Signal parameter estimation and demodulation of the OneWeb Ku-band downlink

Abstract

We present techniques for estimating key parameters of OneWeb’s Ku-band downlink signal (10.7–12.7 GHz) and reveal it as a single-carrier QPSK signal with a 230.4 MHz symbol rate. The techniques also estimate the signal’s roll-off factor and center frequencies. We further provide the first published account of OneWeb signal demodulation, revealing the basic frame structure of the downlink signal, including a synchronization sequence that repeats every millisecond and is common across all beams, channels, and satellites. Identifying this sequence enables making time-of-arrival measurements from OneWeb signals. These findings contribute to the growing body of research focused on repurposing low-Earth-orbit satellite communication signals for positioning, navigation, and timing.

Introduction

The rapid expansion of low-Earth-orbit (LEO) mega-constellations has enabled unprecedented global broadband coverage. These mega-constellations could also revolutionize the positioning, navigation, and timing (PNT) landscape by serving as a new source of signals for PNT¹. While their primary mission is usually broadband communication, there have been studies exploring the cost for a constellation operator adopting a fused communications-and-PNT service², and numerous studies on use of their signal for opportunistic PNT. LEO signals offer increased satellite visibility, enhanced geometric diversity³, and improved robustness through a greater variety of signals. Compared to traditional Global Navigation Satellite System (GNSS) signals, LEO communication signals provide significantly higher bandwidths and received power⁴. These advantages make repurposing LEO signals as a complement or backup to GNSS particularly appealing, especially amid rising threats of jamming and spoofing^5,6,7,8,9.

With over 600 LEO satellites, OneWeb is the second-largest LEO constellation after SpaceX’s Starlink¹⁰. Its polar orbits provide global coverage and are 15 times closer to Earth than GPS orbits. Moreover, its space-to-Earth link operates in the accessible 10.7–12.75 GHz band.

Exploiting LEO signals for PNT has been the focus of recent studies. Iridium’s potential for high dynamic applications using Doppler measurements was explored in ref. ¹¹. Starlink’s signal was used for Doppler-based positioning in ref. ^12,13, and carrier-phase-based positioning was demonstrated in ref. ¹⁴ using tones extracted from the signal that are no longer present in newer satellites. Recent surveys have studied integrating Non-Terrestrial Networks (NTNs) with current 5G and future 6G networks for localization systems¹⁵. Existing multi-constellation Doppler-based positioning results also reinforce the value LEO signals offer with their variety and geometric diversity^{16,17,18,19,20}. In most cases, these LEO signals are utilized as Signals of Opportunity (SoP), meaning the authors had no cooperation with the satellite operators, and only used publicly available information and the signal itself.

Compared to pseudorange-based PNT techniques, Doppler-based techniques have worse timing accuracy by many orders of magnitude (milliseconds vs. nanoseconds), even under optimistic measurement noise and satellite clock offset rate assumptions^3,21,22. Recognizing that many PNT applications of practical interest require accurate timing, we seek a characterization of OneWeb’s signal structure sufficient to enable pseudorange measurements, just as ref. ⁴ provided for Starlink. A recent paper has already demostrated pseudorange-based positioning with Starlink²³, framed as a fused service. Using knowledge published in this paper we were also able to achieve pseudorange-based positioning with OneWeb asa SoP²⁴.

References ^23,24 outline LEO PNT strategies that describe different levels of cooperation with the constellation operators and a priori knowledge about the signals and ephemerides dedicated, fused, network-aided opportunistic, and standalone opportunistic. The information revealed in this paper would already be known for a dedicated or fused PNT service, but would be invaluable fora network-aided opportunistic scenario ora standalone opportunistic scenario.

Prior research has identified key characteristics of OneWeb’s signals, including approximate center frequencies, channel bandwidths^25,26,27,28, and a 10-ms periodicity believed to be unique to each satellite beam^16,25. But beyond these basic observations, OneWeb’s signal remains undisclosed and unpublished, unlike Starlink’s signal, whose structure and parameters are documented in ref. ⁴. Indeed, the existing literature does not even identify OneWeb’s modulation scheme. In ref. ²⁵, the authors blindly detect the presence of modulation that repeats within the same satellite beam, but no demodulation is attempted. Furthermore, OneWeb’s Ku-band signal parameters have not been rigorously estimated, nor has any demodulated data been presented as in ref. ⁴. A detailed understanding of the signal structure, parameters, and synchronization sequences would enhance OneWeb’s potential as a PNT source and provide an analytical basis for assessing its limitations. This information is crucial to achieving our primary goal of harnessing OneWeb for positioning and timing through pseudorange-based methods.

We present a signal model for OneWeb’s Ku-band downlink, incorporating the identified modulation scheme and accounting for carrier frequency offset (CFO). Using established methods, we estimate the symbol rate and pulse shape roll-off, which are essential for demodulation. A typical Quadrature Phase Shift Keying (QPSK) demodulation processing chain is then applied to the signal. Analysis of the demodulated signal reveals that the 10-ms periodicity observed in prior studies may be merely a temporary consequence of the present low demand for OneWeb-provided data. We also identify a short synchronization sequence that repeats every 1 ms and is present on all satellites and beams.

To summarize, our paper offers three primary contributions. First, it provides a signal model for OneWeb’s Ku-band downlink and demonstrates how to estimate its key parameters. This process applies to all Gen 1 OneWeb satellites and likely to future versions as long as the signal remains single-carrier. Second, it identifies a synchronization sequence obtained by demodulating data from multiple satellites. The demodulation process further reveals that the 10-ms periodicity observed in prior studies is unlikely to be a permanent feature, as the data transmitted every 10 ms appear to be repeated default data. Finally, the paper shows how a local replica of the repeating modulation can be used to generate time-of-arrival (TOA) and Doppler measurements.

Signal capture

OneWeb’s roughly 650 satellites follow polar orbits at an altitude of 1200 km. Their downlink signal has approval for the 10.7–12.7 GHz space-to-Earth frequency band. A variety of commercially available user terminals (UTs) are available for OneWeb, with dual parabolic or flat panel designs. These would be ill-suited for our signal capture needs, as they do not provide access to the raw signal samples. Further, we would need to investigate the quality of the UT’s internal clock used for downconversion and sampling, or risk it having it skew any subsequent signal time stability analysis. Nonetheless, we can glean useful information from public OneWeb UT specifications, such as their being designed to support QPSK, 8PSK, and 16APSK modulation with a 250-MHz-wide channel spacing²⁹.

In light of the challenges of using a commercial UT, we opted to employ our own steerable 90-cm offset parabolic dish with an approximately 3-degree beamwidth. Using publicly available ephemerides from North American Aerospace Defense Command (NORAD) in the form of Two-Line Elements (TLEs), we can steer the dish to track OneWeb satellites overhead. Our antenna’s narrow beamwidth limits captures to a single satellite at a time. As we show later on, the satellites have a fixed beam, where the beam footprint moves with the satellite, as opposed to a fixed-cell approach like Starlink’s, where the beam is fixed to a cell on the ground.

Figure 1 outlines the hardware used to capture the raw IQ samples. Our parabolic dish is equipped with a feedhorn connected to a low-noise block (LNB) with a conversion gain of 60 dB and a noise figure of 0.8 dB. The LNB downconverts 10.7–11.7 GHz signals to 950–1950 MHz, or 11.7–12.75 GHz to 1100–2150 MHz. The antenna’s nominal gain is 40 dBi at 12.5 GHz, but suffers at least 4–5 dB of losses due to lack of circular-to-linear polarizer and feedhorn misalignment. The antenna is located on the campus of The University of Texas at Austin, with a clear view of the sky.

Fig. 1: Block diagram of the OneWeb signal capture process.

The K_u-band dish is equipped with a low-noise block which feeds the signal to a capture system allowing for narrow captures at 250 Msps or below, or for wide captures at 500 Msps.

The signal capture system allows selection between two capture modes: wide and narrow. The wide capture is a fixed 500 Msps, while the narrow capture is variable from 250 Msps and below. The downstream hardware then performs additional downmixing, bandpass filtering, and 16-bit complex sampling. Both the LNB and downstream downconversion and sampling hardware are locked to the same GPS-disciplined oven-controlled crystal oscillator (OCXO).

The usable bandwidth of the narrow capture varies depending on the sample rate, with a maximum of 200 MHz. The usable bandwidth of the wide capture is roughly 400 MHz. The capture system is capable of capturing on two channels at once, with the limitation that the sampling rate must be identical for the sampling to begin simultaneously. Such a setup is referred to as dual capture.

For single-carrier signals like OneWeb’s, the narrow captures are challenging or impossible to use for data recovery, but are useful for observing patterns in the signal structure. The wide captures produce roughly 2 GB/s of data, and are prone to overflow the host or device-side data buffers, resulting in dropped samples. As such, our hardware permits less than 10 s of continuous capture in that mode. For narrow captures, the device is capable of capturing for the duration a satellite is overhead.

Signal model

One might expect OneWeb to use orthogonal frequency division multiplexing (OFDM) given its proven success in space-to-Earth communications by Starlink, and its domination in wireless communications. Various sources, including a test report for one of the UTs²⁹, suggest OneWeb instead uses a single-carrier signal. Assuming the 250 MHz channel spacing specified in ref. ²⁹ for the Ku band, OneWeb could presumably have 8 channels over the 2 GHz Ku-band, as assumed in ref. ²⁵.

We claim, and later provide evidence, that OneWeb employs a Multi-Frequency Time Division Multiple Access (MF-TDMA) Single Carrier (SC) scheme on each of 8 separate frequency channels. The sections below outline the signal model for a SC QPSK signal, and subsequently the model of the received OneWeb signal.

QPSK signal model

Fundamentally, a SC signal is a train of pulses, each modulated by a phase and amplitude shift corresponding to the data symbol being transmitted on that pulse. The resulting continuous stream of symbols can be characterized by a simple signal model. The baseband signal model for a SC QPSK signal is given by

$$s(t)=\mathop{\sum }\limits_{m}\exp (j\pi {a}_{m}/2)p\,\left(\frac{t-m{T}_{\mathrm{sym}}}{{T}_{\mathrm{sym}}}\right)$$

(1)

where statistically independent symbol phases ${a}_{m}\in {{\mathbb{N}}}_{4}\triangleq \{0,1,2,3\}$ for $m\in {\mathbb{Z}}$ can be encoded to represent two bits per symbol, and T_sym is the symbol period. The symbol phase values ${a}_{m}\in {{\mathbb{N}}}_{4}$ will be referred to as symbols hereafter.

The pulse shaping function p(t) is left unspecified in (1). Our later signal parameter estimation shows that a square root raised cosine (SRRC) pulse nicely fits the OneWeb signals captured. Pulse shaping is essential to limit the excess bandwidth of the signal, for regulatory and interference purposes. Proper filtering of a pulse-shaped signal within the receiver can also reduce inter-symbol interference (ISI). Due to its popularity, we tested against the SRRC. The only parameter of note for the SRRC is its rolloff factor β_r, which is a measure of its excess bandwidth.

In a single-carrier MF-TDMA protocol, subsequences of symbols are structured in a hierarchy of slots, frames, blocks, etc. We will use the term slot to describe the smallest grouping of symbols that is self-contained in the sense that it includes one or more predictable symbol sequences that mark the beginning of a slot and allow synchronization to it. A slot contains data destined for a small number of users—typically a single user. A contiguous set of slots whose data appear to be correlated in some way will be called a frame.

Different standards outline how frames are constructed. DVB-S2, a popular standard for satellite digital broadcasting, defines base band (BB) frames constructed from a number of input streams time-multiplexed into a physical layer (PL) frame. If a given stream has no data, a default physical-layer frame is inserted, or if a BB frame is incomplete, it is padded. Going from a BB frame to a PL frame also involves appending parity bits and modulating the data based on some modulation and coding scheme. While this processing may provide some structure to the symbol stream, the signal as observed by a receiver will nevertheless follow the model in (1).

Received signal model

The transmitted signal passes through the LEO-to-Earth channel and through the receiver front-end and discretization process. It is affected by multipath fading, Doppler, delay, filtering, digitization, and noise. SATCOM studies conducted in the Ku-band with measurements filtered to 80 MHz indicate that delay spread is minor for receivers experiencing only light shadowing and not near other objects³⁰. We will treat the effect of delay spread as negligible, since in our case the open sky view provides a strong line-of-sight (LOS) component, with few if any multipath components entering our antenna’s narrow beam. Another study on dispersive delays in the Ku-band with a 200-MHz bandwidth receiver attributes a majority of the delay to atmospheric dispersion, and shows sub-millimeter delay³¹. Due to these findings, we adopt a simple additive white Gaussian noise (AWGN) model for the received signal’s noise.

The most pressing phenomenon to model is the Doppler effect. For appropriately low bandwidths and time durations, one often assumes a narrowband model, which treats the Doppler effect as a simple frequency shift³². Using definitions from ref. ⁴, let v_los be the magnitude of the LOS velocity between the satellite and a receiver, and β ≜ v_los/c be the carrier frequency offset (CFO) parameter, where c is the speed of light. The narrowband model requires that βF_symT_synch ≪ 1 for T_synch some interval over which we expect to maintain time synchronization, and for the symbol rate F_sym = 1/T_sym. For a LEO satellite with a large bandwidth like Starlink or OneWeb, the requirement is violated^4,33,34. Thus, a wideband model that accounts for Doppler compression/dilation of the modulation, manifesting as time scaling, is needed in addition to frequency shifting. Given this, our received baseband analog model is

$$\begin{array}{rcl}\begin{array}{lll}{y}_{{\rm{a}}}(t) & = & s\,((t-{\tau }_{0})(1-\beta ))\\ & & \times \exp \,(j2\pi \,[{F}_{{\rm{c}}}(1-\beta )-{F}_{{\rm{c}}{\rm{r}}}]\,(t-{\tau }_{0}))+w(t)\end{array}\end{array}$$

(2)

where F_c is the center frequency of the OneWeb channel, F_cr is the center frequency to which the receiver is tuned, τ₀ is the delay experienced by the signal along the least-time path from transmitter to receiver, and w(t) is complex-valued zero-mean AWGN whose in-phase and quadrature components each have (two-sided) spectral density N₀/2. It is important to note here that since β depends on the LOS velocity, it is time varying. Also, the satellite clock frequency error causes the same effect as LOS motion on CFO. To keep the model simple, we will lump the effects of satellite clock frequency error into the CFO parameter β unless otherwise indicated.

The final stage is discretization. The received signal passed through a low-pass filter h(t) with bandwidth F_h and sampled at a rate F_sr > F_h. As mentioned earlier, the useful bandwidth (3 dB) of our captured signals is roughly F_h = 200 MHz for the narrow capture, and F_h = 400 MHz for the wide capture. The signal is then quantized to 16 bits, and the resulting discrete-time signal is

$$y(n)={\int }_{-\infty }^{\infty }h(n/{F}_{\mathrm{sr}}-\tau ){y}_{{\rm{a}}}(\tau )\,d\tau ,\,n\in {\rm{{\mathbb{Z}}}}$$

(3)

At some stages of our processing, we further digitally low-pass filter the signal closer to the symbol rate F_sym for the wideband captures.

Signal parameter estimation

Three parameters must be known to reliably demodulate the signal. The symbol rate F_sym is most important, since any error in its estimate would strain a symbol timing recovery loop, leading to possible data loss.

Another important parameter is the rolloff factor β_r of the pulse shaping function. A receiver incorporates a matched filter to maximize the SNR, where the filter’s impulse response is the time-reversed pulse shape. If the rolloff factor is not accurately estimated, the matched filter will be suboptimal, leading to increased ISI. In practice, our low-multipath environment and frequency-flat (non-dispersive) channel render the effect of ISI negligible, thus errors in β_r will not significantly affect our demodulation.

The final parameter to estimate is the center frequency F_c of each channel. It is also not as consequential as F_sym since, from a receiver’s perspective, there are various techniques to blindly estimate a QPSK signal’s frequency offset. Estimators often lump together all the frequency shifting effects into a single value, corresponding to the exponent in (2), thereby compensating for Doppler before demodulation.

Exploiting signal cyclostationarity

To estimate the symbol rate, we exploit the cyclostationarity of the QPSK signal. There are numerous examples in the literature of exploiting cyclostationarity to identify periodicity in signals^4,35,36. Specifically, the cyclic autocorrelation (CA) function of a QPSK signal reveals its symbol rate^37,38,39.

The goal of CA analysis is to identify the hidden second-order periodicity in the signal. As an example, consider a simple sinusoid centered at f_c with additive noise. If the noise power is sufficiently high, it can be difficult in the time domain to identify whether the signal is present, let alone its periodicity. Yet observing the sinusoid’s spectrum using a Fourier transform can easily reveal the hidden first-order periodicity as impulses at ±f_c. Likewise, the CA function reveals the hidden second-order periodicity in an SC QPSK signal.

Let y(n) be the received signal described in (3). For now, assume β = 0 and F_cr = F_c. The autocorrelation function is defined as

$${R}_{y}(n,k)={\mathbb{E}}\,[y(n+k){y}^{* }(n)]$$

(4)

where $n,k\in {\mathbb{Z}}$, ${\mathbb{E}}[\cdot ]$ is the expectation operation, and y^*(n) is the complex conjugate of y(n). Since s(t) in (1) is a pulse train with statistically independent phase shifts a_m, $m\in {\mathbb{Z}}$, it follows that R_y(n, k) is periodic in n for certain values of k with a period equal to T_symF_sr. This makes y(n) cyclostationary and allows for its autocorrelation function to be expanded in a Fourier series as

$${R}_{y}(n,k)=\mathop{\sum }\limits_{\alpha \in {\mathcal{A}}(\xi )}{R}_{y}^{\alpha }(k)\exp (j2\pi \alpha n)$$

(5)

where ${\mathcal{A}}(\xi )=\{q/\xi :q\in {\mathbb{Z}}\}$. The particular set ${\mathcal{A}}({T}_{sym}{F}_{sr})$ contains the so-called cyclic frequencies. The Fourier coefficient ${R}_{y}^{\alpha }(k)$ constitutes the signal’s CA function.

Following the framework from ref. ⁴⁰ for discrete-time signals, we approximate ${R}_{y}^{\alpha }(k)$ as

$${\widetilde{R}}_{y}^{\alpha }(k)=\mathop{\mathrm{lim}}\limits_{N\to \infty }\frac{1}{N}\mathop{\sum }\limits_{n=0}^{N-1}y(n+k){y}^{* }(n)\exp (-j2\pi \alpha n)$$

(6)

When operating on a finite-length signal, N is assumed to be much larger than the cyclic period of the signal, and the signal is assumed to be long enough that y(N − 1 + k) is defined for all k values of interest.

Estimation of F _sym

We can now define an estimator for the symbol rate as

$${\widehat{F}}_{sym}=\arg \mathop{\max }\limits_{\widetilde{\alpha }\in {\mathcal{S}}}| {\widetilde{R}}_{y}^{\alpha }(0)|$$

(7)

where ${\mathcal{S}}$ is some constrained set of cyclic frequencies around the expected symbol rate, and $\widetilde{\alpha }=\alpha {F}_{sr}$ is scaled such that the search space is in Hertz. From a priori knowledge (e.g., observation of the signal’s spectrum and perusal of regulatory or commercial documentation), we can devise a narrow range of possible symbol rates over which to search.

In practice, our simplifying assumptions F_cr = F_c and β = 0 are not accurate, and this must be addressed. Note from the received baseband analog model in (2) that the exponential can be non-unitary when β ≠ 0 or F_cr ≠ F_c, but this will not affect the periodicity in the modulation and so will not affect ${\widetilde{R}}_{y}^{\alpha }(k)$ nor ${\widehat{F}}_{sym}$. On the other hand, for a nonzero β the modulation s(t − t₀) gets compressed or stretched as s((t − t₀)(1 − β)). This CFO time-scaling effect does change the periodicity—and therefore the observed symbol rate—of the received modulation.

To address this, we correct for the largest component of time scaling—the one due to LOS motion between the satellite and receiver—before performing symbol rate estimation. From the TLE satellite ephemerides and the known receiver location, we calculate the LOS velocity v_los, from which we estimate the motion-induced component of the CFO parameter as $\widehat{\beta }={v}_{los}/c$. We then resample the received signal at ${F}_{sr}(1-\widehat{\beta })$ to undo the motion-induced time scaling. This results in at most a few Hertz of error in the Doppler shift, and similarly negligible error in the time scaling. Note that this process does not compensate for CFO introduced by transmitter clock frequency error, which, as will be shown, leads to slight residual errors in the symbol rate estimate.

After correcting for time scaling as described, we estimated F_sym based on four captures from March and June 2024. Fig. 2 shows the CA function (6), with N equal to the number of samples in 1 ms of data and k = 0, for each of the four captures. Peaks range from 230.399875 to 230.400180 MHz. Using only 1 ms of data instead of an infinitely long signal causes the peaks to present with finite width. The variance in the location of the peaks is due primarily to transmitter clock frequency error. The peaks are centered around 230.4 MHz to within about 200 Hz, from which we conclude that F_sym = 230.4 MHz.

Fig. 2: Cyclic autocorrelation function of four captures with k = 0.

The horizontal axis coordinate is $\widetilde{\alpha }=\alpha {F}_{sr}$. Peaks range from 230.399875 to 230.400180 MHz.

Resampling

Resampling wide-capture signals at an integer multiple of F_sym facilitates symbol synchronization and demodulation. Recall that for wide-capture signals, the original signal is lowpass filtered to F_h < F_sr and sampled at F_sr > F_sym. Resampling to some F_s < F_sr proceeds by first applying a polyphase anti-aliasing filter at a new lower F_h≥F_sym followed by uniform resampling at F_s. The useful frequency content of the signal is reduced due to the filtering, but what is removed is either noise or adjacent channels, which are not of interest. For what follows, we resample wide captures at twice the symbol rate, going from F_sr = 500 Msps to F_s = 2F_sym = 460.8 Msps.

Narrow-capture signals are only used in this paper for long-duration correlation analysis, for which no resampling was required.

Symbol and carrier frequency synchronization

With F_sym known, one can proceed with carrier frequency and symbol synchronization. This is done with the resampled wide-capture signal. Carrier frequency synchronization proceeds in two steps, coarse CFO compensation followed by phase tracking. Coarse compensation can adopt the method from Sec. IV-B in which TLEs are used to wipe off the expected motion-induced frequency shift. But this method does not compensate for any offset F_cr − F_c from the receiver’s center frequency to the true channel center frequency, and ignoring this offset may strain the carrier phase tracking loop. Thus, a method such as ref. ⁴¹ is preferable for coarse CFO compensation. If, as demand increases, OneWeb adopts M-PSK with M > 4, one could extend the work in ref. ⁴², or rely on the method introduced in ref. ⁴³. For this paper, we applied the FFT-based estimatorin ref. ⁴¹, which is based on a periodogram of the mth power of the received signal, where m is the modulation order resulting in m = 4 for QPSK.

$${\Delta}{\widehat{f}}=\frac{{{F}}_{s}}{4N} \arg \mathop{\max}\limits_{{k}} \left|\mathop{\sum}\limits_{n=0}^{N-1}{y}^{4}(n)\exp(-j2{\uppi}{kn}/N)\right|$$

(8)

which estimates the frequency that maximizes a periodogram of the 4th power of the received signal.

After coarse CFO compensation, inspection of the samples rendered on the complex plane reveals a QPSK-like constellation, but with samples between the canonical symbol locations due to the non-unitary number of samples per symbol, and with residual constellation rotation over time due to imperfect frequency synchronization. To refine the frequency synchronization and thereby arrest the rotation, we apply a second-order phase-locked loop.

Having achieved frequency synchronization, we proceed to symbol synchronization. For this, we pass the signal through a symbol timing recovery loop to align to the pulse apex, then resample to one sample per symbol. We adopted decision-directed approach to symbol synchronization using the Mueller-Muller timing error detection method [ref. ⁴⁴, Chapter 8]. A preliminary decision on the mth symbol can then be made on each pulse-centered sample. The entire process is summarized by the block diagram in Fig. 3.

Fig. 3: Block diagram of signal processing chain.

The signal y(n) is processed into hard-decision estimated values where ${\widehat{a}}_{m}\in {{\mathbb{N}}}_{4}\triangleq \{0,1,2,3\}$ is the estimated value of the mth symbol’s QPSK phase shift.

Symbol demodulation is preliminary at this stage because it neglects matched filtering to the pulse p(t), which cannot yet be applied because the rolloff factor β_r remains unknown. Once the rolloff factor is estimated using the preliminary symbol estimates, as described in the following subsection, a second pass of the process in Fig. 3 is carried out, this time with symbol synchronization and detection aided by matched filtering, which reduces ISI and therefore improves symbol detection accuracy.

The process leading to symbol demodulation requires an entire channel to be present in the data; thus, only our wide captures are suitable. Figure 4 shows the successful result of symbol demodulation with matched filtering to p(t) after determination of β_r for 10 μs of data.

Fig. 4: Measured QPSK symbol values after Doppler correction and symbol synchronization with matched filtering to p(t) after determination of β_r.

The signal’s pre-correlation SNR is 10.35 dB.

Estimation of β _r

The rolloff factor β_r can be estimated based on the preliminary symbol estimates produced without matched filtering. Only the wide captures are suitable for this, as the narrow captures distort the pulse shape. Let the nth sample after resampling and coarse frequency compensation be denoted ${y}_{s}(n),\,n\in {\mathbb{Z}}$. Suppose we isolate a subset of samples $\{{y}_{s}(n):n\in {\mathcal{N}}\}$ for a given set ${\mathcal{N}}$ of contiguous indices. Following the steps depicted in Fig. 3, we obtain the preliminary hard-decision demodulated symbols $\{{\widetilde{a}}_{m}\in {{\mathbb{N}}}_{4}:m\in {\mathcal{M}}\}$, where ${\mathcal{M}}$ is the set of symbol indices corresponding to the sample indices in ${\mathcal{N}}$. We can then generate a local replica l(n; β_r), $n\in {\mathcal{N}}$ of the resampled-and-coarse-frequency-compensated signal by a discrete version of (1) with ${\widetilde{a}}_{m}$ substituted for a_m, $m\in {\mathbb{Z}}$, as a function of a candidate rolloff factor β_r for p(t). Defining a search space ${\mathcal{B}}$ of possible rolloff factors, we can determine which local replica best matches the original signal. Taking the objective function to be maximized as

$${Q}({{\beta}}_{{\rm{r}}})=\left|\mathop{\sum }\limits_{n\in {\mathcal{N}}}{y}_{s}(n){l}^{* }(n;{\beta }_{{\rm{r}}})\right|,$$

(9)

Our estimator for β_r thus becomes

$${\widehat{\beta }}_{{\rm{r}}}=\arg \mathop{\max }\limits_{{\beta }_{{\rm{r}}}\in {\mathcal{B}}} {Q}({\beta }_{{\rm{r}}})$$

(10)

Figure 5 shows the normalized objective function over β_r ∈ [0, 0.25]. The function is maximized for β_r ≈ 0.1. Setting ${\mathcal{B}}=\{0.25,0.2,0.15,0.1,0.05\}$, which are the values on this range allowed by the DVB-S2X standard⁴⁵, an extension of DVB-S2, we conclude that the OneWeb downlink rolloff factor is β_r = 0.1.

Fig. 5

The normalized objective function from (10) vs. β_r with correlation based on 1 ms of data.

Estimation of channel center frequencies

OneWeb is authorized to downlink in the 10.7–12.7 GHz Ku band⁴⁶. Taking into account the 250-MHz channel spacing mentioned in ref. ²⁹ and existing literature showing channelization²⁵, we suppose there are eight channels spaced 250 MHz apart within the 10.7–12.7 GHz band.

For channel center frequency estimation, we follow the same procedure outlined in ref. ⁴. For this, we exploit a synchronization sequence in the OneWeb signal that will be described later on. The sequence as transmitted repeats once per ms. We estimate the effect of time scaling on the received signal from a series of synchronization sequence time of arrival (TOA) measurements. From (2), one notes that time scaling is only a function of the CFO. From this, we obtain an estimate $\widehat{\beta }$ of the CFO parameter.

Next, we estimate the same CFO parameter from the exponent in (2) given an a priori estimate of the channel center frequency, denoted ${\overline{F}}_{ci}$. If the prior channel center frequency estimate is correct, then the offset ${\overline{F}}_{ci}-{F}_{cri}$ can be compensated, leaving the CFO as the sole effect on the frequency shift, expressed as F_d. We can estimate the CFO parameter from the frequency shift as $\overline{\beta }=-{F}_{d}/{\overline{F}}_{ci}$. With the two estimates $\widehat{\beta }$ and $\overline{\beta }$, we can then estimate the channel center in MHz as

$${\hat{F}}_{{\rm{c}}i}=\left\lfloor \frac{{\bar{F}}_{{\rm{c}}i}}{1+\bar{\beta }-\hat{\beta }},\right\rceil ,i=1,2,\ldots ,8$$

(11)

where rounding to the nearest MHz is justified for the same reasons given in ref. ⁴.

From this we conclude that the OneWeb downlink channels are centered at F_ci = (10.7 + 0.25(i − 0.5))GHz, i = 1, 2, …, 8. These are roughly aligned with Starlink’s channel centers as reported in ref. ⁴. We only observe activity on channels 2, 3, and 4 over Austin, Texas. The baseband signal model in (1) represents a single channel of the MF-TDMA signal from the transmitter.

Table 1 summarizes the parameter values for the OneWeb Ku-band downlink signal as found by applying the foregoing estimators.

Table 1 OneWeb downlink signal parameter values

Further system analysis

We can exploit our knowledge of the OneWeb downlink signal parameters and our ability to demodulate the signal to further probe OneWeb’s system behavior and data structure. In particular, we seek answers to the following questions: How are channels mapped to beams? What explains the 10-ms periodicity in OneWeb data noted in earlier studies? What can be revealed about the frame substructure? Do there exist any sequences that are invariant across frames, beams, channels, and satellites, as with Starlink’s PSS and SSS?

Channel activity

Figure 6 shows a composite power spectral density plot of three separate wide captures centered at F_c2, F_c3, and F_c4, showing activity on the three channels. We observe the channels regularly fade in and out of activity over ~20-s windows in such a way that no channel is continuously active. Activity on channels 2 and 4 is synchronous, whereas channel 3 is only active when the other two are not. This behavior is consistent with the spectrogram shown as Fig. 5 in ref. ²⁸. (Note that the channel indexing in ref. ²⁸ starts with what we designate as channel 2.)

Fig. 6: Overlaid power spectral density plots from wide captures centered at F_c2, F_c3, and F_c4.

Data are from ONEWEB-0696, ONEWEB-0352, and ONEWEB-0644 in July 2024.

Beam patterns

OneWeb downlink signals within a given channel exhibit some patterns that are observable even without knowledge of the signal parameters. One such pattern is the signals’ time-varying power, as shown in the top plot of Fig. 7. This variation in power is a result of the receiver being illuminated by different transmitter beams as the satellite passes overhead. OneWeb satellites can reportedly produce 32 user beams in the Ku-band, half of which are currently active for downlink ⁴⁷. These beams emanate from the satellite antenna array in a fixed pattern that projects a total footprint of roughly 1080 × 1080 km² on Earth’s surface. Assuming each of the 16 downlink beams covers approximately the same area, the footprint of each is roughly 68 × 1080 km².

Fig. 7

Top: normalized signal power for a single OneWeb channel. Colors indicate the intervals during which the receiver was within the footprint of an active beam. Bottom Left: Satellite ground track relative to the receiver location (lower vertex of the black triangle). Each arrow shows the movement of the sub-satellite point over the time interval with the corresponding color in the top plot. Thus, when the first recorded beam was passing over the receiver during the interval marked in red in the top plot, the sub-satellite point was entering Oklahoma. Bottom Center: Beam footprints (modeled as rectangular) at the time of the first peak, assuming the receiver is centered latitudinally within the 3rd of 16 beams. Colors indicate correspondence with the signal power time history. Bottom Right: Beam footprints at the time of the second peak, at which point the receiver is centered within the 5th beam. Data are for ONEWEB-0114 from a capture centered at F_c2 taken in March 2024.

Consider the power time history shown in Fig. 7, which lasts about 190 s. As the satellite moves overhead, the receiver is illuminated by successive beams, resulting in a power variation pattern similar to that observed in Fig. 5 of ref. ²⁵. For further analysis, we generate satellite positions using TLE ephemerides and manually align the center of the third beam’s footprint to our receiver location at the moment of the first peak in power (the capture began after the first two beams passed over the receiver’s location). Tracking the beam footprints for subsequent peaks makes it clear that every other beam of the 16 is inactive on a given channel. A reasonable explanation for this observation, and for the alternating channel activity noted above, is that OneWeb’s frequency reuse strategy activates successive beams on different channels. Thus, for the satellite whose data are shown in Fig. 7, one may reasonably assume that channels 2 and 4 are active on beams 1,3,…,15, whereas channel 3 is active on beams 2,4,…,16.

Data patterns across beams

For frames captured within approximately 20 s of each other, we find a repeating pattern of nearly identical demodulated symbols with a 10-ms period. This pattern is consistent with the 10-ms-spaced peaks in the signal’s autocorrelation function noted in ref. ^16,25. Such repetition implies a signal with low information content, which is clearly incompatible with a high-rate communication system. We suspect that near our receiver’s location in Austin, Texas, OneWeb currently has few customers, if any, and that, like the DVB-S2 standard, OneWeb’s protocol inserts default physical-layer frames when there is low demand for downlink data.

The 10-ms periodicity is connected to OneWeb’s fixed beams. This can be demonstrated by a narrow capture whose time span is long enough for data from at least two active beams to be present. First, we use TLE ephemerides to eliminate motion-induced CFO effects over the capture, as described in Section IV-B. Next we choose a 10-ms segment from somewhere within the capture. Call this a reference segment. We normalize the reference segment to have unit energy and cross-correlate it against the full capture. The resulting correlation profile reveals that the reference segment is only strongly correlated with an approximately 20-s window of the capture. By selectively choosing the reference segment to maximize the correlation within its window, and repeating this process for various reference segments, we can produce a composite plot like the blue, red, and violet traces shown in Fig. 8. The pattern that emerges matches the power profile over the capture, confirming that each active beam has a unique data pattern, as first reported in ref. ²⁵.

Fig. 8: Cross-correlation power of four different unit-energy-normalized 10-ms reference segments, extracted at the times noted by the respective circles, against the full un-normalized CFO-compensated capture.

The correlation peaks for reference segments taken at the maximum of each beam are approximately equivalent in magnitude, indicating uniform power across beams. The correlation peak of the gold trace is lower because the overall power of the captured data is reduced at the seam between beams. Data are from ONEWEB-0114 in June 2024.

To appreciate OneWeb’s frequency reuse strategy, consider a reference segment chosen at the moment when the receiver is equidistant from the latitudinal centers of two active beam footprints. If there is significant overlap in the active beam footprints, then this reference segment will be strongly correlated with the unique data pattern associated with both beams, albeit at a lower power for each beam than if it had been chosen at the center of that beam. This is in fact exactly what we observe, as shown by the gold trace in Fig. 8. Clearly, there is considerable overlap between active beams even when only every other beam is active on a given channel. This explains why OneWeb does not allow adjacent beams to be active on the same channel despite such a policy reducing the system’s area spectral efficiency. Each beam pattern would have to be significantly sharper in its power rolloff to allow each beam to carry all channels without significant inter-beam interference.

Frame structure

OneWeb’s simultaneous operation of single-carrier signals in multiple channels constitutes a MF-TDMA scheme. In such schemes, it is typical for a controller to devise a terminal burst time plan (TBTP) to efficiently transmit data to each UT, possibly in response to requests from the UTs on the uplink side. The downlink stream is divided into frames within which each user is assigned one or more time slots to receive data, per the TBTP. Guard intervals filled with predictable data are typically inserted as a preamble within each slot to facilitate slot identification and continual time and frequency synchronization.

The signal demodulation process depicted in Fig. 3, including matched filtering to the SRRC pulse p(t), produces a sequence of symbol estimates. Let ${\widehat{a}}_{m}\in {{\mathbb{N}}}_{4}$ denote the mth symbol estimate for a given satellite, and let ${\boldsymbol{a}}=({\widehat{a}}_{m}:m\in {\mathcal{M}})$ denote the vector of symbol estimates with sequential indices for some set ${\mathcal{M}}\subset {\mathbb{Z}}$ of contiguous indices. By examining such sequences for different ${\mathcal{M}}$ and different satellites, we can identify patterns that reveal the fundamental structure of the OneWeb signal, including repeating sequences.

In view of the strong 10-ms periodicity observed in the estimated symbols across all satellites, we define the frame period T_f to be 10 ms, or N_f = 2304000 symbols. Key questions are the following: (1) Within the same beam, what fraction of the N_f symbols repeat from frame to frame? (2) Are there frame sub-segments that are common across all beams of the same satellite? (3) Are there such sub-segments common across all satellites?

Our approach to addressing these questions proceeds as follows. For a given satellite and beam, we process N frames’ worth of wide-capture samples collected near the latitudinal center of the beam through the decoding pipeline in Fig. 3 to produce a sequence of symbol estimates. One can think of these data as having been collected near one of the peaks shown in Fig. 8. Initially, there is no basis by which to define the beginning of a frame, so we arbitrarily select the first N_f symbols and declare these to be the first frame, etc. Let ${{\boldsymbol{a}}}_{n}=({\widehat{a}}_{m}:m\in {{\mathcal{M}}}_{n})\in {{\mathbb{N}}}_{4}^{{N}_{f}}$ denote the vector of estimated symbols over the nth frame, with ${{\mathcal{M}}}_{n}=\{(n-1){N}_{f}+1,(n-1){N}_{f}+2,\ldots ,n{N}_{f}\}$, and let a_n(m) denote the mth element of a_n, with $m\in [1,{N}_{f}]={{\mathcal{M}}}_{1}$.

Taking advantage of the strong frame-to-frame correlation evident in Fig. 8, we correlate a_n, n ∈ {2, 3, …, N} against a₁ to verify that the frames are mutually aligned with no extraneous or missing symbols in any frame. We then compute the consensus frame $\overline{{\boldsymbol{a}}}\in {{\mathbb{N}}}_{4}^{{N}_{f}}$ for the capture, whose mth element $\overline{{\boldsymbol{a}}}(m)$ is the mode of the set {a₁(m), a₂(m), …, a_N(m)}.

