S-0193 - Supplemental 193 - Passive Radar with Broadcast Illumination

Author: Patrick Luan de Mattos
Category Path: sdr-hacking
Audience Level: Advanced
Generated at: 2026-04-02T22:56:06.794Z

Supplemental Chapter: Passive Radar with Broadcast Illumination

193. Passive Radar with Broadcast Illumination

1) Position of this supplemental chapter in the advanced SDR roadmap

This supplemental chapter on Passive Radar with Broadcast Illumination assumes a strong foundation in advanced Software-Defined Radio (SDR) and Radio Frequency (RF) security concepts. It builds upon topics such as:

• Advanced Signal Processing: Fourier Transforms (FFT, DFT), correlation techniques, matched filtering, digital filtering, and noise reduction.
• SDR Fundamentals: Understanding of RF signal chains, sampling, quantization, digital down-conversion, and SDR hardware capabilities.
• RF Security Principles: Awareness of signal interception, electronic countermeasures (ECM), electronic support measures (ESM), and the principles of spectrum analysis.
• Basic Radar Principles: Familiarity with active radar concepts, including transmit/receive cycles, range and Doppler estimation.

This chapter delves into a more specialized and sophisticated application of SDR, requiring the ability to process and analyze complex signals without direct control over the illumination source. It is positioned at an advanced level, focusing on the theoretical underpinnings and practical implementation challenges of a covert or opportunistic sensing technique.

2) Deep conceptual explanation

Passive radar, also known as passive coherent location (PCL) or bistatic radar, is a radar system that exploits existing, non-cooperative illumination sources to detect and track targets. Unlike traditional active radar systems that transmit their own electromagnetic pulses, passive radar systems are "receivers-only." They rely on signals broadcast by third-party emitters, such as FM radio, digital television (DVB-T, ATSC), cellular base stations, or even satellite signals.

The core principle of passive radar with broadcast illumination lies in the correlation between two distinct signals:

1. The "Reference" Signal: This is a direct, unobstructed signal received from the illumination source. It serves as a clean, known waveform that captures the characteristics of the transmitted signal without any target interaction. This signal is typically received by a dedicated "surveillance" antenna, often placed in a location with a clear line of sight to the illuminator.

2. The "Surveillance" Signal: This is the signal received by a second antenna (or multiple antennas) that may have reflected off potential targets. This signal will contain the original broadcast signal, but it will also include echoes from targets, which will be time-delayed and Doppler-shifted relative to the direct reference signal.

By cross-correlating the reference signal with the surveillance signal, the passive radar system can identify and extract the delayed and Doppler-shifted components that correspond to target echoes. The time delay provides information about the target's range, while the Doppler shift reveals its radial velocity.

The "non-cooperative illumination sources" aspect is critical. It means the system doesn't require any cooperation from the broadcast transmitter. This offers several advantages:

• Covertness: The passive radar system itself does not transmit, making it virtually undetectable by traditional radar detection equipment.
• Cost-effectiveness: It leverages existing infrastructure, reducing the need for expensive dedicated transmitters.
• ECCM Resilience: It is inherently resistant to jamming directed at active radar transmitters, as it doesn't have one.
• Illumination Diversity: The availability of multiple broadcast sources can provide diverse illumination angles and frequencies, improving detection and tracking.

However, passive radar also presents significant challenges:

• Signal Complexity: Broadcast signals are often complex, modulated, and not designed for radar applications. Their characteristics (bandwidth, modulation scheme, power levels) can vary significantly.
• Synchronization: Precise synchronization between the reference and surveillance channels is crucial for accurate correlation.
• Interference: Broadcast spectrum is crowded, and interference from other emitters can degrade performance.
• Processing Demands: Extracting weak target echoes from strong direct signals requires sophisticated signal processing techniques, particularly high-performance correlation algorithms.
• Geometry: The bistatic geometry (separate positions of illuminator, target, and receiver) introduces complexities in range and Doppler calculations compared to monostatic radar.

