Space · FSV-4 · Resilient LEO comms and alternative PNT
Beacon
A bearer of last resort. 288 satellites at 1,050 km. An authenticated position 19 dB above GPS in wide beam and 38 dB in a steered spot — and the orbital bearer that carries REVENANT MESH when a node has no neighbour left.
Mission
Two programmes that share the hard part
BEACON broadcasts an authenticated positioning, navigation and timing signal from an orbit where a ground jammer's geometry is far worse — and the same satellite is the fourth bearer of REVENANT MESH, the one that works when a node is alone.
Those are usually two separate constellations. They share a bus here because they share the expensive part: 288 satellites with L-band phased arrays, precise time, and optical crosslinks. Building either one alone wastes the other.
REVENANT MESH is peer-to-peer with no master node, and its bearers are radio-frequency line-of-sight, optical, and acoustic. All three require a neighbour. A soldier in a denied area, a submarine at periscope depth, a WRAITH in emission control, a POLTERGEIST in terminal flight — at some point every one of them is the only friendly node inside its horizon. BEACON is the bearer for that node, and the position source for it when GPS is gone.
Prior art, up front. We are not the first to propose alternative PNT from low Earth orbit. Iridium's time-and-location service has been fielded for over a decade and is genuinely far stronger than GPS; at least one commercial constellation is building for the same purpose now. What is new here is the constellation size, a cryptographically authenticated military signal, and the fact that the same satellite is a mesh router. A spec sheet that pretends this is unprecedented is a spec sheet a knowledgeable customer stops reading.
Key figures
The physics
Four independent reasons a LEO signal survives jamming and a MEO one does not
01 · Received power
GPS L1 C/A's specified minimum received power at the Earth's surface is −158.5 dBW. It is that weak because the satellite is 20,200 km up and free-space loss goes as the inverse square of range. BEACON is at 1,050 km. That is most of the argument, and it is not a design choice anyone can copy without moving their satellites.
| GPS L1 C/A | ~22,000 km slant · ~27 dBW EIRP · −158.5 dBW |
|---|---|
| BEACON, wide beam | 1,600 km slant · 21 dBW EIRP · −139.5 dBW — a 19.0 dB advantage |
| BEACON, steered spot beam | 1,050 km slant · 36.7 dBW EIRP · −120.1 dBW — a 38.4 dB advantage |
| Spot beam geometry | 1.2 m, 64-element array → 23.7 dBi gain, 9.1° beamwidth, a 167 km footprint. Concentrating 20 W into a theatre instead of a hemisphere buys 25 dB. |
| Operational translation | A jammer that denies GPS at 10 km must be 8.9× closer or 79× more powerful to deny BEACON's wide beam — and 83× closer or ~6,900× more powerful to deny a spot beam pointed at the theatre it is jamming. |
02 · Geometry and nulling
A ground jammer is, by definition, on the ground, so it arrives at low elevation. A controlled-reception-pattern antenna nulls by direction of arrival and an N-element array can null N−1 interferers — but only if it can afford to discard the satellites near those bearings.
With GPS you frequently cannot. Dropping the low-elevation satellites destroys the dilution of precision, because there are only eight to twelve in view and the geometry needs the spread. With BEACON, three to five satellites are above 45° elevation at any moment, so a null placed across the entire horizon below 20° costs nothing at all. The receiver can throw away the whole lower hemisphere and still fix.
And a BEACON satellite crosses the sky at about 0.35°/s at zenith. The constellation geometry is completely different within minutes, so a jammer optimised against the current geometry is mis-optimised against the next one, continuously, forever.
03 · Doppler
A GPS satellite's line-of-sight range rate peaks near 0.8 km/s — about ±4.2 kHz at L-band, changing at roughly 1 Hz/s. A BEACON satellite's peaks near 6.3 km/s — ±33 kHz, changing at up to 80 Hz/s. Two consequences, and the second is the important one.
Doppler as an observable. The Doppler curve of a single BEACON pass is itself a position measurement. This is Transit and Argos heritage, sixty years old and thoroughly proven: one pass yields a two-dimensional fix without decoding a navigation message and without four satellites in view. GPS structurally cannot do this, because its Doppler is seven times smaller and changes two orders of magnitude more slowly, so the geometry is too weak to invert. BEACON's fast geometry — a nuisance for the receiver designer — comes back as a fallback observable that survives when the navigation message does not.
Doppler as authentication. A stationary ground jammer or spoofer has zero Doppler and zero Doppler rate. A genuine BEACON signal has a large, rapidly changing Doppler that must be consistent with a valid orbital trajectory. A receiver that rejects any signal whose Doppler history does not fit an orbit discards every static spoofer for free. To defeat it, a spoofer has to fly, and fly a credible orbit-consistent profile. That is an enormous increase in the cost of the attack, and it falls out of the physics of the orbit rather than out of a protocol.
04 · Signal design freedom
GPS's signal structure is frozen by three decades of installed base. BEACON is a clean sheet, and the emission-control row below is the one GPS can never be retrofitted to have: GPS is a global always-on broadcast that an adversary can characterise at leisure from anywhere. BEACON can put PNT over a theatre and nowhere else.
| Chip rate | GPS L1 C/A 1.023 Mcps · BEACON 20.46 Mcps |
|---|---|
| Data rate | 50 bps · 250 bps |
| Processing gain | 43.1 dB · 49.1 dB (+6.0 dB) |
| Authentication | None on C/A · message authentication on all channels, spreading-code encryption on the protected channel |
| Frequencies | L1 / L2 / L5 · 1,575 MHz + 1,207 MHz dual-frequency ionospheric correction |
| Emission control | Always on, globally, forever · 16 steerable spot beams — PNT only where and when required |
| Total anti-jam advantage | ~24 dB over GPS L1 C/A in wide beam — a factor of 250 in required jammer power — and ~44 dB in a spot beam. |
The honest centre of the programme
The accuracy floor is orbit determination, not the signal
GPS works partly because medium Earth orbit is quiet: negligible drag, slow J2 rates, and satellites carrying caesium and rubidium standards good to one part in 10¹⁴. A 214 kg satellite at 1,050 km has neither luxury. Drag is non-negligible over years, J2 rates are far higher, and the clock is a miniature rubidium at roughly 3 × 10⁻¹³ per day.
Optical two-way time transfer across the crosslink mesh, to 100 ps — three centimetres of range equivalent — means a single satellite's clock does not have to be good. The network's time has to be good, and the constellation disciplines itself to a small number of nodes carrying real atomic standards.
Crosslink ranging determines the constellation's shape very precisely. And here is the problem: a constellation determined only by internal ranging is rank-deficient. The whole shape can rotate and translate without any internal range changing by a millimetre. Internal ranging alone cannot fix the datum, and any vendor claiming otherwise has not done the observability analysis.
The datum is restored by ranging to hardened ground reference transponders that stay radio-silent until interrogated, and — when those are unavailable — to three LANTERN-M satellites in the GNSS shell, whose orbits are quieter and independently determined. That is a real cross-domain dependency and we state it as one.
| Nominal, GNSS available for POD | 1.5 m |
|---|---|
| 24 h of full GNSS denial | 3 m |
| 7 days, crosslink-only POD | 12 m and degrading |
Specification
BEACON parameters
| BEACON-I | 240 satellites · 1,050 km · i = 76° · Walker Delta 240/20/1 · global coverage to ±70° |
|---|---|
| BEACON-P | 48 satellites · 1,050 km · i = 88° · 4 planes × 12 · polar and high Arctic |
| Satellites in view, 25° mask | 4.2 mean — four is the minimum for a three-dimensional fix plus time |
| Satellites in view, 15° mask | 7.8 mean; typically six to ten |
| Latitude bias | High latitudes see about 40% more than the equator — the opposite of every inclined GNSS shell, and the correct bias for where the Arctic fight is |
| Deployment | 288 × 214 kg = 61.6 t · about 60 per medium-lift launch · 5 launches |
| Replenishment | 41 satellites per year at a 7-year design life |
| Wet / dry mass | 214 kg / 206 kg (8 kg krypton) |
|---|---|
| PNT payload | 1.2 m deployable L-band phased array, 64 elements, 16 steerable spot beams + 1 wide beam |
| Transmit | 20 W L-band PA · 36.7 dBW EIRP spot, 21 dBW wide |
| Timing | Miniature rubidium at ~3 × 10⁻¹³/day, disciplined by optical two-way transfer to 100 ps |
| Crosslinks | 4 × optical, 10 Gbit/s — 2 in-plane, 2 cross-plane, 5,000 km maximum |
| Power | 1.9 kW BOL array, 1.55 kW orbit average |
| Propulsion | Krypton Hall, Isp 1,500 s, 550 m/s including a 211 m/s disposal reserve that operations cannot spend |
| Compute | REVENANT CORE — mesh routing, LEDGER signing, on-board orbit determination |
| Return link, node → satellite | UHF/L-band burst, 2.4 – 64 kbit/s. Over 20 dB of margin from a 1 W handheld with a 0 dBi whip, through foliage. |
|---|---|
| Forward link | L-band spot or wide beam; broadcast-only mode available |
| End-to-end latency | Under 200 ms globally, routed entirely on orbit |
| Ground infrastructure in the traffic path | None. The ground segment exists for management, not for traffic. |
| Degraded mode | Store-and-forward on crosslink partition. Latency goes from 200 ms to minutes. It does not go to infinity. |
The fourth bearer
What "last resort" actually means
No ground segment in the path. A message from a node in the Philippine Sea to a node on Guam transits satellite-to-satellite across optical crosslinks. There is no teleport to strike, no fibre to cut, no gateway to jam. Every other satellite communications architecture in the US inventory has a ground station in the middle of the traffic, and that ground station is a coordinate.
Receive-only emission control. A node can receive orders, PNT and mesh state while never transmitting. For a submarine at periscope depth, a soldier in a denied area, or a WRAITH holding emission control, that is the difference between silence and blindness — and it is a mode a two-way tactical radio structurally cannot offer.
Graceful degradation, not a cliff. If the crosslink mesh partitions, BEACON falls back to store-and-forward: a satellite collects a burst, carries it, and delivers it on a later pass. Latency goes from milliseconds to minutes. It does not go to infinity. That is the definition of a bearer of last resort — it gets worse, and it does not stop.
Every fielded Fantom node — VEIL on a soldier, PALL in a container, MARROW behind a squad, WRAITH in EMCON, LEVIATHAN at periscope depth, POLTERGEIST in terminal flight — carries a BEACON receiver as its final bearer and its final position source.
Concept of operations
Seven phases, and every degradation is announced
- Broadcast. Continuous wide-beam authenticated PNT plus mesh beacon. The default state, everywhere, all the time.
- Concentrate. On tasking, spot beams steer to a designated theatre and delivered power in that footprint rises about 17 dB above wide beam. Beam assignment across the constellation is solved on board.
- Route. Mesh traffic enters from a node's burst, transits the optical crosslink fabric, and exits at the destination node or gateway. No ground hop.
- Authenticate. Every PNT frame carries a signature chained to REVENANT LEDGER. A receiver that cannot verify the chain reports an unauthenticated fix and says so, loudly. A BEACON position is a signed assertion, not an inference.
- Degrade. On loss of GNSS, orbit determination falls back to crosslink ranging plus ground reference transponders, then to crosslink plus LANTERN-M, then to crosslink only. Each step is announced in the broadcast, so a receiver always knows which accuracy row it is living in rather than silently trusting a stale one.
- Partition. On loss of crosslink continuity, store-and-forward. Latency degrades; service does not stop.
- Dispose. The 211 m/s reserve — which on-board planning cannot spend — executes a controlled deorbit to a 250 × 1,050 km ellipse at end of life.
Engineering rationale
Why it is built this way
Why 1,050 km, and what it costs us
Altitude is the whole trade. Lower means a stronger signal and a worse constellation count; higher means fewer satellites and a weaker link. At a 15° mask, 1,050 km needs 288 satellites for a mean of 7.8 in view. Dropping to 600 km would improve the link by about 5 dB and require 621 satellites for the same coverage — more than double the constellation for a fifth of a decibel per satellite.
The price of 1,050 km is a decay time measured in centuries, and we pay it honestly: every satellite holds the full 211 m/s disposal reserve, never spends it on operations, and carries laser retroreflectors and a passive radar-augmentation corner so that a dead BEACON stays trackable even when it stops answering. That is mitigation. It is not a fix, and a 288-satellite constellation at that altitude is a real contribution to the debris environment.
Why the two missions share a bus
The expensive parts of a PNT satellite — a phased array, precise time, and a way to know exactly where you are — are the same expensive parts as a mesh router. A PNT-only constellation would carry crosslinks anyway, for time transfer and orbit determination. Once the crosslinks are there at 10 Gbit/s, refusing to route tactical traffic across them is leaving the capability on the table.
Why authentication is signed rather than encrypted
Encryption tells you nobody else read the message. Authentication tells you the message is what the sender sent. For PNT, only the second matters: the threat is a false position, not an overheard one. Chaining the frames to REVENANT LEDGER means a navigation solution can be audited after the fact — which is what you need when a weapon went where it went and somebody asks why.
Program candor
Open engineering and programme risks
- BEACON is a receiver programme as much as a satellite programme. The installed base dwarfs the space segment in both cost and schedule, and no amount of satellite performance fixes it.
- Spectrum is the schedule risk, not engineering. The critical path may well run through regulators rather than through a launch manifest.
- 1,050 km, 288 satellites, multi-century decay. A satellite that fails before its disposal burn is a permanent object. Retroreflectors and a radar corner keep it trackable; nothing makes it go away.
- The unauthenticated civil channel remains spoofable. Authentication protects the military channel. We should not imply otherwise and this page does not.
- The twelve-metre figure will get worse than twelve metres. It is a seven-day number, and nobody has ever flown a fully isolated crosslink-only orbit determination for seven days. Treat it as a design requirement with wide error bars.
- Constellation economics. 288 satellites at a seven-year life is forty-one replacements a year, forever. The programme's real cost is not the deployment. It is the annuity.
- Nothing has flown. The signal is a definition. The bus is a design. Prior art exists for LEO PNT in general and none of it is ours.
Related
What it anchors to, and what it carries
Assured PNT and resilient comms programs
Send us the jamming environment you actually fly in
Threat power, standoff, terrain, platform antenna and the accuracy you need to hold. We will run the link budget in front of you, including the cases where 24 dB is not enough.
Every figure on this page is a design target derived from first-principles analysis, not a measured result. Nothing has flown. The signal is a definition and the bus is a design. Where a number here is later measured and comes out worse, we will publish the measured number. No export-controlled information is published on this site.