied to evaluate utilization of Doppler observables for navigation at an elevation of 82,177 ft. During this period, five different Starlink satellites were tracked over a 50-second period, during which the balloon traveled 948 m.  The balloon was equipped with a VectorNav VN-200 GNSS/INS, from which the ground truth trajectory was generated. Starlink signals were captured over two Ku-band downlink channels using an upward LNBF and processed at 2.5 MSps via two Ettus B205-mini USRPs. Figure 6 shows the balloon’s hardware setup.

The balloon navigated by fusing Doppler shift measurements from five Starlink satellites and altimeter measurements via an EKF. The dynamic model of the high-altitude balloon was chosen as a velocity random walk model, with acceleration process noise spectra set to 0.5 m²/s³ in the in the East, North and 0.8 m²/s³ in the in Up directions, respectively. Starlink Doppler measurement updates were performed at a rate of 10 Hz with measurement noise variance inversely related to the received C/N₀, ranging between 1.40 (m/s)² and 7.01 (m/s)², while altimeter updates were performed at rate of 10 Hz with a measurement noise variance of 1 m². The process noise covariance for the clock states was constructed according to an OCXO clock quality. A prior for the balloon’s position and velocity was obtained from the on-board GNSS system. Ephemeris data for each satellite was obtained from offline SGP4-propagated TLE, with epoch time corrections made by minimizing the residuals between predicted Doppler and measured Doppler^26,27.

The EKF state vector consisted of the balloon’s 3D position and 3D velocity along with the relative clock drift error between the receiver and each LEO satellite. The navigation solution was generated using (i) an open-loop approach, which simply propagated the states via the dynamical model and (ii) the LEO+altimeter approach.

Figure 7 shows the balloon’s ground truth and estimated trajectories with the two different navigation approaches. The open-loop solution drifted to a 3D position RMSE of 83.34 m from the truth trajectory, while the LEO-aided solution resulted in an RMSE of 12.28 m. Table 3 summarizes the navigation results.

---

Maritime navigation in the Arctic

The experiment was conducted in August 2024³⁰. The vessel navigated for 8.5 km in 20 minutes off the shore of Baffin Island, Nunavut, Canada. Starlink signals were captured over the third Ku-band downlink channel using an upward LNBF and processed at 2.5 MSps via a B205-mini USRP and a Raspberry Pi 4. Figure 8 shows the vessel’s hardware setup.

The vessel navigated by fusing Doppler shift measurements from 12 Starlink satellites and altimeter data via an EKF. The dynamic model of the vessel was chosen as a velocity random walk model. Starlink Doppler measurement and altimeter data updates were both performed at a rate of 10 Hz with measurement noise variances of 4.5 (m/s)² and 3 m², respectively. The vessel-mounted receiver and the LEO satellites’ oscillator qualities were assumed to be that of an OCXO. The vessel’s position states were initialized from the true position obtained from the on-board GNSS system. The velocity was initialized from the true velocity but with a 10˚ clockwise error with respect to the vessel’s direction-of-motion. The Starlink satellites’ orbits were generated by propagating TLE files with SGP4 for the duration of the experiment. Ephemeris errors were corrected by adjusting the TLE epoch time for eachsatellite^26,27 to minimize the residuals between predicted Doppler and measured Doppler.

An EKF was used to estimate the state vector, consisting of the vessel’s 3D position, 3D velocity and the relative clock drift errors between the receiver and each LEO satellite. The navigation solution was generated via two approaches: (i) using only altimeter data and (ii) using LEO Doppler fused with altimeter data.

Figure 9 shows the Starlink satellite trajectories, as well as the vessel’s ground truth and estimated trajectories with the two navigation approaches. The altimeter-only solution drifted to a 3D position RMSE of 846 m from the truth trajectory. The LEO+altimeter solution resulted in a 3D position RMSE of 123 m. Table 4 summarizes the navigation results.