3) Architecture and signal reasoning

A typical passive radar system with broadcast illumination comprises the following key components:

• Illumination Source: Any strong, continuous wave (CW) or modulated signal transmitter (e.g., FM radio station, DVB-T transmitter).
• Reference Antenna: A directional antenna with a clear line of sight to the illumination source. This antenna captures the direct, uncorrupted broadcast signal.
• Surveillance Antenna(s): One or more antennas designed to receive signals reflected from potential targets. These antennas are typically positioned to cover the surveillance area.
• RF Front-end (Receiver): High-performance, wide-bandwidth receivers for both the reference and surveillance channels. These receivers must be capable of capturing the broadcast signal with sufficient fidelity. Key components include low-noise amplifiers (LNAs), filters, and mixers for down-conversion.
• Analog-to-Digital Converters (ADCs): High-speed ADCs to digitize the received analog signals. The sampling rate must be at least twice the bandwidth of the broadcast signal.
• Digital Signal Processor (DSP): This is the "brain" of the passive radar system. It performs the critical signal processing tasks, including:
  • Digital Down-Conversion (DDC): Shifting the received RF signals to baseband or intermediate frequencies for easier processing.
  • Filtering: Removing unwanted interference and noise.
  • Cross-correlation: The core operation to compare the reference signal with the surveillance signal.
  • Range-Doppler Processing: Extracting range and velocity information from the correlated signals.
  • Target Detection and Tracking: Identifying potential targets and maintaining their tracks over time.
• Data Storage and Display: For recording processed data and visualizing detected targets.

Signal Reasoning (The Correlation Process):

Let $s(t)$ be the transmitted signal from the illuminator.

• Reference Signal ($r(t)$): This is the direct signal received by the reference antenna. Ideally, it's a clean replica of $s(t)$, possibly with some channel impairments:
  $r(t) \approx s(t - \tau_{ref})$
  where $\tau_{ref}$ is the propagation delay from the illuminator to the reference antenna.

• Surveillance Signal ($u(t)$): This signal received by the surveillance antenna consists of the direct signal plus echoes from a target:
  $u(t) \approx s(t - \tau_{dir}) + \sum_{i} s(t - \tau_{target,i}) e^{j \phi_{target,i}}$
  where $\tau_{dir}$ is the propagation delay to the surveillance antenna from the illuminator, and $\tau_{target,i}$ and $\phi_{target,i}$ represent the delay and phase shift introduced by the $i$-th target's echo, including Doppler effects.

The goal is to isolate the target echo components by removing the direct signal component from $u(t)$. This is achieved through cross-correlation. The cross-correlation function between the reference signal $r(t)$ and the surveillance signal $u(t)$ is defined as:

$R_{ru}(\tau) = \int_{-\infty}^{\infty} u(t) r^*(t - \tau) dt$

where $*$ denotes the complex conjugate.

If we assume for simplicity that the reference antenna is positioned such that $\tau_{ref} \approx \tau_{dir}$ (or we can compensate for the difference), and focus on a single target, the correlation will look something like this:

$R_{ru}(\tau) \approx \int_{-\infty}^{\infty} [s(t - \tau_{dir}) + s(t - \tau_{target})] r^*(t - \tau) dt$

If $r(t)$ is a good replica of $s(t)$, then $r(t-\tau)$ is a delayed version of $s(t)$. The integral will be maximized when the delay in $r^*(t-\tau)$ matches the delay in $s(t)$.

• The term $\int s(t - \tau_{dir}) s^*(t - \tau - \tau_{ref}) dt$ will produce a large peak when $\tau \approx \tau_{dir} - \tau_{ref}$. This corresponds to the direct path signal.
• The term $\int s(t - \tau_{target}) s^*(t - \tau - \tau_{ref}) dt$ will produce peaks when $\tau \approx \tau_{target} - \tau_{ref}$. These peaks correspond to the target echoes.

Crucially, the target echoes will be Doppler-shifted. This means the signal $s(t - \tau_{target})$ will be frequency-shifted due to the target's radial velocity. This Doppler shift will manifest as a shift in the location of the correlation peak in the frequency domain, or a variation of the correlation peak's position over time if processing in range-Doppler space.

Range-Doppler Map:

The processed output is often a Range-Doppler map. This is a 2D representation where:

• The x-axis represents range delay (derived from the time delay $\tau$).
• The y-axis represents Doppler frequency shift (derived from the frequency shift in the correlation).

The direct signal will appear as a strong peak at zero Doppler and a certain range delay. Target echoes will appear as weaker peaks at different range delays and non-zero Doppler frequencies.

4) Python examples when applicable

This Python example demonstrates the core concept of cross-correlation for target detection. It simulates a simplified scenario with a broadcast signal, a direct path (reference), and a delayed/Doppler-shifted echo from a target.

import numpy as np
import matplotlib.pyplot as plt
from scipy.signal import correlate

# --- Simulation Parameters ---
sampling_rate = 1e6  # Hz
duration = 1.0       # seconds
num_samples = int(sampling_rate * duration)
time = np.linspace(0, duration, num_samples, endpoint=False)

# Simulate a simple broadcast signal (e.g., a chirp or modulated signal)
# For simplicity, let's use a sine wave with a frequency sweep (chirp)
carrier_freq = 100e3  # Hz
sweep_rate = 50e3     # Hz/s
broadcast_signal = np.exp(1j * (2 * np.pi * (carrier_freq * time + 0.5 * sweep_rate * time**2)))

# --- Target Echo Simulation ---
target_range_delay = 1000  # meters (simulated)
speed_of_light = 3e8       # m/s
target_time_delay = 2 * target_range_delay / speed_of_light # seconds

# Simulate Doppler shift (target moving towards the receiver)
target_radial_velocity = 50  # m/s
doppler_freq = 2 * target_radial_velocity * carrier_freq / speed_of_light # Hz

# Apply delay and Doppler shift to the broadcast signal for the target echo
# Note: In a real scenario, Doppler affects the carrier frequency.
# Here, we are simplifying by shifting the entire signal's frequency.
# A more accurate simulation would involve modulating the original signal
# with exp(1j * 2 * pi * doppler_freq * time).
# For this example, we'll simulate the effect on the carrier.
# Let's re-create the broadcast signal with Doppler effect for the echo
echo_signal_base = np.exp(1j * (2 * np.pi * ((carrier_freq + doppler_freq) * time + 0.5 * sweep_rate * time**2)))

# Apply time delay to the echo signal
# This requires interpolation or padding for accurate delay.
# For simplicity, we'll shift indices, which is an approximation.
delay_samples = int(target_time_delay * sampling_rate)
if delay_samples < num_samples:
    echo_signal_delayed = np.zeros_like(echo_signal_base)
    echo_signal_delayed[delay_samples:] = echo_signal_base[:-delay_samples]
else:
    echo_signal_delayed = np.zeros_like(echo_signal_base) # Target is beyond observation window

# Add some noise to the surveillance signal
noise_level = 0.1
surveillance_signal = echo_signal_delayed + noise_level * np.random.randn(num_samples) + 1j * noise_level * np.random.randn(num_samples)

# --- Passive Radar Processing ---

# 1. Reference Signal: Direct path (idealized)
# In a real system, this is what the reference antenna receives.
# We'll use the original broadcast signal as our 'perfect' reference.
reference_signal = broadcast_signal

# 2. Surveillance Signal: Received by the surveillance antenna
# This is the signal that potentially contains target echoes.
# We'll add the direct path component to the surveillance signal as well,
# as the surveillance antenna also receives the direct broadcast.
# Let's assume a slight delay difference for the direct path in surveillance.
direct_path_delay_surveillance = 500 # samples (arbitrary, representing slight antenna placement difference)
direct_path_surveillance = np.zeros_like(broadcast_signal)
direct_path_surveillance[direct_path_delay_surveillance:] = broadcast_signal[:-direct_path_delay_surveillance]

surveillance_signal_with_direct = direct_path_surveillance + surveillance_signal
# Add more noise to the combined surveillance signal
surveillance_signal_with_direct += noise_level * np.random.randn(num_samples) + 1j * noise_level * np.random.randn(num_samples)


# 3. Cross-correlation
# Correlate the reference signal with the surveillance signal.
# The 'mode' parameter determines the length of the output.
# 'full' gives all possible overlaps.
correlation = correlate(surveillance_signal_with_direct, reference_signal, mode='full')

# The lags correspond to the time shifts between the two signals.
# The length of correlation is len(a) + len(b) - 1
lags = np.arange(-(num_samples - 1), num_samples)

# Convert lags to time delays
lag_times = lags / sampling_rate

# --- Analysis ---

# Find the peak of the correlation. This corresponds to the direct path.
peak_index_direct = np.argmax(np.abs(correlation))
direct_path_lag_samples = lags[peak_index_direct]
direct_path_estimated_delay = lag_times[peak_index_direct]

print(f"Estimated direct path delay (samples): {direct_path_lag_samples}")
print(f"Estimated direct path delay (seconds): {direct_path_estimated_delay:.6f}")

# To find target echoes, we often look for peaks *away* from the main direct path peak.
# This requires more advanced techniques like Range-Doppler processing.
# For this simplified example, let's conceptually show how a delayed/Doppler signal
# would appear in a correlation output if we were to analyze it differently.

# A more practical approach is to remove the strong direct path component first
# and then look for residual peaks.
# However, precise removal is tricky. A common method is to use the correlation
# result itself to estimate and subtract the direct path.

# Let's try to find peaks *other* than the main one.
# This is a crude approximation. Real systems use FFTs and coherent integration.

# Let's find the direct path peak and then look for other significant peaks.
# We'll filter out the strongest peak's vicinity.
correlation_magnitude = np.abs(correlation)
threshold_factor = 0.5 # Look for peaks that are at least 50% of the max peak
secondary_peak_indices = np.where(
    (correlation_magnitude > threshold_factor * correlation_magnitude[peak_index_direct]) &
    (np.abs(lags) > np.abs(direct_path_lag_samples) + 100) # Exclude immediate vicinity of direct path
)[0]

# This simplified peak finding is NOT how real passive radar works but illustrates the idea of
# finding secondary correlation peaks. Real systems use Range-Doppler processing.

print("\n--- Simplified Target Echo Detection (Conceptual) ---")
if len(secondary_peak_indices) > 0:
    # For a simple echo, we'd expect a peak related to target_time_delay
    # This simplified peak finding might not be accurate.
    print(f"Potential secondary peaks found at indices: {secondary_peak_indices}")
    for idx in secondary_peak_indices:
        lag_samples = lags[idx]
        lag_time = lag_times[idx]
        print(f"  - Lag: {lag_samples} samples ({lag_time:.6f} s), Magnitude: {correlation_magnitude[idx]:.2f}")
else:
    print("No significant secondary peaks detected with this simple method.")

# --- Visualization ---
plt.figure(figsize=(12, 8))

plt.subplot(3, 1, 1)
plt.plot(time, np.real(broadcast_signal[:num_samples]), label='Broadcast Signal (Real)')
plt.title('Simulated Broadcast Signal')
plt.xlabel('Time (s)')
plt.ylabel('Amplitude')
plt.grid(True)
plt.legend()

plt.subplot(3, 1, 2)
plt.plot(time, np.real(surveillance_signal_with_direct[:num_samples]), label='Surveillance Signal (Real)')
plt.title('Simulated Surveillance Signal (with direct path and echo)')
plt.xlabel('Time (s)')
plt.ylabel('Amplitude')
plt.grid(True)
plt.legend()

plt.subplot(3, 1, 3)
plt.plot(lag_times, np.abs(correlation), label='Cross-correlation Magnitude')
plt.axvline(direct_path_estimated_delay, color='r', linestyle='--', label=f'Direct Path Peak (~{direct_path_estimated_delay:.6f}s)')
if len(secondary_peak_indices) > 0:
    for idx in secondary_peak_indices:
        plt.axvline(lag_times[idx], color='g', linestyle=':', label=f'Secondary Peak ({lag_times[idx]:.6f}s)')
plt.title('Cross-correlation Result')
plt.xlabel('Lag Time (s)')
plt.ylabel('Correlation Magnitude')
plt.grid(True)
plt.legend()
plt.xlim([-0.001, 0.001]) # Zoom in on the main correlation lobe for clarity

plt.tight_layout()
plt.show()

# --- Conceptual Range-Doppler (Not fully implemented here) ---
# In a real passive radar, you would:
# 1. Segment the reference and surveillance signals into coherent integration intervals.
# 2. For each segment, compute the FFT of the reference signal.
# 3. For each segment, compute the FFT of the surveillance signal.
# 4. Perform frequency-domain correlation (multiplication by conjugate of reference FFT).
# 5. Perform Inverse FFT (IFFT) on the result to get range information for that Doppler bin.
# 6. Repeat for multiple Doppler bins or use a different approach to build the Range-Doppler map.

print("\n--- Conceptual Range-Doppler Processing ---")
print("Real passive radar systems would employ Range-Doppler processing.")
print("This involves FFTs on segments of the signals and frequency-domain correlation.")
print("The output is a 2D map showing target range vs. Doppler frequency.")
print("The direct signal appears at zero Doppler and a specific range.")
print("Moving targets appear as distinct peaks at non-zero Doppler frequencies.")

Explanation of the Python Example:

1. Simulation Parameters: Sets up sampling rate, duration, and time vector.
2. Broadcast Signal: A simplified chirp signal is generated. This represents the signal from the illumination source.
3. Target Echo Simulation:
   • target_range_delay and target_time_delay are calculated.
   • doppler_freq is calculated based on a simulated target velocity.
   • A new signal (echo_signal_base) is created with the Doppler-shifted carrier frequency.
   • This Doppler-shifted signal is then time-delayed to simulate propagation.
   • Noise is added to create a more realistic surveillance_signal.
4. Passive Radar Processing:
   • Reference Signal: The original broadcast_signal is used as the ideal reference.
   • Surveillance Signal: The echo_signal_delayed is added to a simulated direct path component received by the surveillance antenna (with a slight delay difference). More noise is added.
   • Cross-correlation: scipy.signal.correlate is used to compute the cross-correlation between the surveillance_signal_with_direct and the reference_signal.
5. Analysis:
   • The code finds the main peak of the correlation, which corresponds to the direct path signal.
   • A very simplified attempt is made to find secondary peaks by looking for significant correlation values away from the main peak. This is a conceptual illustration and not a robust target detection method. Real systems use Range-Doppler processing.
6. Visualization: Plots show the simulated signals and the resulting cross-correlation magnitude. The plot is zoomed to highlight the main correlation peak.
7. Conceptual Range-Doppler: A note explains that full Range-Doppler processing is the standard approach but is too complex for a simple script.

5) GNU Radio examples when applicable

Implementing a full passive radar receiver in GNU Radio is a significant undertaking due to the computational demands and the need for precise synchronization. However, we can illustrate the core correlation concept using a simplified flowgraph.

This example focuses on the cross-correlation block within GNU Radio. It assumes two input streams: one representing the "reference" and the other the "surveillance" signal.

Conceptual GNU Radio Flowgraph:

graph TD
    A[Signal Source 1 (Reference)] --> C{Correlate};
    B[Signal Source 2 (Surveillance)] --> C;
    C --> D[Magnitude Sink];
    C --> E[Complex Sink (Raw Correlation)];

Explanation of the Flowgraph Components:

• Signal Source 1 (Reference): This block would generate or load the reference signal. In a real system, this would be fed by a dedicated receiver chain connected to the reference antenna. For demonstration, it could be a pre-recorded waveform or a generated signal.
• Signal Source 2 (Surveillance): This block would generate or load the surveillance signal. This comes from the receiver chain connected to the surveillance antenna.
• Correlate Block: This is the core block from gr-analog (or other relevant modules). It computes the cross-correlation between its two input streams.
  • Input 0 (Signal A): Typically the reference signal.
  • Input 1 (Signal B): Typically the surveillance signal.
  • Mode: 'full', 'valid', 'same' (similar to NumPy's correlate). 'full' is usually preferred for initial analysis to see all overlaps.
  • Output: A complex stream representing the correlation result.
• Magnitude Sink: Displays the magnitude of the correlation output. Peaks in this plot indicate strong correlations.
• Complex Sink (Raw Correlation): Allows you to inspect the raw complex correlation output for further processing.

GNU Radio Block Parameters (Conceptual):

For the Correlate block (assuming it's available or implemented):

• Type: complex (for complex baseband signals)
• Mode: full (to capture all possible lags)
• Input 0 (Reference): Connect to your reference signal source.
• Input 1 (Surveillance): Connect to your surveillance signal source.

Python Implementation Snippet (Illustrative, assuming a correlate block exists):

# This is a conceptual snippet and not a runnable GR Python script.
# It shows how you might use a Correlate block.

from gnuradio import gr
from gnuradio import analog # Assuming Correlate block is here

class passive_radar_flowgraph(gr.top_block):
    def __init__(self):
        gr.top_block.__init__(self, "Passive Radar Flowgraph")

        # --- Parameters ---
        samp_rate = 1e6 # Example sample rate
        correlation_mode = gr.CORRELATE_FULL # Corresponds to 'full'

        # --- Blocks ---
        # In a real system, these would be actual receiver chains
        # For demo, using simple signal sources
        self.reference_source = gr.vector_source_c(reference_signal_data) # Load your reference signal
        self.surveillance_source = gr.vector_source_c(surveillance_signal_data) # Load your surveillance signal

        self.correlate_block = analog.correlate_cc(
            correlation_mode,
            1.0 # Scale factor (can be adjusted)
        )

        self.magnitude_sink = gr.blocks.float_sink() # For magnitude
        self.complex_sink = gr.blocks.complex_sink() # For raw output

        # --- Connections ---
        self.connect((self.reference_source, 0), (self.correlate_block, 0))
        self.connect((self.surveillance_source, 0), (self.correlate_block, 1))

        # Outputting magnitude for visualization of peaks
        self.connect((self.correlate_block, 0), (self.magnitude_sink, 0)) # Assuming correlate outputs complex, need to take magnitude
        # In a real flowgraph, you'd have a complex->magnitude block here.
        # For simplicity, let's assume magnitude is handled downstream or the sink does it.
        # A more proper way:
        # self.complex_to_mag = gr.blocks.complex_to_float() # Or similar
        # self.connect((self.correlate_block, 0), (self.complex_to_mag, 0))
        # self.connect((self.complex_to_mag, 0), (self.magnitude_sink, 0))

        # Connect to raw complex sink for debugging
        self.connect((self.correlate_block, 0), (self.complex_sink, 0))

# --- Running the flowgraph (conceptual) ---
# tb = passive_radar_flowgraph()
# tb.run()

Important Considerations for GNU Radio Implementation:

• Real-time Processing: Achieving real-time passive radar processing in GNU Radio is challenging. It often requires high-performance hardware (SDRs with high sample rates and bandwidth), efficient implementations (C++ blocks), and careful tuning.
• Synchronization: Precise synchronization between the reference and surveillance channels is paramount. This usually involves hardware synchronization or advanced software techniques.
• Range-Doppler Processing: A full Range-Doppler processor would involve multiple FFT blocks, complex multiplication (in the frequency domain), and IFFT blocks, making the flowgraph significantly more complex.
• Signal Acquisition: The vector_source_c is a placeholder. In practice, these would be connected to actual SDR hardware via blocks like osmosdr.source or uhd.usrp_source.