At this point, we can compare each frame symbol-by-symbol against $\overline{{\boldsymbol{a}}}$. We define the agreement ratio R_m as

$${R}_{m}=\frac{1}{N}\mathop{\sum }\limits_{n=1}^{N}{\bf{1}}({\boldsymbol{a}}(m)={\overline{{\boldsymbol{a}}}}_{n}(m)),\,m\in {{\mathcal{M}}}_{1}$$

(12)

where 1(x) is the indicator function, equal to 1 when x is true and otherwise 0. We assume that frames may contain synchronization sequences or default payload data having perfect frame-to-frame agreement. We denote the index set for these by ${\mathcal{S}}\subset {{\mathcal{M}}}_{1}$. We further assume that frames may contain payload data, identified by the index set ${\mathcal{P}}\subset {{\mathcal{M}}}_{1}$, whose values are independent and uniformly distributed over the domain of a_m (which is ${{\mathbb{N}}}_{4}$ for QPSK). Finally, we assume that frames may contain intermediate-type data, identified by the index set ${\mathcal{I}}\subset {{\mathcal{M}}}_{1}$, that are neither perfectly constant nor perfectly random from frame to frame. We assume these three sets are exhaustive so that ${{\mathcal{M}}}_{1}={\mathcal{S}}\cup {\mathcal{P}}\cup {\mathcal{I}}$.

In a noise-free scenario, R_m = 1 for $m\in {\mathcal{S}}$, and R_m ≈ 0.25 for $m\in {\mathcal{P}}$, assuming QPSK modulation and large N. Under the AWGN signal model (2), and assuming large N and perfect phase and symbol synchronization (conditions of coherent detection), R_m ≈ 1 − P_e for $m\in {\mathcal{S}}$, where P_e is the symbol error rate, which can be calculated based on SNR and F_sym⁴⁸.

Another useful analytical metric is the frame mismatch rate M_n, or the fraction of symbols in a_n that fail to match the corresponding symbols in $\overline{{\boldsymbol{a}}}$:

$${M}_{n}=\frac{1}{{N}_{{\rm{f}}}}\mathop{\sum }\limits_{m=1}^{{N}_{{\rm{f}}}}{\bf{1}}({\boldsymbol{a}}(m)\,\ne \,{\bar{{\boldsymbol{a}}}}_{n}(m))$$

(13)

Figure 9 presents exemplary results for a capture with SNR = 10 dB and N = 100. The top plot indicates near-unity R_m, $m\in {{\mathcal{M}}}_{1}$ except for short bursts spaced by 1 ms during which R_m falls to near 0.25. Each burst lasts approximately 25 μs and contains a 2-μs subinterval over which R_m is again approximately unity. The frame mismatch rate M_n, shown in the bottom plot, hovers around 0.02, meaning that about 98% of the symbols in a contiguous set of frames agree with the consensus frame. This may be compared with P_e = 5.8 × 10⁻³, the symbol error rate corresponding to SNR = 10 dB under the AWGN model. Clearly, contiguous frames are highly similar, but there exists some systematic disagreement between them that is not due merely to AWGN. Similar results were obtained for other captures analyzed.

Fig. 9

Top: Agreement ratio R_m for $m\in {{\mathcal{M}}}_{1}$ over a 10-ms capture. The ratio has been smoothed by a 10-sample moving average for visual clarity. Bottom: The frame mismatch rate M_n for n ∈ {1, 2, …, 80}. Data are for a capture with SNR = 10 dB from ONEWEB-0394 in June 2024.

Based on these results, we can develop a basic model of OneWeb’s frame structure. According to this model, shown in Fig. 10, a 10-ms frame spans 10 1-ms slots, each consisting of a header and a payload. The header, which corresponds to the 1-ms-spaced intervals of mostly low agreement ratios shown in the top plot of Fig. 9, contains a synchronization sequence and other information unique to each slot. The synchronization sequence occurs at approximately the midpoint of the header and corresponds to the brief 2-μs subinterval over which R_m is approximately unity. The synchronization sequence will be detailed in a later section. The payload typically contains unique downlink data destined to one or more users. But when no active users are present, it is filled with data from a sequence of default payloads.

Fig. 10

A 10-ms frame spans 10 1-ms slots each consisting of a header and a payload.

For further discussion of header and payload properties, it will be convenient to introduce some additional notation. Let h_sfbci and p_sfbci, respectively, be vectors containing the header and payload symbols for slot s of frame f of beam b on channel c of satellite i. Also, let ${{\mathcal{F}}}_{bci}(k)$ be the set of frame indices transmitted by the bth beam on the cth channel of the ith satellite for the kth default payload constancy window, defined as the time interval over which default payload remains constant. The kth default payload ${{\boldsymbol{d}}}_{bci}(k)=({{\boldsymbol{p}}}_{1fbci}(k),\,{{\boldsymbol{p}}}_{2fbci}(k),\,\ldots ,\,{{\boldsymbol{p}}}_{10fbci}(k))$ spans a full frame and is identical for all $f\in {{\mathcal{F}}}_{bci}(k)$. However, the slot-level payloads are different from one another (p_sfbci(k) ≠ p_lfbci(k) for s ≠ l). Moreover, the default payload is different from beam to beam (d_bci(k) ≠ d_lci(k) for b ≠ l), different from channel to channel (d_bci(k) ≠ d_bli(k) for c ≠ l), and different from one constancy window to another (d_bci(k) ≠ d_bli(l) for k ≠ l).

Our observation has been that the default payload constancy window lasts approximately one hour. During this time, the default payload for beam b on channel c of satellite i is identical to that for all other satellites on the same beam and channel (d_bci(k) = d_bcl(k) ≜ d_bc(k) for i ≠ l). Our estimate of the default payload constancy window duration was obtained by capturing data from corresponding beams of many satellites over a 2-h interval. Although our antenna can only point to a single satellite at one time, and requires some time to switch between them, we conjecture that each d_bc(k) remains constant because it was found to be so for each satellite tracked during the kth window. Three constancy windows were observed during the 2-h interval, two partial and one complete.

Reference ²⁴ exploits the default payload by demodulating only a single frame’s worth of data and using a portion of that as a local replica. This allows TOA and FOA measurements to be made with only a single frame of data per beam.

Synchronization sequence

Discovery of the default payload d_bci(k) is significant for opportunistic use of OneWeb signals. When known, it enables long-duration correlation and thus high processing gain. But it must be noted that opportunistic use of the default payload is complicated by the need to re-estimate d_bci(k) for each beam b, channel c, satellite i, and constancy window k. Moreover, d_bci(k) is only continually present when the OneWeb network is unburdened. In environments where users are highly active, d_bci(k) will be only intermittently present or absent altogether.

Thus, it would be of great value to discover a symbol sequence within the OneWeb data that is invariant across slots, frames, beams, channels, and satellites, as is true for Starlink’s PSS and SSS⁴. Such invariance would make the sequence especially useful for correlation against OneWeb signals in cold-start conditions, and in high-data-rate-demand environments where the default payload is not present. Moreover, it would constitute an unambiguous feature in the OneWeb data stream relative to which an evolving frame structure model could be referenced.

To avoid confusion with the default payload, finding such a sequence requires correlation of frame-length estimated symbol vectors across beams, channels, and satellites. Let ${\overline{{\boldsymbol{a}}}}_{bci}$ be a length-N_f consensus frame for beam b on channel c of satellite i. Circularly correlating this against similar consensus frames from different beams, channels, and satellites reveals peaks spaced by N_f/10 samples, or one slot length. Aligning a large number of diverse consensus frames to the nearest slot and then calculating an agreement ratio R_m, $m\in {{\mathcal{M}}}_{1}$, what emerges are short 400-symbol (~2-μs) bursts of near-perfect agreement spaced by 1 ms. We call this sequence of symbols the OneWeb synchronization sequence (SS). The SS resides at approximately the midpoint of each slot’s header. In Fig. 9, it is visible in the top panel’s inset as the short subinterval over which R_m ≈ 1.

To verify the SS’s invariance, we correlated it against Doppler-corrected narrow captures that were not involved in its initial identification. The verification data encompassed narrow captures from diverse beams, channels, and satellites across various days in June 2024. In all cases, we found strong correlation against the candidate SS and so consider it verified.

We provide the SS in the form of an 800-bit hexadecimal number q_ss in which each pair of bits represents a symbol:

$$\begin{array}{lll}{q}_{\mathrm{ss}}&=&{\mathtt{B}}{\mathtt{5}}{\mathtt{D}}{\mathtt{0}}\,{\mathtt{CDB}}{\mathtt{5}}\,{\mathtt{66}}{\mathtt{F}}{\mathtt{9}}\,{\mathtt{5}}{\mathtt{A}}{\mathtt{93}}\,{\mathtt{F}}{\mathtt{90}}{\mathtt{B}}\,{\mathtt{0060}}\,{\mathtt{834}}{\mathtt{E}}\,{\mathtt{073}}{\mathtt{C}}\\&&{\mathtt{9}}{\mathtt{EC}}{\mathtt{3}}\;{\mathtt{EAAA}}\,{\mathtt{D}}{\mathtt{425}}\,{\mathtt{C}}{\mathtt{677}}\,{\mathtt{93}}{\mathtt{B}}{\mathtt{0}}\,{\mathtt{EE}}1{\mathtt{F}}\,{\mathtt{993}}{\mathtt{C}}\,{\mathtt{5}}{\mathtt{CF}}{\mathtt{5}}\\&&{\mathtt{2}}{\mathtt{FFE}}\,{\mathtt{5839}}\,{\mathtt{CC}}{\mathtt{7}}{\mathtt{E}}\,{\mathtt{5170}}\,{\mathtt{FE}}{\mathtt{09}}\,{\mathtt{31}}{\mathtt{EF}}\,{\mathtt{33}}{\mathtt{CD}}\,{\mathtt{3}}{\mathtt{E}}{\mathtt{13}}\\&&{\mathtt{16}}{\mathtt{F}}{\mathtt{4}}\,{\mathtt{3}}{\mathtt{E}}{\mathtt{9}}{\mathtt{E}}\,{\mathtt{2}}{\mathtt{A}}{\mathtt{17}}\,{\mathtt{5}}{\mathtt{D}}{\mathtt{4}}{\mathtt{B}}\,{\mathtt{2}}{\mathtt{D}}{\mathtt{9}}{\mathtt{B}}\,{\mathtt{E}}{\mathtt{629}}\,{\mathtt{2}}{\mathtt{E}}{\mathtt{62}}\,{\mathtt{6386}}\\&&{\mathtt{B}}{\mathtt{994}}\,{\mathtt{6849}}\,{\mathtt{7811}}\,{\mathtt{5074}}\,{\mathtt{5930}}\,{\mathtt{417}}{\mathtt{E}}\,{\mathtt{3338}}\,{\mathtt{E}}{\mathtt{497}}\\&&{\mathtt{3}}{\mathtt{A}}{\mathtt{3}}{\mathtt{A}}\,{\mathtt{5}}{\mathtt{B}}{\mathtt{05}}\,{\mathtt{CFBD}}\,{\mathtt{5}}{\mathtt{A}}{\mathtt{8}}{\mathtt{F}}\,{\mathtt{669}}{\mathtt{D}}\,{\mathtt{9}}{\mathtt{D}}{\mathtt{31}}\,{\mathtt{EEB}}{\mathtt{8}}\,{\mathtt{B}}{\mathtt{48}}{\mathtt{C}}\\&&{\mathtt{B}}{\mathtt{7}}{\mathtt{E}}{\mathtt{2}}\,{\mathtt{2}}{\mathtt{DBA}}.\end{array}$$

Let m ∈ {0, 1, 2, …, N_ss − 1} be the symbol index within the SS, where N_ss = 400 is the number of symbols. The decimal value a_m obtained from the hexadecimal sequence is the symbol phase used in (1) to generate a QPSK signal.

$${a}_{m}=\left\lfloor \frac{{q}_{\mathrm{ss}}}{{4}^{m}}\right\rfloor \,\mathrm{mod}4$$

(14)

The formula in (14) extracts the mth symbol by first dividing q_ss by 4^m so that the desired bit pair occupies the two least significant bits after flooring. Taking the modulo 4 isolates this pair from all others. To ensure proper interpretation of (14), we provide the first eight values of a_m:

$$({a}_{0},\ldots ,{a}_{7})=(2,2,3,2,1,3,2,0)$$

The duration of the SS is T_ss = N_ss/F_sym = 1.73 μs, and its period is 1 ms. Curiously, we find that symbols at indices m = 10, 25, and 42 at times vary from SS to SS, whereas all others are invariant.

Conclusions

We have presented and applied a blind signal identification process to uncover key parameters in OneWeb’s Ku-band downlink signal. We further identified a synchronization sequence that can be used to passively exploit OneWeb signals for pseudorange-based positioning, navigation, and timing (PNT), and have proposed a model for the OneWeb frame structure. Moreover, we have discovered that when no active users are present, the OneWeb symbol stream is identical across all satellites for corresponding beams and channels for a period of approximately one hour. The results in this paper illuminate a path to use of OneWeb signals as a backup to traditional GNSS for PNT. Further studies are needed to probe OneWeb’s timing stability and relationship to an absolute time scale such as GPS time.