Position and Navigation Using Starlink

E. Grayver, R. Nelson, E. McDonald, E. Sorensen, S. Romano

Aerospace Corporation
2310 E. El Segundo Blvd.
El Segundo, CA 90245
310-336-1274
[Link]@[Link]

Abstract— The world relies on accurate and reliable navigation 5. GEOPOSITIONING .................................................. 6
made possible by GNSS. There is significant interest in
expanding the range of signals that can be used for navigation Geopositioning model ...................................................... 7
2024 IEEE Aerospace Conference | 979-8-3503-0462-6/24/$31.00 ©2024 IEEE | DOI: 10.1109/AERO58975.2024.10521263

in case the traditional GNSS sources are unavailable. The

The model ........................................................................ 7
proliferated communications satellite constellations are
particularly interesting because of they offer unparalleled level Signal correlation ............................................................. 7
of resilience. The Starlink satellites transmit a wideband signal
at power levels much higher than GPS and provide worldwide Geopositioning fits ........................................................... 8
coverage. This paper provides new experimental results that
demonstrate positioning with better than 100m accuracy using
Data Preparation ............................................................... 8
only Starlink downlink signal. Results .............................................................................. 8
These are the first published results that take advantage of the Discussion ........................................................................ 9
full downlink signal. A low-gain antenna is used to capture
signals from a 30-degree cone that includes many Starlinks at 6. CONCLUSION.......................................................... 9
any time. Unlike previously published work, we process all the
in-view satellites rather than pointing at just one. Not only does REFERENCES ............................................................. 10
this approach solve the question of which satellite is active at any BIOGRAPHY ............................................................... 10
time, but it also increases the number of useful observations.

A wideband digitizer is used to process the entire band that

consists of six 250 MHz channels. All the channels are processed
simultaneously since the receiver cannot tell which channel may
1. INTRODUCTION
be active at any time. Each channel is individually correlated The use of Signals of Opportunity (SoP) for positioning and
with a fixed sequence (preamble) that is known to arrive at navigation can alleviate concerns about the resilience of the
regular intervals. The key contribution of this paper is an
GNSS infrastructure. Traditional GNSS signals (e.g., GPS)
algorithm that takes advantage of the regular arrival intervals
to extract the change in the range between the satellite and the can be vulnerable to jamming, spoofing, and other attacks.
receiver. This range-rate is similar—but not identical—to the Additional signals, especially in a different band, can add
Doppler frequency offset that was used in previous work. significant redundancy. Fortunately, there are now plenty of
SoP available curtesy of the proliferated LEO constellations.
The rate change observations are combined into traces that The Starlink, OneWeb, and soon Kuiper constellations
correspond to different satellites and channels. An algorithm to transmit thousands of potentially exploitable signals.
separate overlapping and/or intersecting traces allows us to use
all the available data. At least a dozen papers [1-7, 12,13] have been published in
the last couple of years looking at repurposing these signals,
Starting from an estimated initial location and estimated initial developed for providing high speed, low-latency internet for
time, we form a model to correlate each trace to a positioning and navigation.
satellite/channel. An optimizer is used to minimize the
difference between the observations and model is predictions The first promising results were published by Kassas [1],
parametrized by (x,y,z,t). The initial results using a simple based on the Doppler offset of unintentional tones transmitted
model are very promising. between the data channels. More recently Humphreys
published a thorough analysis of the Starlink signal structure
[2], but stopped short of using the signal for positioning. The
TABLE OF CONTENTS signal analysis was extended and its applicability to
navigation is suggested by Kassas in [4].
1. INTRODUCTION ....................................................... 1
The pioneering work of Kassas and Humphreys was
2. ANALYZING THE SIGNAL STRUCTURE ................ 2 apparently limited by lack of wideband signal capture
hardware required to process the complete Starlink signal.
3. EXTRACTING THE MEASURANDS ......................... 2
This paper presents the first (to the best of the author’s
4. SEPARATING TRACES ........................................... 5 knowledge) complete positioning solution using the full

979-8-3503-0462-6/24/$31.00 ©2024 IEEE

1
Authorized licensed use limited to: Nanyang Technological University Library. Downloaded on March 10,2025 at 04:44:26 UTC from IEEE Xplore. Restrictions apply.
 Starlink signal. The wideband signal capture equipment used
by the authors allowed observation of previously unreported
behavior of the signal. Further, the fortuitous location of the
authors’ laboratory next to a major Starlink hub, provided a
glimpse into the future of heavily utilized satellite resources.

