Rotating Target Detection Using Commercial 5G Signal

Abstract

Passive radar detection emerges as a pivotal method for environmental perception and target detection within radar applications. Through leveraging its advantages, including minimal electromagnetic pollution and efficient spectrum utilization, passive radar methodologies have garnered increasing interest. In recent years, there has been an increasing selection of passive radar signal sources, and the emerging 5G has the characteristics of a high-frequency band, high bandwidth, and a large number of base stations, which give it significant advantages for use in passive radar. Therefore, in this paper, we introduce a passive radar target detection method based on 5G signals and design a rotating target speed measurement experiment. In the experiment, this paper validated the method of detecting rotating targets using 5G signals and evaluated the measurement accuracy, providing a research foundation for passive radar target detection using 5G signals and detecting rotating targets such as drone rotors.

1. Introduction

With the continuous development of communication technology and the integration of sensing and communication systems, the types of space radiation signal sources are increasing, improving passive radar detection technology. Radio signal candidates range from analog signals, such as television and frequency modulation (FM) signals, to digital communication signals, such as the global system for mobile (GSM) communications and wireless fidelity (WiFi) signals. As the signal bandwidth and carrier frequency gradually increase, detection performance also continues to improve. Moreover, with the development and application of the integration of fifth-generation mobile communication technology (5G), the use of 5G signals as passive radar signal sources for target detection also has research significance.

In recent years, the emergence of signal sources such as GSM, WiFi, and long-term evolution (LTE) signals has led to rapid development in the short-range application of passive radar. Although they have low power, they are widely present in the environment and have a large signal bandwidth, making them suitable for short-range detection. Therefore, these signals are applied to passive radar systems for target detection in different scenarios [1,2,3,4,5]. Additionally, the bandwidth and carrier frequency of communication signals are gradually increasing, which will improve the detection performance of passive radar, indicating the direction for its development. The rapidly developing 5G is also being applied to passive radar [6,7,8].

At present, 5G is in a stage of rapid development, fostering widespread accessibility to its corresponding resources. These resources can be used for passive radar systems, and many passive radar researchers often focus on larger targets such as vehicles and people. When the target is small, targets such as drones or drone rotors, whether passive radars based on 5G can correctly detect the target is a worthwhile research question. Therefore, based on existing research, this paper proposes a method for detecting small targets over short distances using the Channel State Information-Reference Signal (CSI-RS) in 5G. Additionally, a rotating target experimental model employing a stepper motor is constructed to accurately simulate target movement scenarios. To conduct experimental measurements, the CSI-RS in the 5G signal is applied in different experimental scenarios. Then, by comparing the measurement results with the set parameters of the experimental system, the correctness of the method of measuring rotating targets using 5G signals is verified. In a word, this paper provides an approach for small target detection based on 5G passive radar.

2. Related Work

This chapter provides a detailed introduction to the related work mentioned in the first chapter. This work is classified into the following three categories based on signals.

GSM and LTE: Samczynski et al. proposed the concept of GSM passive radar for road vehicle monitoring and verified its feasibility, providing an example for other GSM-based applications [1]. As for LTE, the feasibility of using LTE signals for target detection has been explored [4].

WiFi: Colone et al. designed a passive radar data processing method based on WiFi signals and verified the feasibility of the system through experiments [2]. In 2017, Colone et al. applied the WiFi passive radar system to the detection and monitoring of targets such as aircraft and vehicles at small airports, proving the potential of the system in such scenarios [3]. In terms of human perception, Xie et al. proposed a respiratory rate monitoring system based on WiFi signals, verifying the ability of passive radar based on WiFi [5]. These studies reveal the potential of passive radar for short-range applications and also provide different signal-processing methods. For example, Fabiola Colone et al. obtained target information by setting signal monitoring channels and reference channels, while Xie et al. obtained WiFi channel state information ratio(CSIR) for target detection.

5G: Kanhere conducted a simulation analysis on the method of using 5G signals for target localization and evaluated the performance of applying 5G in radar systems [6]. Księżyk et al. provided a detailed introduction to the basic principles of 5G sensing and conducted concept validation, explaining the feasibility and limitations of using 5G signals for passive radar and providing guidance for further research on passive radar based on 5G [7]. Abratkiewicz et al. also studied the use of Synchronization Signaling Block (SSB) signals for target detection in addition to classical passive radar signal processing methods, and validated this method with cars as experimental targets, providing a new approach for target detection [8].

3. 5G Signal and Detection Performance Analysis

3.1. 5G Signal Overview

The 5G system is the evolution of the 4G system and meets the needs for higher data transmission rates, greater data traffic, low latency, and large-scale connections. Additionally, 5G new radio (NR) is a key technology in 5G, which is a global 5G standard based on OFDM’s new air interface design.

Table 1. Overview of the main parameters of 4G and 5G NR.

Parameter	4G	5G NR
Frequency Range	<3 GHz	FR1: <6 GHz; FR2: >24.25 GHz
Subcarrier Spacing	15 kHz	FR1: 15/30/60 kHz; FR2: 60/120/240 kHz
Channel Bandwidth	≤20 MHz	FR1: ≤100 MHz; FR2: ≤400 MHz
Uplink Waveform	DFT-S-OFDM	DFT-S-OFDM/CP-OFDM
Downlink Waveform	CP-OFDM	CP-OFDM

presents a comparison of the main parameters of 4G and 5G NR, including waveform, bandwidth, and subcarrier spacing.

It can be seen from Table 1 that both the uplink and downlink signals of 5G signals can use cyclic prefix orthogonal frequency division multiplexing (CP-OFDM) waveforms and the physical layer uplink can also use discrete Fourier transform-spread orthogonal frequency division multiplexing (DFT-S-OFDM) waveforms. OFDM technology converts high-speed information streams into lower-rate parallel data streams through serial-to-parallel conversion and then modulates the parallel data with multiple orthogonal subcarriers. The 5G signal used for detection in this paper is the CP-OFDM waveform. When the cyclic prefix is not considered, the OFDM-modulated signal can be expressed as follows:

$$s_{\mathrm{OFDM}}\left(t\right)={\displaystyle \sum _{i=0}^{N-1}{d}_i\exp \left[j2\pi \left(f_c+\frac{i}{T_{\mathrm{OFDM}}}\right)t\right]}={\displaystyle \sum _{i=0}^{N-1}{d}_i\exp \left(j2\pi f_{c}t+j2\pi \frac{i}{T_{\mathrm{OFDN}}}t\right)}$$

(1)

where $T_{\mathrm{OFDM}}$ is the symbol period, $N$ is the number of subcarriers in the OFDM modulation process, $f_c$ is the carrier frequency, and $d_i$ is the amplitude of the i-th modulation symbols. When the carrier frequency is not considered, the baseband signal waveform $x(t)$ can be obtained from (1), which can be represented as follows:

$$x\left(t\right)={\displaystyle \sum _{i=0}^{N-1}{d}_i\exp \left(j2\pi \frac{i}{T_{\mathrm{OFDM}}}t\right)}$$

(2)

Additionally, the sampled signal can be expressed as follows:

$$x_k=x\left(k\frac{T_{OFDM}}{N}\right)={\displaystyle \sum _{i=0}^{N-1}{d}_i\exp \left(j\frac{2\pi ki}{N}\right)} , 0\le k\le N-1$$

(3)

It can be seen that $X=[x_0,x_1,\cdots ,x_k,\cdots ,x_{N-1}]$ is the Inverse Discrete Fourier Transform of $D=[d_0,d_1,\cdots ,d_i,\cdots ,d_{N-1}]$; thus, OFDM modulation can be achieved using Inverse Discrete Fourier Transform.

3.2. Features of 5G Signal Physical Layer

The method used in this paper is to obtain channel response through CSI-RS signals in 5G for object detection. Therefore, it is necessary to understand the main parameter settings of 5G and CSI-RS signals. This chapter introduces the main parameter configuration of 5G and CSI-RS signals.