6) Visual examples when applicable

ASCII Signal Diagram: Correlation Peaks

This ASCII diagram conceptually illustrates the output of a cross-correlation function between a reference signal and a surveillance signal containing a direct path and a target echo.

Correlation Magnitude
        ^
        |
        |       * (Target Echo)
        |     /   \
        |    /     \
        |   /       \
        |  /         \
        | /           \
        |*-------------*--------- (Direct Path Peak)
        +------------------------> Lag Time / Delay
        |
        |

Explanation:

• The horizontal axis represents the time lag or delay between the reference and surveillance signals.
• The vertical axis represents the magnitude of the correlation.
• The broad, strong peak signifies the direct path signal. This occurs when the delay in the reference signal perfectly aligns with the direct path delay in the surveillance signal.
• The smaller, potentially distinct peak(s) represent target echoes. These occur when the delay in the reference signal aligns with the delayed and Doppler-shifted echo from a target. The position of these peaks indicates the target's range (relative to the direct path).

Bit Pattern Layout (Conceptual - Focus on Signal Structure):

This is not about actual bit patterns of digital modulation, but how the structure of the signal is perceived through correlation.

Imagine the broadcast signal as a unique "fingerprint" ($S$).

• Reference Signal: [... S ...]
• Surveillance Signal: [... S ...] (direct path) + [... S_delayed_Doppler ...] (target echo)

When you correlate Reference with Surveillance:

Reference:     [... S ......]
Surveillance:  [... S ... S_delayed_Doppler ...]

The correlation process effectively "slides" the reference signal over the surveillance signal and measures similarity.

Correlation Process:

Lag 0:
Reference:     [... S ......]
Surveillance:  [... S ... S_delayed_Doppler ...]
               ^
               | Strong match here (Direct Path)

Lag 'T_target':
Reference:     [... S ......]
Surveillance:  [... S ... S_delayed_Doppler ...]
                          ^
                          | Potential match here (Target Echo)

The output is a series of values representing the "similarity" at each lag. Peaks indicate where the structures align.

Flow Illustration: Bistatic Geometry

      Illuminator (e.g., TV Tower)
         /|\
          |
          |  (Broadcast Signal)
          |
  -----------------
  |               |
  |               |
  |  Target       |
  | (Aircraft)    |
  |  /            |
  | / (Echo)      |
  |/              |
  *---------------> Reference Antenna (Clear Line of Sight)
  |
  | (Surveillance Antenna)
  |
  V
Receiver (Passive Radar System)

Explanation:

• The Illuminator broadcasts a signal.
• The Reference Antenna receives the direct signal from the illuminator. This is the clean reference.
• The Target reflects the broadcast signal.
• The Surveillance Antenna receives both the direct broadcast signal (with its own path delay) and the reflected echo from the target.
• The Receiver at the bottom performs the cross-correlation between the reference and surveillance signals to extract the target echo information.
• The bistatic geometry (illuminator, target, and receiver are not collinear) is crucial. The geometry defines the angles and distances, which are used to convert measured delays and Doppler shifts into target position and velocity.

7) Defensive and offensive implications and troubleshooting

Defensive Implications:

• Covert Surveillance: Passive radar's primary advantage is its covert nature. It can be used for intelligence gathering, border surveillance, or air traffic control without emitting any detectable signals. This makes it ideal for scenarios where an active radar signature would be undesirable or easily countered.
• ECCM Resilience: As it doesn't transmit, it's immune to jamming techniques that target active radar transmitters.
• Low Probability of Intercept (LPI) Target Detection: Detecting targets that themselves might be trying to avoid radar detection becomes more feasible.
• Cost-Effective Wide-Area Surveillance: Leveraging existing broadcast infrastructure allows for potentially widespread coverage at a lower cost than deploying numerous active radar systems.