2. ANALYZING THE SIGNAL STRUCTURE

Figure 2. Starlink downlink spectrogram (long duration)
The work by Humphreys [2] provides an excellent summary
of the Starlink signal internals. This section summarizes
these results, which were independently confirmed by the
authors, and highlights any differences.
We used a 2.4m antenna to capture high-SNR snapshots of
the Starlink downlink. Unfortunately, the only large antenna
available to us is designed for slow-moving GEO or MEO
satellites and cannot change its elevation fast enough to track
the fast-moving LEOs1. The antenna controller software was
modified to point at a high-elevation pass and wait for the
satellite to get into the beam. Once in the beam tracking is
enabled and the antenna stays on the satellite for as long as it Figure 3. Starlink downlink spectrogram (short duration)
can (a few seconds).

Figure 4. Starlink downlink spectrum

Figure 1. 2.4m GEO pointing antenna The high-SNR capture allows us to easily identify repeating
features and extract the preamble. There is a slight difference
The amplified and downconverted signal is split between a between the preamble we extracted and [2], where the last 16
recorder and a spectrum analyzer. A wideband Pentek Talon symbols are not inverted. The frame duration (spacing
recorder [10] supports 3.6 GHz sample rate, which is between preambles), 1/750~1.33ms, and the preamble length,
sufficient to capture signals up to ~1.7 GHz. The fixed 10.75 1024 symbols, match the results in Humphrey’s paper. The
GHz LO moves the Ku-band downlink signal to an IF such preamble and frame duration are the only signal parameters
that channels 3-7 can be digitized2. that will be used for the remainder of the paper.
Table 1 Frequency mapping of Starlink channels Only the primary (PSS) preamble is used for all the results in
this paper because one of the goals is to analyze the
Channel
robustness of the approach. The secondary preamble (SSS)
3 4 5 6 7
can be trivially added to increase the SNR by 3 dB.
RF 11.325 11.575 11.825 12.075 12.325
IF 575 825 1075 1325 1575
3. EXTRACTING THE MEASURANDS
A few representative captures showing the spectrogram and
the raw spectrum are presented in the figures below. The large high-gain antenna is clearly not suitable for a
Contrary to the claim in [2], multiple channels are active practical positioning receiver3. The goal is to develop a
simultaneously. Figure 3 shows an abrupt change/glitch on portable, ideally hand-held, solution.
15s boundary, which will be revisited later in the paper. A set of measurands that are related to the relative positions
of the satellite(s) and the receiver are needed to compute a

astronomy users. Channel 8 is outside the digitizer bandwidth.

1
We have since procured a Kymeta U8 electronically steerable antenna [9]
3
that can easily track the Starlinks (using a simple script to set the pointing Even if it could point to a satellite quickly. Multiple satellites need to be
angle via the API), but it was not used for the results in this paper. observed simultaneously to achieve a reasonably quick position ‘fix.’
2
Starlink does not use channels 1 and 2 to avoid interference with radio

2
Authorized licensed use limited to: Nanyang Technological University Library. Downloaded on March 10,2025 at 04:44:26 UTC from IEEE Xplore. Restrictions apply.
 positioning solution. It is important to note that
demodulating the downlink data is not needed. The signal
can be integrated over the duration of the preamble to
increase the SNR. This approach is similar to the traditional
GPS processing since the SNR of the GPS signal is less than
zero. However, unlike GPS, the integration is ‘bursty.’
The large dish is replaced with a small 15 dB gain horn
antenna pointed straight up. The horn is connected to a
wideband low-noise-block (LNB) [11]. Unfortunately, the
10 GHz fixed LO in the LNB places the Starlink signal at a
high intermediate frequency, beyond the bandwidth of the
digitizer. A simple additional frequency shift is added to
achieve the frequency mapping shown in Figure 5 which
allows us to digitize all the channels.

