Space – Daniel Estévez

Galileo OSNMA chain renewal

Galileo OSNMA (open service navigation message authentication) is a cryptographic system that is used to authenticate the navigation message (satellite ephemeris and clocks, etc.) in the Galileo GNSS. I have spoken before about OSNMA in this blog, since I implemented an OSNMA library in Rust a few years back. A good introduction to OSNMA for readers unfamiliar with how it works can be found in Bert Hubert‘s short series of OSNMA posts. The OSNMA system is currently in the public observation test phase.

On July 4, an OSNMA live test notification went out with the following message:

EVENT DESCRIPTION: USERS ARE ADVISED THAT, AS PART OF THE PUBLIC OBSERVATION TEST PHASE ACTIVITIES, A TESLA CHAIN RENEWAL IS PLANNED ON 2025-07-07 10:00 UTC AND THE TRANSITION WILL OCCUR ON 2025-07-08 10:00 UTC. THE TESLA CHAIN RENEWAL PROCESS IS DESCRIBED IN THE OSNMA SIS ICD (LINK).

NOTE THAT USER RECEIVERS SHALL PREVENT THE USE OF ANY CHAIN THAT HAS BEEN SUBJECT TO A RENEWAL PROCESS.

I have used the utilities from the Galmon project to record the Galileo INAV data received by a uBlox GNSS receiver that I have at home. This dataset can be used to test OSNMA implementations and to study how the chain renewal was done. The dataset is publised in Zenodo as “Galileo INAV data for OSNMA chain renewal test in July 2025“. In this post I study the chain renewal using my galileo-osnma Rust implementation.

Z-Sat VHF transmissions

Z-Sat is a microsatellite by Mitsubishi Heavy Industries that was launched in 2021. It is a demonstrator for multi-wavelength infrared Earth observation technologies. It carries an amateur radio payload that was coordinated by IARU and which consists of a BBS (bulletin board system) with a 145.875 MHz downlink and 435.480 MHz uplink. I have not been able to find more information about the amateur radio payload on this satellite.

Recently, Daniel Ekman SA2KNG asked me to analyze some transmissions by this satellite. Apparently it has recently begun to transmit a digital modulation, as shown in this SatNOGS observation, while it typically had transmitted CW telemetry in the past. The point where this started appears to be on 2025-06-20, as there is a SatNOGS observation of CW telemetry on that day followed by an observation of the digital modulation. In this post I analyze this digital modulation and explain what it is.

Time-dependent delay in GNU Radio

Since some years ago, a Doppler correction block has been available in gr-satellites. This block uses a text file that defines a time series of frequency versus time, and applies the appropriate frequency shift to each sample by linearly interpolating the frequency corresponding to the time of that particular sample. It can be used both to correct Doppler in a satellite propagation channel and other similar channels, as well as to simulate Doppler.

For some time I have been wanting to implement a similar block that applies a time-dependent delay to a complex baseband signal. The delay versus time would be defined by a text file in the same way as for the Doppler correction block. With this block, the delay of a satellite propagation channel can be simulated. It can also be used to correct the delay-rate of a satellite channel, which causes waveforms to be expanded or compressed in time due to a changing time-of-flight. This effect is known as code Doppler in GNSS, and as symbol frequency offset in general digital communications.

For accurate simulation of a satellite propagation channel, both the Doppler block and the delay block are needed, since the Doppler block accounts for the effects of variable time-of-flight on the RF carrier, and the delay block accounts for the effects on the band-limited modulation of the signal, by delaying its complex baseband representation.

I have now added a Time-dependent Delay block to gr-satellites. In this post I give a few details about its implementation and usage.

Decoding BGM-1 GMSK telemetry

In my previous post, I analyzed the Doppler of the Blue Ghost Mission 1 S-band telemetry signal during its lunar landing. The mission came to an end on March 16, as night fell on the landing site. During the 14 days that it has been operating on the lunar surface, BGM-1 has been transmitting low-rate GMSK telemetry on S-band at some times, and a high-rate signal on X-band at other times (this is said to be up to 10 Mbps DVB-S2), including some periods of no transmissions, presumably for thermal management.

In this post I will show how to decode the GMSK S-band telemetry signal with GNU Radio. I will use the IQ recording done by CAMRAS with the Dwingeloo 25 m radiotelescope during the landing as an example, since this dataset is publicly available.

The signal is 15360 baud GMSK, with the usual precoder that allows coherent demodulation as OQPSK (see Figure 2.4.17A-1 in the Radio Frequency and Modulation Systems CCSDS Blue Book). The coding is CCSDS concatenated coding with a Reed-Solomon interleaving depth of 4. The frame size is 892 bytes (4 times 223). The frames are CCSDS TM Space Data Link frames, but there is a bug in how the Reed-Solomon interleaving is implemented. The contents of the Space Data Link frames are encrypted, probably using CCSDS SDLS.

BGM-1 Doppler during the lunar landing

On Sunday March 2, Firefly Aerospace’s Blue Ghost Mission 1 successfully landed on Mare Crisium, becoming the first NASA CLPS mission to perform a fully successful lunar landing. Congratulations to all the team at Firefly for this huge achievement.

Both AMSAT-DL and CAMRAS covered this event live, by receiving the S-band beacon from the lander with the 20 m antenna in Bochum Observatory and the 25 m Dwingeloo radiotelescope respectively, and streaming the waterfall of the signal in YouTube.

