Satellite-5G Convergence: Non-Terrestrial Networks for Mobile Coverage

For thirty years “satellite phone” meant bulky handsets, $1/minute bills and a separate network. 3GPP Release 17 changed that. Non-Terrestrial Networks (NTN) now make a low-Earth-orbit satellite behave like just another 5G cell tower — with a 500 km cell radius, 7.5 km/s Doppler and 30 ms of unavoidable physics.

Satellite-5G convergence is no longer experimental. AST SpaceMobile, Lynk Global, Apple Globalstar, Iridium NTN and 3GPP-compliant LEO constellations from OneWeb and Starlink have all demonstrated direct-to-handset 5G NR. The challenge is no longer whether your phone can see a satellite, but how the 5G stack survives extreme delay, mobility and link budget. This article dissects the architecture, protocol adaptations, and hardware realities behind NTN.

1. From Afterthought to Standard: 3GPP NTN Timeline

NTN was formalized in two phases. Release 17 (frozen mid-2022) introduced NTN for two radio tracks: NB-IoT/eMTC NTN for massive IoT sensors and NR NTN for smartphones and broadband terminals in FR1 (S-band 2 GHz, L-band 1.6 GHz). Release 18 (5G-Advanced) added coverage enhancements, mobility optimization, and the commercial enabler for disaster roaming.

Key changes versus terrestrial NR were surgical but critical:

• SIB19: New system information broadcasting satellite ephemeris (position/velocity), epoch time, and validity timers so the UE can predict where the cell will be 10 seconds from now.
• Extended timers: HARQ disabling, increased t-Reassembly, ra-ResponseWindow and sr-ProhibitTimer to absorb 20-50 ms RTT.
• Timing Advance (TA) with GNSS: The UE must know its own position via GNSS and compute full TA autonomously: TA = 2 * (service_link_delay + feeder_link_delay).
• Doppler pre-compensation: UE adjusts uplink frequency by up to ±45 kHz (S-band LEO at 7.56 km/s) using broadcast ephemeris.

2. Architecture: Bent Pipe vs. GNB in Space

The reference NTN architecture reuses the full 5G system. The only question is where the gNB lives.

Transparent Payload (Today’s Reality)

Over 90% of 2025-26 deployments use transparent architectures. The satellite is a frequency-translating repeater: S-band uplink (1980-2010 MHz) is converted to Ku/Ka-band feeder downlink. The gNB, AMF and timing reference remain at the gateway. Advantages are simplicity and spectrum reuse — the same terrestrial 5G core handles NTN UEs with only software upgrades. The penalty is double-hop latency and feeder-link dependency: if the gateway is out of view, the cell collapses.

Regenerative Payload (The 2027+ Target)

Regenerative moves the DU — and eventually the full gNB — on board. Inter-satellite links (ISLs) route NG traffic optically between satellites until a gateway is reachable, creating a true space-based RAN. Airbus/Thales Alenia and SpaceX v2 satellites already fly prototype regenerative DU cards. The trade-off is thermal, radiation hardening, and on-board processing power: a space-grade DU must handle Doppler, handover and scheduling at <40W.

3. The Physics Bottleneck: Link Budget & Mobility

NTN breaks three assumptions terrestrial engineers take for granted.

Path loss: Free-space loss to LEO at 2 GHz and 600 km is ~154 dB vs 110-120 dB to a terrestrial tower. Even with a 30 dBi satellite phased array (64-256 elements) and UE Tx power of 23 dBm (Power Class 3), uplink SNR hovers at –3 to 5 dB. Solution: highly directional satellite beams (3-6° beamwidth, 30-50 km footprint) and narrowband UL grants. This is why early NTN services cap at QPSK, not 256-QAM.

Doppler: At 600 km, Doppler shift is ±45 kHz in S-band, shifting ~300 Hz/s as the satellite passes. The UE’s oscillator must pre-correct within ±0.1 ppm, using GNSS + ephemeris. Without it, the base station cannot decode PUSCH. For modem architects, this means the RF PLL and NCO must be continuously steered — a domain where tombstone crash analysis often reveals subtle GNSS-timing race conditions in NTN field tests.

Cell mobility: A LEO beam dwells over a user for only 2-4 minutes (earth-moving) or up to ~60 seconds with steering. Handovers are predictable — ephemeris tells the UE exactly when to switch satellites — but they are frequent. 3GPP Rel-18 introduces conditional handover with time/location triggers to avoid measurement gaps. Without optimization, an urban UE would perform 30-40 handovers per hour via satellite.

4. Protocol Surgery: What Changed in the Stack

NTN UEs run standard 5G NR with four critical adaptations:

1. RACH with large k-Offset: The network signals k-Offset and k-Mac to shift DL/UL slot alignment. Random access preambles include full RTT compensation so Msg2 doesn’t time out.
2. HARQ disabled: With RTT > HARQ RTT timer, Rel-17 allows harq-Disabled per process. Link adaptation relies on RLC ARQ and outer-loop BLER targeting instead.
3. Scheduling offsets: UL grants are scheduled far in advance. The UE applies K_offset × slot duration before transmitting.
4. Idle mode enhancements: SIB19 validity timers and satellite assistance let the UE camp without constant measurement.

Code: Decoding NTN Configuration

Below is a simplified view of SIB19 and RRC NTN-Config that an NTN modem parses. The ephemeris allows the UE to propagate satellite position without constant network signaling.

// SIB19 payload — broadcast every 160ms for NTN cell
ntn-Config-r17 ::= SEQUENCE {
  epochTime-r17          2026-09-06T12:00:00Z,
  ntn-UlSyncValidityDuration-r17  60s,
  ephemerisInfo-r17 SEQUENCE {
    ephemerisCommon-r17  PositionVelocity {
      positionX -2321819, positionY 4589021, positionZ 4123456 // ECEF meters
      velocityVX 7234, velocityVY -1211, velocityVZ -342  // m/s
    },
    epochTime-r17        same-as-above
  },
  ta-Common-r17          12.4 ms  // feeder + service common delay
  k-Offset-r17           32 slots,
  cellSpecificKoffset-r17 8 slots
}

// UE behavior: compute full TA and Doppler
ueServiceDelay = distance(ueGnssPos, satPos(epoch)) / c;
fullTA = 2 * (ueServiceDelay + ta-Common);
ulFreqPreComp = - dopplerShift(satVelocity, uePos) // up to ±46 kHz

From a security architecture perspective, SIB19 and ephemeris injection points become high-value spoofing targets. A forged ephemeris can force UEs to miscalculate TA and deliberately jam the uplink. This extends the mobile app sandboxing model down to the modem: baseband must validate GNSS + ephemeris consistency before transmitting.

5. Spectrum and Regulatory Realities

NTN operates in two spectrum strategies:

• Dedicated NTN bands (n255/n256): 1626-1660 MHz UL / 1525-1559 MHz DL (L-band) and 1980-2010 MHz UL / 2170-2200 MHz DL (S-band) carved from MSS. No terrestrial interference, but limited to 2×30 MHz. Used by Iridium, Globalstar and Thuraya partners.
• Terrestrial spectrum sharing: T-Mobile + Starlink and AST SpaceMobile propose using PCS G-block (1910 MHz) and 700 MHz from terrestrial licenses via Supplemental Coverage from Space (SCS). FCC approved SCS in March 2024; WRC-23 codified NTN identification.

The second model is transformative: your existing T-Mobile SIM can roam onto a satellite using its normal terrestrial band when out of coverage, with the terrestrial operator acting as anchor HPLMN. The modem reuses the same RF front-end — only baseband timing changes.

6. Use Cases Beyond “Bars in the Desert”

Disaster roaming: When terrestrial RAN is destroyed, NTN provides instant 5G Standalone coverage. 3GPP Rel-18 disaster NTN allows any NTN-capable UE to access a PLMN via satellite without commercial roaming agreements for 72 hours.

IoT-NTN: NB-IoT NTN sensors (logistics trackers, soil monitors, maritime buoys) connect via GEO/LEO with 10-year battery life, using 3.75 kHz subcarriers and 15 dB coverage extension. Starlink D2C and LacunaSpace already host millions of devices.

Automotive and aviation: Regenerative LEO with ISL offers <50 ms latency suitable for connected cars and inflight 5G picocells — a market terrestrial towers cannot serve.

Network resilience: Operators like Orange and NTT Docomo plan NTN as a 3rd resilience layer under terrestrial and fiber, guaranteeing at least messaging/MCS QoS nationwide.

7. Hardware and Security Implications

For device vendors, NTN support is now a modem checklist item. Qualcomm X75/X80, MediaTek M80 and Exynos Modem 5400 include NTN GNSS coupling, extended DRX for NTN idle, and additional NVRAM for ephemeris caching. RF front-ends add high-linearity LNAs for weak NTN downlink and must tolerate simultaneous GNSS + NTN reception without desense.

Security requires defense in depth. The 5G core authenticates NTN UEs identically (SUCI/AKA), but the broadcast nature of SIB19 demands signed ephemeris in Rel-19. Baseband isolation also matters: a compromised NTN modem driver must not escalate, which is where enforcement such as Android SELinux MAC policy for modem-to-AP interfaces becomes essential.

Power is the silent constraint. Continuous GNSS fixes for TA can drain 15-30 mW extra — a 6-10% hit to idle battery life. Vendors mitigate with GNSS duty-cycling, ephemeris prediction (valid for 60-300 s), and snapshot GNSS rather than continuous tracking. Thermal design for sustained 23 dBm NTN uplink also mimics Li-ion constraints under high duty-cycle transmission.

8. The Road to 6G-NTN Convergence

Rel-19 (expected late 2026) closes gaps: NTN handover without GNSS gap, 5 MHz narrowband NR-NTN for RedCap wearables, and uplink coverage enhancement via repetitions and DMRS bundling. 3GPP’s vision for 6G (Rel-21+) treats terrestrial and non-terrestrial as one fabric: a unified RAN where a UE transparently moves between gNB-on-tower and gNB-on-satellite with slice-aware routing.

Economics will decide pace. Launch cost per LEO satellite fell below $1,500/kg with Starship, making regenerative mega-constellations viable. But spectrum coordination — avoiding interference between earth-moving beams and terrestrial cells — remains a regulatory super-problem, especially for SCS shared bands.

The takeaway for mobile engineers: stop thinking of satellite as “alternative connectivity.” Within two release cycles, every 5G device will be NTN-aware, and every core will be satellite-ready. The convergence is happening in firmware, not in orbit.