Ch RF IF
3 11.325 175 Figure 6. Spectrum of the digitized signal
4 11.575 425
The wideband signal is channelized by digitally
5 11.825 675 downconverting each channel and then decimating by 7 to a
6 12.075 925 sample rate of 514.28 MHz. The preamble is resampled to
7 12.325 1175 this sample rate and correlated with each of the 6 channels.
8 12.575 1425
We chose to implement the channelization and correlation in
a GNURadio flowgraph to take advantage of native multi-
threading and existing highly optimized FFT-based
correlation engine5. The preamble acquisition engine outputs
the sample number and magnitude of any correlation that
exceeds a specified threshold.

Figure 5. Low-gain
horn + LNB

The horn gain is around 40 dB lower than the dish, making

signal is not observable at the output of the LNB since it is Figure 7. Preamble acquisition
below the noise floor. The IF signal is amplified and then
A representative correlation between one of the channels and
digitized at 3.6 Gsps. The combined frequency response of the resampled preamble is shown in Figure 8 for the high-
the digitizer and the RF components results in somewhat SNR collection and in Figure 10 for the low-SNR collection.
disappointing4 plot shown in Figure 6.
Note that the spacing between peaks is ≈ 685714 samples,
which corresponds to a frame duration of 1/750 s at a sample
rate of 514.28 MHz. Zooming in around one of the peaks
reveals a set of secondary peaks as shown in Figure 9. The
secondary peaks are due to the structure of the preamble
(PSS) [2]. The secondary peaks are filtered out during post-
processing based on the rule: ‘keep only the largest peak in a
group within one preamble duration long.’

turns out that the frequency offset for all observed acquisitions is less than
4
However, there’s gold in them hills! the frequency search resolution (sample_rate / preamble length) and is
5
reported as zero.
This correlation engine was developed for acquisition of DSSS signals and
performs a time/frequency search for the specified sequence of samples. It

3
Authorized licensed use limited to: Nanyang Technological University Library. Downloaded on March 10,2025 at 04:44:26 UTC from IEEE Xplore. Restrictions apply.
 • There is a distinct 15 second period in the behavior of the
Starlink downlink. This periodicity has been reported
previously in the context of uplink beam scheduling.
• The power level of acquisitions changes over long-scale
time due to satellite motion. Note that the absolute power
levels are lower for higher-numbered channels due to the
rolloff shown in Figure 6.
• There is significant (~5 dB) variability in the power level
of close-by acquisitions on the same channel. We do not
have an explanation for this behavior.
• Multiple satellites are transmitting at the same time as
evidenced by different power variation over time.
• The low-gain antenna with a 30-degree beam is not wide
Figure 8. Correlating preamble against one channel. enough to capture all the transmitting satellites. This is
rather surprising but is demonstrated by the absence of
acquisitions at around 260s. Similar absences were
observed on other captures.

Figure 9 Correlation detail (high SNR)

Figure 11 Preamble acquisitions

The preambles are too short to accurately measure the
Figure 10. Correlation (low SNR) frequency offset7, especially given the low SNR. The high
sample rate provides approximately 2ns8 time resolution for
The preamble acquisitions are plotted in Figure 11. To the
the preamble acquisitions. The preamble time of arrival
best of the author’s knowledge this is the first time that
cannot be used directly since the relative timing
multiple simultaneously active Starlink channels have been
synchronization between satellites (or between channels) is
reported6. A couple of observations can be made:
not guaranteed9. For a stationary satellite, the preambles are

frequency offsets constrained by the estimated location of the user and

6
We repeated the captures multiple times at different times of day, and satellites. However, this approach was not pursued in favor of the time-
always saw the rich combination of channels and satellites. This observation domain approach described in the paper.
is in contrast to the sparse (one frame every 40 ms, one active channel)
8
downlink channel reported in [2]. Finer resolution can be achieved by interpolating between offsets adjacent
to the correlation peak. The timing accuracy is not the main driver for overall
7
The authors considered an approach where the phase of the correlation peak geolocation accuracy, making the interpolation unnecessary.
is used across multiple preambles to estimate the frequency offset. The low
9
effective sample rate (every 1.33 ms), results in aliasing of frequency offsets We are looking into whether the 15 s beam scheduling is locked to GPS,
above 750 Hz. It is possible to resolve the ambiguity given the possible but results were not available at publication time.

4
Authorized licensed use limited to: Nanyang Technological University Library. Downloaded on March 10,2025 at 04:44:26 UTC from IEEE Xplore. Restrictions apply.
 expected to arrive at multiples of, but not necessarily every We define a measurand that describes the change in the time
multiple, 𝑡𝑓𝑟𝑎𝑚𝑒 . If the propagation time between the satellite of arrival10:
and the receiver is fixed, the preambles will arrive with a
𝑑 = 𝑡𝑎𝑐𝑞 − ⌊𝑡𝑎𝑐𝑞 ⁄𝑡𝑓𝑟𝑎𝑚𝑒 ⌉ × 𝑡𝑓𝑟𝑎𝑚𝑒
constant delay relative to an arbitrary 𝑡𝑓𝑟𝑎𝑚𝑒 grid. This
regular grid is evident in the Figure 12. As can be seen in If the propagation time changes, then the delay, d, also
Figure 13 the Starlink system is highly loaded at the authors’ changes. A representative plot of d for a low-SNR capture is
location and most of the time preambles are spaced by just shown in Figure 14. The trace colors correspond to the
one frame (i.e., sequential). downlink channel number. We can make a few observations:
• The 15 s periodicity noted previously is evident.
• There are at least four different satellites present based
on the shapes of the traces.
• The delay is not always maintained across 15 s
boundaries even for the same channel. The delay is also
not maintained across 15 s boundaries11.

Figure 12 Time delta between successive acquisitions

Figure 14 Measurand d

4. SEPARATING TRACES
The measurand data needs to be split into individual satellites
and bins (the 15 s periodic intervals). While the separation of
satellites is obvious to a human eye, computational methods
struggle to naturally identify trace patterns. Given a random
start of capture data, there is an offset from t = 0 to the start
of the first full length bin (the bin offset). Traces from
different satellites at the same frequency may overlap as
shown in Figure 15.

Figure 13 Distribution of preamble spacing

between channels due to the RF components and the digitizer. However, the
10
Not to be confused with time difference of arrival. group delay alone does not account for the large jumps in delay.
11
The delay computation does not account for group delay difference

5
Authorized licensed use limited to: Nanyang Technological University Library. Downloaded on March 10,2025 at 04:44:26 UTC from IEEE Xplore. Restrictions apply.
 Figure 17 The iterations used to determine a set of traces’
shapes.
Having found the bin boundaries, the program iterates
through the data again by bin to identify the individual traces
Figure 15 Three traces at the same frequency at the same and group the data accordingly. The algorithm iteratively
time (other channels removed for clarity). selects data points in a group using random sample consensus
(RANSAC) regression with a residual threshold of 10-5 and
removes them from the data set. Subsequently, each group
within the channel is fit to a quadratic polynomial. Because
RANSAC regression is linear, and the expected tolerance is
not perfect, the set of quadratic equations is used as a
guideline for the actual groups the data points will be placed
in. The points are grouped by calculating the mean squared
error between each data point and each quadratic and
selecting the line with the lowest mean squared error. This
also allows for filtering of anomalous data, as points with a
error above 10-11 s are not close enough to anything to be a
part of a trace. An example of the resulting data is Figure 18;
traces are colored uniquely in each bin to show the
distinctions.
Figure 16 Example of traces starting (yellow), stopping
(pink), and jumping (red) at a bin boundary.
To calculate the initial bin offset, we first analyze all data
from all the channels in 20 s intervals. Each 20 s interval will
have two bin edges. Channels with little or no information are
ignored. We look for bin boundaries by detecting one of
three “events” (Figure 16):
• A channel stops transmitting for more than 0.75 seconds.
Figure 18 The resulting trace map. The black bin
• A channel begins transmitting consistently (< 0.5 s spacing boundaries have been added for clarity.
for more than 5 points in a row)
• A channel has a jump in delay greater than 0.1 ms that lasts 5. GEOPOSITIONING
for more than 100 points. From a practical matter, geopositioning requires inverting a
The time of each event in an interval is recorded for all set of measurements, which vary with position and/or
intervals. We then compute time of each event modulo 15 s velocity, to determine the best possible estimate for the
and group events within 0.1 seconds of each other. The group location of the receiver. The set of measurements used here,
with the largest number of events is selected, and the average are a series of preamble start times relative to a fixed
of the values in the group is computed. Experiments show reference (i.e., the receiver’s clock). The previous sections
that this average value is within 1 ms of the ‘eyeballed’ bin discussed the extraction of the preambles, the definition of
boundaries. the observable, and the separation of the signals into
individual 15-second-long collections or timing bins. This
section takes those measurements and determines a position
for where those measurements were taken. The inversion of
these signals into an estimate of the receiver’s position will
require the following steps:
1. Define a geopositioning model
2. Correlation of the timing traces to specific Starlink
6
Authorized licensed use limited to: Nanyang Technological University Library. Downloaded on March 10,2025 at 04:44:26 UTC from IEEE Xplore. Restrictions apply.
 satellites discontinuity in the trace. Then, the data and the model are
shifted so that they have zero delay at the center of their time
3. Correcting the Starlink ephemerides to better-than-
windows. The final correction comes from the fact that the
typical TLE uncertainties (at least for this purpose) and
way in which the measurand d is computed (i.e., difference
potential receiver clock bias
to the nearest boundary), adds an arbitrary sign to the trace so
4. Fit the geopositioning model to the measured data and both the model and its mirror image need to be compared with
determine both precision and accuracy of the estimates. the data.
This section will describe how each of these steps were
accomplished and the implementation of a simplistic
geopositioning model.