In this post I do a quick analysis of the Doppler of the signal received at Bochum and Dwingeloo. Part of the goal of this is to try to answer a question of Jonathan McDowell, who asked if it was possible to determine the exact second of the touchdown from this data. The answer is that this is probably not possible, since for a soft touchdown there is no significant acceleration at touchdown that can be identified in the Doppler curve.

The raw IQ data recorded by AMSAT-DL is not publicly available. The data recorded by CAMRAS can be found here.

Decoding HYDRA-T

HYDRA-T is a PocketQube developed and operated by the Spanish start-up Hydra Space. It was launched on SpaceX’s Transporter 12 mission on January 12, and according to this news article (in Spanish), it is very similar to HADES-R, another PocketQube also launched in Transporter 12 and developed by Hydra Space and operated by AMSAT-EA, the Spanish amateur satellite society. While HADES-R is an amateur satellite that carries a transponder for amateur radio communications, HYDRA-T is a commercial satellite which according to the news article carries a payload from the 6G-XTREME CON-SAT project from Universidad Carlos III de Madrid related to 6G deployment.

Some days ago, people in the LibreSpace forums started noticing that HYDRA-T was transmitting telemetry on 437.780 MHz, which is a frequency that belongs to the amateur satellite service 435 – 438 MHz band. This was acknowledged by Félix Páez EA4GQS, who is AMSAT-EA’s president and Hydra Space Software and Satellite Operations Manager. Félix expressed that HYDRA-T should not be transmitting in this frequency even if it has a license to do so.

I could delve more and give my opinion about whether HYDRA-T can rightfully transmit on this frequency, specially given the fact that it is doing so under the Earth Exploration Satellite Service (active) allocation (see the frequency allocation tables from ITU, and the ITU Space Explorer entry for this satellite, which for some reason is listed there as HYDRA-A), which is a whole different usage from a telemetry downlink of a communications satellite. Maybe I will do this another time. In this short post I wanted to focus on the analysis of the short telemetry recording shared by Jan van Gils PE0SAT, and show the similarities between HYDRA-T and HADES-R, as well as previous satellites from AMSAT-EA, for which documentation of their telemetry format is publicly available.

Tianwen-1 second apoapsis raise

Some weeks ago I reported about an apoapsis raise manoeuvre done by Tianwen-1, the Chinese Mars orbiter. This has now happened again. Using state vectors from the telemetry decoded with the 20 m antenna in Bochum observatory by AMSAT-DL, we have detected an apoapsis raise manoeuvre done on 2025-01-08. This new apoapsis raise is much larger than the previous one. I have done the same kind of calculations as in the previous post, and also corrected a bug in my Keplerian elements plots (the periapsis and apoapsis passings were being paired incorrectly, which caused the SMA and eccentricity not to change in the plots I did in the previous post).

Tianwen-1 apoapsis raise

For a long time, AMSAT-DL has been using the 20 meter antenna in Bochum observatory to receive some telemetry from Tianwen-1, the Chinese Mars orbiter, almost daily. Since the telemetry includes the spacecraft’s state vectors, we can use this to monitor the spacecraft’s orbit. In 8 November 2021, Tianwen-1 entered its remote sensing orbit. This is an elliptical orbit with a period approximately 2/7 Mars sidereal days plus 170 seconds. This causes a ground track that is almost repeating, but drifts slowly to cover all the surface area of the planet.

I have been posting yearly updates about Tianwen-1’s orbit, the last of them this summer. In these updates, we can see that no manoeuvres have happened, and the changes in the Keplerian elements correspond to orbital perturbations caused by external forces. The orbit is in fact designed to cause the latitude of the periapsis to precess. In this way, all the surface of Mars can be scanned from low altitude.

Now we have some news. In the telemetry of the last few days we have detected that Tianwen-1 has raised its apoapsis radius from about 14134 km to 14489 km. All the data we have indicates that a propulsive burn has happened recently. In this post I give the details about this apoapsis raise manoeuvre.

Hera telemetry

In my previous post I spoke about the recording I made of the X-band telemetry signal of Hera with the Allen Telescope Array shortly after it was launched. Despite the lack of publicly available accurate ephemerides at the time of launch, I managed to track the spacecraft by hand and decode a good amount of telemetry frames. In this post I will do an in-depth analysis of the telemetry.

Decoding Hera

Hera is an ESA mission to the Didymos binary asteroid system. It will arrive there in December 2026 to study the asteroids and the effects of the impact of DART on Dimorphos. It was launched on October 7 from Cape Canaveral, exactly one week before Europa Clipper. In the same way as for Europa Clipper, Hera’s launch trajectory allowed me to track it with the Allen Telescope Array, starting approximately 90 minutes after launch.

However, the ephemerides publicly available when the launch happened turned out to be completely wrong, as I will explain below in more detail. I needed to find the spacecraft’s signal by moving the antenna in the blind, and continue tracking it by hand by tweaking the pointing every few minutes. For this reason, the quality of the recordings I have done is not so good. The signal drops down frequently as the spacecraft moves away from where I was pointing or when I made mistakes in my pointing adjustments.

For this reason, I have prioritized decoding the Europa Clipper recordings, since I expected that decoding these low quality recordings of Hera would take more work. Nevertheless I have managed to decode a good amount of telemetry.

I have published the IQ recordings made with the ATA in the following two Zenodo datasets: