Signal Structure of the Starlink Ku-Band Downlink
Todd E. Humphreys∗, Peter A. Iannucci∗, Zacharias M. Komodromos†, Andrew M. Graff†
∗Department of Aerospace Engineering and Engineering Mechanics, The University of Texas at Austin
†Department of Electrical and Computer Engineering, The University of Texas at Austin
Abstract—We develop a technique for blind signal identifica-
tion of the Starlink downlink signal in the 10.7 to 12.7 GHz
band and present a detailed picture of the signal’s structure. Im-
portantly, the signal characterization offered herein includes the
exact values of synchronization sequences embedded in the signal
that can be exploited to produce pseudorange measurements.
Such an understanding of the signal is essential to emerging
efforts that seek to dual-purpose Starlink signals for positioning,
navigation, and timing, despite their being designed solely for
broadband Internet provision.
Index Terms—Starlink, signal identification, positioning, time
synchronization, low Earth orbit
I. INTRODUCTION
In addition to revolutionizing global communications,
recently-launched broadband low-Earth-orbit (LEO) mega-
constellations are poised to revolutionize global positioning,
navigation, and timing (PNT). Compared to traditional global
navigation satellite systems (GNSS), they offer higher power,
wider bandwidth, more rapid multipath decorrelation, and
the possibility of stronger authentication and zero-age-of-
ephemeris, all of which will enable greater accuracy and
greater resilience against jamming and spoofing [1]–[5].
With over 3000 satellites already in orbit, SpaceX’s Starlink
constellation enjoys the most mature deployment among LEO
broadband providers. Recent demonstrations of opportunistic
Doppler-based positioning with Starlink signals [6]–[8] open
up exciting possibilities. But whether Starlink signals are
more generally suitable for opportunistic PNT—not only via
Doppler positioning—and whether they could be the basis of a
full-fledged GNSS, as proposed in [5], remains an open ques-
tion whose answer depends on details of the broadcast signals,
including modulation, timing, and spectral characteristics. Yet
whereas the orbits, frequencies, polarization, and beam pat-
terns of Starlink satellites are a matter of public record through
the licensing databases of the U.S. Federal Communications
Commission [9], details on the signal waveform itself and
the timing capabilities of the hardware producing it are not
publicly available.
We offer two contributions to address this knowledge gap.
First, we develop a technique for blind signal identification
of the Starlink downlink signal in the 10.7 to 12.7 GHz
band. The technique is a significant expansion of existing
blind orthogonal frequency division multiplexing (OFDM)
signal identification methods (see [10]–[12] and the references
therein), which have only been successfully applied to simu-
lated signals. Insofar as we are aware, blind identification of
operational OFDM signals, including exact determination of
synchronization sequences, has not been achieved previously.
The technique applies not only to the Starlink Ku-band down-
link but generally to all OFDM signals except as regards some
steps required to estimate synchronization structures that are
likely unique to Starlink.
Second, we present a detailed characterization of the Star-
link downlink signal structure in the 10.7 to 12.7 GHz band.
This applies for the currently-transmitting Starlink satellites
(versions 0.9, 1.0, and 1.5), but will likely also apply for
version 2.0 and possibly later generations, given the need to
preserve backward compatibility for the existing user base.
Our signal characterization includes the exact values of syn-
chronization sequences embedded in the signal that can be
exploited to produce pseudorange measurements. Combining
multiple pseudorange measurements to achieve multi-laterated
PNT, as is standard in traditional GNSS, enables faster and
more accurate opportunistic position fixes than the Doppler-
based positioning explored in [6]–[8], [13]. and can addition-
ally offer nanosecond-accurate timing, whereas even under the
optimistic scenario envisioned in [13], extracting timing from
Doppler-based processing of LEO signals yields errors on the
order of 0.1 to 1 ms.
II. SIGNAL CAPTURE
To facilitate replication of our work, and as a prelude to
our presentation of the signal model, we begin with a detailed
description of our signal capture system.
One might reasonably wonder whether a standard consumer
Starlink user terminal (UT) could be modified to capture wide-
band (hundreds of MHz) raw signal samples for Starlink signal
identification. Not easily: operating the UT as development
hardware, which would permit capture of raw signal samples,
requires defeating security controls designed specifically to
prevent this. Moreover, the clock driving the UT’s downmixing
and sampling operations is of unknown quality and would
therefore taint any timing analysis of received signals.
We opted instead to develop our own system for Starlink
signal capture. Composed of off-the-shelf hardware and cus-
tom software, the system enables signal capture from one
Starlink satellite at a time with downmixing and sampling
referenced to a highly-stable GPS-disciplined oscillator.
Whereas the consumer Starlink UT operates as a phased
array of many separate antenna elements, our antenna is a
steerable 90-cm offset parabolic dish with a beamwidth of
approximately 3 degrees. Starlink orbital ephemerides pro-
vided publicly by SpaceX guide our selection and tracking
of overhead satellites. Only one or two Starlink satellites
illuminate a coverage cell at any one time with a data-bearing
beam [5]. To guarantee downlink activity, we solicit data by
arXiv:2210.11578v3 [eess.SP] 30 Aug 2023