Offensive Implications (Conceptual/Defensive Context):

• Intelligence Gathering: Understanding the capabilities of passive radar systems is crucial for electronic intelligence (ELINT) efforts. Knowing that a passive radar might be operating allows for counter-intelligence measures.
• Target Signature Management: If a target knows it might be illuminated by passive radar, it needs to consider its radar cross-section (RCS) against the types of signals used by common broadcast sources. While not a direct "attack," it influences how targets manage their signatures.
• Counter-Passive Radar: Developing techniques to disrupt or deceive passive radar systems is a conceptual area of research. This could involve:
  • Jamming the Illuminator: While not directly jamming the passive radar, disrupting the broadcast signal source would render the passive radar inoperable. This is a high-level and often impractical approach due to the widespread nature of broadcast signals.
  • Signal Spoofing: Introducing complex interference or false echoes into the environment that could confuse the correlation process of the passive radar. This is extremely difficult with broadcast signals due to their complexity and power.
  • Exploiting Synchronization Vulnerabilities: If the passive radar relies on specific synchronization methods, these might be targeted.

Troubleshooting:

• No Target Detection:
  • Illumination Source Issues: Is the broadcast signal strong enough and stable? Is the reference antenna receiving a clean signal?
  • Synchronization Errors: Even small timing drifts between reference and surveillance channels can destroy correlation.
  • Low Target RCS: The target may simply be too small or have a radar cross-section too low to be detected against the noise floor.
  • Incorrect Geometry/Calibration: Errors in the assumed geometry or calibration of the system can lead to missed detections.
  • Processing Parameters: Incorrect integration times, Doppler bin sizes, or detection thresholds.
• False Alarms:
  • Strong Interference: Other RF signals in the environment can create spurious correlation peaks.
  • Multipath: Reflections from static objects (buildings, terrain) can mimic target echoes.
  • Signal Artifacts: Imperfections in the broadcast signal or the receiver chain can lead to false positives.
  • Algorithm Limitations: The detection algorithm might be too sensitive or not robust enough to handle complex clutter.
• Poor Range/Velocity Accuracy:
  • Bandwidth Limitations: Insufficient signal bandwidth limits range resolution.
  • Doppler Ambiguity: If the signal is not sufficiently complex or the integration time is too long, Doppler shifts can be ambiguous.
  • Bistatic Geometry Errors: Inaccurate knowledge of the illuminator, target, and receiver positions.

Troubleshooting Steps:

1. Verify Reference Signal: Ensure the reference antenna is properly aligned and the signal is clean. Use spectrum analyzers to check the broadcast signal's integrity.
2. Check Synchronization: Implement and verify robust synchronization mechanisms.
3. Analyze Noise Floor: Quantify the noise and interference levels.
4. Examine Correlation Output: Look for expected peaks (direct path) and deviations.
5. Calibrate Geometry: Ensure accurate geodetic information for all relevant points.
6. Review Processing Chain: Step through each stage of the signal processing, verifying intermediate results.
7. Utilize Test Targets: If possible, use known radar reflectors in a controlled environment to validate system performance.

8) Summary

Passive radar with broadcast illumination represents a sophisticated and covert approach to target detection and tracking by leveraging existing radio frequency (RF) infrastructure. Unlike active radar systems, it operates solely as a receiver, analyzing the direct signals from non-cooperative emitters (like TV or radio broadcasts) and comparing them with signals that have reflected off potential targets.

The fundamental principle relies on cross-correlation. By correlating a clean, direct reference signal from the illuminator with a surveillance signal that may contain target echoes, the system can isolate the time-delayed and Doppler-shifted signatures of targets. The time delay reveals range, and the Doppler shift indicates radial velocity.

The architecture typically involves separate antennas for reference and surveillance signals, high-performance receivers, and powerful digital signal processors to perform the computationally intensive correlation and subsequent Range-Doppler processing.

While offering advantages in terms of covertness, cost-effectiveness, and resilience to jamming, passive radar

This chapter is educational, lab-oriented, and constrained to lawful, defensive, and controlled research contexts.