3.2.1. Cyclic Prefix (CP)

CP-OFDM waveforms can be used for uplink and downlink transmission of 5G signals. After obtaining the OFDM modulation waveform, a segment of data at the end of each symbol is copied to the front end to obtain the CP-OFDM waveform, which is the cyclic prefix. The cyclic prefix prevents the previous symbol from falling into the range of this symbol due to multipath effects and does not destroy the orthogonality between subcarriers. When inter-symbol interference occurs, the presence of the cyclic prefix causes a cyclic shift in the signal, resulting in a phase shift in the demodulated symbols. The 5G system has flexible subcarrier settings and corresponding cyclic prefix types, as listed in

Table 2. Subcarrier spacing parameters and cyclic prefix types of 5G.

$\mathit{\mu }$	$\mathbf{Subcarrier} \mathbf{Spacing} \mathbf{\Delta }\mathit{f} = 2^{\mathit{\mu }}\times 15\mathbf{kHz}$	The Type of Cyclic Prefix
0	15	Normal
1	30	Normal
2	60	Normal
2	60	Extended
3	120	Normal
4	240	Normal
5	480	Normal

[9], where $\mu$ is the subcarrier parameter.

3.2.2. Frame Structure

In a 5G signal, the time length of a wireless frame is 10 ms, consisting of 10 subframes with a length of 1 ms. The time scheduling in 5G NR is based on slots, with each 1 ms sub-frame containing several slots, and each slot containing 14 or 12 OFDM symbols. The number of slots contained in a subframe is determined by the subcarrier spacing. The quantity relationship between subframes, slots, and OFDM symbols with different parameters $\mu$ is shown in

Table 3. The quantity relationship between subframes, slots, and OFDM symbols with different parameters $\mu$.

$\mathit{\mu }$	$\mathbf{Subcarrier} \mathbf{Spacing} \mathbf{\Delta }\mathit{f} = 2^{\mathit{\mu }}\times 15\mathbf{kHz}$	${\mathit{N}}_{\mathbf{slot}}^{\mathbf{frame}}$	${\mathit{N}}_{\mathbf{slot}}^{\mathbf{subframe},\mathit{\mu }}$	${\mathit{N}}_{\mathbf{sym}}^{\mathbf{slot}}$
0	15	10	1	14
1	30	20	2	14
2	60	40	4	12/14
3	120	80	8	14
4	240	160	16	14
5	480	320	32	14

[10]. $N_{\mathrm{slot}}^{\mathrm{frame}}$ is the number of slots in a frame, $N_{\mathrm{slot}}^{\mathrm{subframe},\mu }$ is the number of slots in a subframe, and $N_{\mathrm{sym}}^{\mathrm{slot}}$ is the number of OFDM symbols in a slot. The subcarrier spacing of the 5G signal used in this paper is 30 kHz, i.e., $\mu =2$. When the subcarrier spacing is 30 kHz, each subframe contains two slots, that is, each slot is 0.5 ms [11]. Additionally, when the type of cyclic prefix is a normal cyclic prefix, a slot contains 14 OFDM symbols; when it is an extended cyclic prefix, a slot contains 12 OFDM symbols [11].

3.2.3. Time–Frequency Resources

In the 5G protocol, many time–frequency resource units are defined, such as the resource element (RE), resource block (RB), physical resource block (PRB), and time–frequency resource grid. The RE is the smallest resource unit in 5G, occupying one OFDM symbol in the time domain and representing one subcarrier in the frequency domain. An RB contains 12 subcarriers in the frequency domain and is not defined in the time domain. PRB is a physical RB within the bandwidth part (BWP). BWP is a partial continuous bandwidth configured for UE in the transmission channel. Within each BWP, PRB is independently numbered, and, in order to manage different BWPs, a common resource block (CRB) is defined in 5G. The schematic diagram of BWP is shown in Figure 1 [10], where $N_{grid}^{start}$ is the offset of the cell containing this BWP relative to CRB0, $N_{BWP}^{size}$ is the number of RB contained in BWP, and $N_{BWP}^{start}$ is the offset of BWP relative to CRB0. The resource grid contains two dimensions, the time domain and frequency domain, and it is a method of signal representation. Each grid represents a subcarrier in the frequency domain and an OFDM symbol in the time domain.