Geopositioning model
The Starlink preambles are emitted at a fixed 750 Hz rate
during the 15-second-long connection with a ground
terminal. The model takes a TLE for a given Starlink satellite
and processes it through a SGP4 propagator to determine the
satellite’s Earth-centered-Earth-fixed (ECEF) position and
velocity for a specified time. The slant range is calculated for
each satellite position and converted to a time-of-flight (TOF) Figure 19: A single 15-s-long data trace and it’s
between the emission point and reception at the receiver. corresponding model. Left) the uncorrected raw data and
Since the synchronization offset of the ground receiver and corresponding model. Right) the data and model after
each satellite is unknown, the model doesn’t determine the unwrapping, shifting, and correcting the sign (if needed).
relative phase of the emitted preamble and the ground Figure 19 shows a 15-s-long data trace and it’s corresponding
reference signal nor does it account for the few meters of matched model before and after unwrapping, shifting, and
motion of the satellite between emission and reception. The correcting the sign.
TOF for each emission point is then calculated modulo the
expected interval. Because of relative motion between the
satellites and the receiver, this modulo isn’t constant during
the time bins as shown by Figure 18. While there are
potentially 11,250 preambles in a bin, it’s the shape of the
curve that provides the information needed for the fit. As the
shapes have very little structure, the fits were poor whenever
the fitter was used for a small number of traces. To compare
the data to the model, the data and model need to be
unwrapped in the event either crosses the modulo boundary,
and the offset needs to be removed.

The model
We define 𝑓𝑖𝑗 (𝑔⃗) to be the model that maps a given position
Figure 20: Geometric Dilution of Precision.
vector, 𝑔⃗, to the expected delay with the caveat that we need
the entire expected delay trace to normalize the function. Figure 20 shows the geometric dilution of precision (GDOP)
calculated from the Starlink satellite positions and the GPS
|𝑔⃗ − 𝑝⃗𝑖𝑗 | position of the receiver. For reference, a GDOP = 1 implies
𝑓𝑖𝑗 (𝑔⃗) = (𝑟𝑗 + ) %Δ𝑡
𝑐 that a 1 s measurement uncertainty should have a roughly
where i is the preamble index, j is the satellite index, 𝑝⃗𝑖𝑗 is 3 km position uncertainty.
the satellite ephemeris in ECEF coordinates, c is the vacuum
Signal correlation
speed of light, ∆𝑡 = 1/750 𝐻𝑧 ≅ 1.33 𝑚𝑠, and − ∆𝑡⁄2 ≤
We don’t know how to determine which satellite is
𝑟𝑗 ≤ ∆𝑡⁄2 is an unknown random offset and fixed for each
responsible for a particular trace12. A brute-force process was
trace. The ephemerides, 𝑝⃗𝑖𝑗 , are calculated at each measured implemented to correlate a potential Starlink satellite to each
preamble collection time at index i. To compare the measured data trace. For this purpose, we used the GPS
measured delays to the model, both are first unwrapped so position of the receiver to compare the geopositioning model
that any set that encountered the modulo boundary are using all Starlinks in view to each trace, calculate a χ2, then
continued smoothly instead of having a Δ𝑡-sized

much too low to extract it.

12
Even if the information is embedded in the OFDM symbols, the SNR is

7
Authorized licensed use limited to: Nanyang Technological University Library. Downloaded on March 10,2025 at 04:44:26 UTC from IEEE Xplore. Restrictions apply.
 keep the satellite that best matches the data. Each data trace describes a mapping from the parameters of interest (here, the
is compared with all the satellites that are in view at that position of the receiver). With that set of information, the
particular moment. Figure 21 shows an example of this fitter iterative applies the Gauss-Markov theorem consistent
process. with Generalized Least Squares [8]. Note that this approach
is less sophisticated than in the works by Kassas. The goal
of this paper is to demonstrate the feasibility of using the
obtained measurands for positioning, but by no means to
present an optimal way to use them.

Data Preparation
For a 5-minute-long data collection window divided into 15-
s-long bins with an uneven bin boundary there are 19 15-s-
long bins with the first and last bins combining to 15 s in
length14. Therefore, across the 5 5-minute-long data collects,
there are 95 possible 15-s-long bins (where each bin has 0 or
more traces), 45 30-s-long bins, 20 60-s-long bins, 10 120-s-
long bins, and 5 300-s-long bins; however, because some of
the 15-s bins were empty—or didn’t have enough data to
Figure 21: Comparison of 5 different Starlink satellites to perform the fits—there were only 63 and 42 bins used in the
a single 15-s-long trace. Clearly, one of the satellites 15-s-long and 30-s-long data.
matches well while the others do not. Note: each In order to perform the individual geolocation fits, the data
satellite’s modelled delay and mirror image are shown. are linearized by stacking the individual delay vector traces
end-to-end. To reduce computational complexity, each trace
was decimated to use at most 100 points randomly selected
uniformly15 across the trace, or the full trace if it comprised
fewer than 100 points. Figure 23 shows a representative
example for one of—out of the 42—30-s-long time windows.
Additionally, the figure shows the post-fit model, post-fit
residuals, and pre-fit weighted uncertainties. The apparent
jaggedness of the traces is solely due to the decimation as the
time between data points is not constant (i.e., the x-axis in no
longer time but an arbitrary index).

Figure 22: Histogram of the number of data traces

correlated to individual satellites. The largest number of
traces correlated to one satellite is 16.
Figure 22 shows a histogram of the number of data traces
correlated to individual satellites. There were 235 distinct
satellites found across the 5 data collections. As there were
490 traces used in the analysis, 121 were correlated to single
satellites or to 24.7% of the data13. It’s certainly possible that
some fraction of those were correlated incorrectly.
Figure 23: Delay data and post-fit residuals for a
Geopositioning fits representative 30-s-long time window.
The iterative weighted least-squares fit was performed with a
Results
custom fitter that accepts a vector of data (the measurements),
a covariance for that data, and a functional model that As an overall scale for the measurement uncertainties is

13 15
Analysis of the root cause of the ‘bad fits’ is ongoing. Random selections are preferred over periodic selections because they
avoid periodic systematics that might have occurred during data collection.
14
Unless the bin boundaries exactly matches the start time, then there are 20
15-s-long bins.

8
Authorized licensed use limited to: Nanyang Technological University Library. Downloaded on March 10,2025 at 04:44:26 UTC from IEEE Xplore. Restrictions apply.
 unknown, the data was subdivided and fit in independent
sections to produce a set of estimated positions as a function
of collection time window. These measurements were then
used to estimate the average position for that time window,
and the covariance of positions around that average. The
distance between the average estimate and the true GPS
location estimates the accuracy of the technique while the
semi-major axis of the ellipse/ellipsoid of the points about the
average provides an estimate of the precision of the
measurements. The cumulative distribution function of the
absolute miss distances from the true location of each
measurement as a function of collection window were used
to determine an estimate for the circular error probabilities.
Table 2: Estimated precision and accuracy Figure 25: CDF of the east-north miss distances. (zoomed
in)
ECEF [m] east-north projection [m]
Figure 24 and Figure 25 shows the CDF for the 5 collection
window [s] precision accuracy precision accuracy windows for east-north projected fits. As expected, the
15 43,688.1 2,661.3 10,994.5 2,654.1 results improve for longer integration windows, except for
the curious overlap between the 60-and 120-s-long window
30 12,258.4 1,491.5 2,381.7 782.2 CDFs. This is a case of both low statistics and the fact that
60 4,595.2 1,523.9 2,054.1 581.9 adding more data doesn’t always yield a better fit. Rather
120 1,439.1 472.6 268.8 131.8 than cut data where the model didn’t quite match, we chose
to weight the uncertainties of the measurements instead,
300 147.3 56.4 68.0 43.0 which didn’t improve the fit.

Discussion
Table 2 shows the estimates for the precisions and accuracies
of the fits as a function of time window for the 3 parameter Ideally, one would run this experiment significantly more
ECEF fits as well as the projection of those fits in the east- times to increase the statistics, as there are only 5 data points
north plane. The time windows are not independent from in the 300-s-long CDF; however, the results here show a
each other, only within the same window are the fits from promising approach to alternative PNT. There are several
independent collections. In each case, the true location is other factors of note:
contained by the 1-σ ellipsoids (i.e., precision).
• We used the estimated receiver location and estimated
time to determine a subset of Starlinks that may be
visible. Searching over all possible locations and
extending the time window would make the
computational complexity prohibitive.
• Ideally a more accurate set of ephemerides would be
available in real-time for an operational implementation
of this technique.
Furthermore, in a scenario where one was unable to get real-
time accurate ephemerides one could setup a receiver (or
several) in-theater at known locations, record delay data, and
use it to correct the real-time ephemerides of the overhead
portion of the Starlink constellation (as suggested in papers
by Kassas, etc.). Then transmit those correlated and
corrected ephemerides through some other communication
channel to a receiver at an unknown location (but nearby)
Figure 24. CDF of the east-north miss distances. when performing its geopositioning measurements.
Regardless, as a proof-of-principle test using real data, the
results shown in Figure 25 and Table 2 are quite promising.

6. CONCLUSION
The results presented in this paper demonstrate the feasibility
of using the Starlink constellation as the only source of
positioning. We demonstrated that a compact receiver with a

9
Authorized licensed use limited to: Nanyang Technological University Library. Downloaded on March 10,2025 at 04:44:26 UTC from IEEE Xplore. Restrictions apply.
 small, fixed antenna is feasible. The signal processing [9] [Link]
described above was implemented ‘off-line,’ but can be [10] “Talon RTR 2749 3.6 GS/sec Ultra Wideband RF/IF
easily ported to a real-time receiver. The authors envision a Rugged Rackmount Recorder,”
portable implementation, perhaps based on an FPGA [Link]
integrated with a high-rate ADC such as the Xilinx RFSoC. 49
[11] “Actox External Reference Ku-Band PLL LNB
The positioning is not as accurate as GPS and requires
AL1012X”
significantly longer observation.
[12] Ferre, Ruben Morales, et al. "Is LEO-based positioning
It is important to note that Starlink offers its subscribers PNT with mega-constellations the answer for future equal
service that takes advantage of accurate ranging between the access localization?." IEEE Communications Magazine
satellites, terminals, and ground stations. That service will 2022
provide faster and more accurate solutions than what can be [13] Prol, Fabricio S., et al. "Position, navigation, and timing
achieved using the technique described in this paper. The (PNT) through low earth orbit (LEO) satellites: A
main differences are that the proposed technique does not survey on current status, challenges, and opportunities."
require a full-sized dish to close the link for data transfer and IEEE Access 2022
does not require a subscription.
The low SNR due to small antenna makes the system
vulnerable to intentional or unintentional interference. As BIOGRAPHY
more pLEO systems come online, the interference
Dr. Eugene Grayver received a
environment will become more challenging since the antenna
B.S. degree in electrical
does not provide directivity. The SNR margin is only around
engineering from Caltech, and a
3 dB16 (i.e., raising the noise floor by 3 dB makes the PSS
Ph.D. degree from UCLA. He was
undetectable), as can be seen in Figure 10.
one of the founders of a fabless
semiconductor company working
on low-power ASICs for
REFERENCES multi-antenna 3G mobile receivers.
In 2003 he joined The Aerospace
[1] Kassas, Zak, Joshua Morales, and Joe Khalife. "New- Corporation, where he is currently working on flexible
age satellite-based navigation--STAN: simultaneous communications platforms. His research interests include
tracking and navigation with LEO satellite reconfigurable implementations of digital signal
signals." Inside GNSS Magazine 14.4 (2019): 56-65. processing algorithms, adaptive computing, and system
[2] Humphreys, Todd E., et al. "Signal structure of the design of wireless data communication systems. He is also
starlink ku-band downlink." IEEE Transactions on participating in the software-defined radio community,
Aerospace and Electronic Systems (2023). trying to define a common configuration standard and
[3] Iannucci, Peter Anthony, and Todd E. Humphreys. determine optimal partitioning between software and
"Fused low-Earth-orbit GNSS." IEEE Transactions on hardware.
Aerospace and Electronic Systems (2022).
[4] Kassas, Zaher M., et al. "Navigation with Multi- Dr. Eric J McDonald received a
Constellation LEO Satellite Signals of Opportunity: B.S. in electrical engineering from
Starlink, OneWeb, Orbcomm, and Iridium." 2023 the University of Pittsburgh in 1998,
IEEE/ION Position, Location and Navigation where he studied VLSI design. He
Symposium (PLANS). IEEE, 2023. continued his education at Cornell
[5] Kassas, Zak, et al. "Enter LEO on the GNSS stage: University and received his Ph.D. in
Navigation with Starlink satellites." (2021). electrical and computer engineering
[6] Neinavaie, Mohammad, et al. "First results of in 2004. In 2005 he joined the
differential Doppler positioning with unknown Starlink Aerospace Corporation where he leads efforts focused on
satellite signals." 2022 IEEE Aerospace Conference digital communications using software defined radios and
(AERO). IEEE, 2022. machine learning. He is active in developing and
[7] Hayek, Samer, et al. "Assessment of Differential promoting DevOps and MLOps practices, especially on
Doppler Navigation with Starlink LEO Satellite Signals systems with embedded devices.
of Opportunity." Proceedings of the 2023 International
Technical Meeting of The Institute of Navigation. 2023.
[8] Aitken, A. C. (1935). "On Least Squares and Linear
Combinations of Observations". Proceedings of the
Royal Society of Edinburgh. 55: 42–48.

16
Additional 3 dB from using both PSS and SSS is ‘held in reserve.’

10
Authorized licensed use limited to: Nanyang Technological University Library. Downloaded on March 10,2025 at 04:44:26 UTC from IEEE Xplore. Restrictions apply.
 Dr. Robert Nelson received a B.S.
in physics from UCSB, a Ph.D. in
physics from CU, Boulder, and
completed a postdoc at Caltech.
He joined The Aerospace
Corporation in 2013 where he has
performed novel geolocation and
alternative PNT studies. He is
currently an Associate Director
leading teams developing ontologies, database tools,
AI/ML tools, and several Digital Engineering efforts.
Samantha Romano received a
B.S. in electrical engineering
from Cal Poly SLO, and a M.S.
in electrical engineering from
ASU with a study in
electromagnetics and antenna
design. She joined The
Aerospace Corporation in 2020
in the Digital Implementation Dept implementing and
testing software defined radios and her interest includes
DSP, CubeSats, and phased arrays.
Ethan Sorensen is a third-
year electrical engineering
student at BYU. Though he has
not declared a specialization,
his recent studies have given
him a strong interest in
wireless communications.
Ethan recently finished an
internship with the Aerospace
Corporation where he focused on the development of
alternative PNT solutions and hopes to continue studying
and pursuing ideas in the space industry.

11
Authorized licensed use limited to: Nanyang Technological University Library. Downloaded on March 10,2025 at 04:44:26 UTC from IEEE Xplore. Restrictions apply.
Authorized licensed use limited to: Nanyang Technological University Library. Downloaded on March 10,2025 at 04:44:26 UTC from IEEE Xplore. Restrictions apply.
12