3.3. CSI-RS Signal

This paper uses the CSI-RS in 5G to detect rotating targets. CSI-RS [11,12,13,14] is a reference signal used in 5G signals to obtain channel state information. It is similar to a pilot signal. In 4G, the cell-specific reference signal (CRS) is used to obtain the downlink channel status between the base station and the user. And CRS can be configured with 1, 2, and 4 antenna ports. Compared to 4G, the functions of CSI-RS in 5G have been expanded, including time–frequency tracking, channel state information obtaining, and more flexible configuration of CSI-RS parameters such as the number of antenna ports, signal period, and multiplexing method. Additionally, the parameter configuration of CSI-RS is very important for using it for target detection.

The basic parameters of CSI-RS signals mainly include the number of antenna ports, period, and density. The number of antenna ports supported by a CSI-RS signal includes 1, 2, 4, 8, 12, 16, 24, and 32. The period of CSI-RS can be 4, 5, 8, 10, 16, 20, 32, 40, 64, 80, 160, 320, and 640 time slots, and the length of the time slot is related to the length of the CP. CSI-RS has three densities: 0.5, 1, and 3. This paper obtains channel response through the CSI-RS signal, so it is necessary to know the position of the CSI-RS signal in the resource grid. The position of the CSI-RS signal in this experiment is mainly determined by period, density, symbol location, and subcarrier location. The period determines the frequency of CSI-RS occurrence in the time domain. Density determines how many subcarriers CSI-RS occupies within a PRB, symbol location determines the time starting position of CSI-RS in a slot, and subcarrier location determines the subcarrier starting position of CSI-RS within a PRB. Figure 2 shows a CSI-RS RE mapping, which includes a slot in the time domain and a PRB in the frequency domain. When the subcarrier spacing is 30 kHz, a slot contains 14 OFDM symbols. The number of antenna ports is one and the density is three. Three CSI-RS symbols occupy three REs in a PRB. In Figure 2, the symbol location is five, starting from the fifth OFDM symbol, and the subcarrier location is one, starting from the first subcarrier.

4. Target Model and Frequency Offset Extraction Method

4.1. Model Establishment

4.1.1. The Bistatic Radar Model

Utilizing 5G signals for rotating target detection essentially employs bistatic radar principles for target identification. The transmitting antenna and receiving antenna of the bistatic radar are separated from each other, and their structural model is shown in Figure 3 [15]. Where $v$ is the velocity of the target, $L$ is the distance between the receiving and transmitting antennas, $L_T$ is the distance between the target and the transmitting antenna, $L_R$ is the distance between the target and the receiving antenna, $\beta$ is the double base angle, and $\delta$ is the angle of the target at the velocity direction relative to the bisector of the double base angle.

Assuming the wavelength of the signal is $\lambda$, the Doppler frequency shift generated by the moving target can be expressed as [16]

$$f_d=\frac{v}{\lambda }\left[\cos \left(\delta +\frac{\beta }{2}\right)+\cos \left[\delta -\frac{\beta }{2}\right]\right]=\frac{2v}{\lambda }\cos \left(\delta \right)\cos \left(\frac{\beta }{2}\right)$$

(4)

4.1.2. The Model of the Received Signal

In the actual environment, the receiving antenna will receive the direct wave signal from the base station and the multipath interference caused by the reflection of other obstacles in the environment while receiving the target echo. The transmission diagram of the 5G signal from the transmitting base station to the receiving antenna is shown in Figure 4.

The signal received by the receiving antenna can be represented as follows:

$$s_{\mathrm{echo}}\left(t\right)=\alpha s\left(t-t_0\right)+{\displaystyle \sum _m{a}_m}s\left(t-t_0-{\tau }_m\right)+{\displaystyle \sum _{\mathrm{n}}{b}_n}s\left(t-t_0-{\tau }_n\right)\exp \left[j2\pi f_{d_n}\left(t\right)\right]+n\left(t\right)$$

(5)

where $s(t)$ is the transmitted signal, $t_0$ is the time delay of the signal propagating in a straight line between the receiving antenna and the base station, $t_0+{\tau }_m$ is the time delay generated by the transmitted signal reflecting from the m-th stationary obstacle to the receiving antenna, $t_0+{\tau }_n$ is the time delay generated by the transmitted signal reflecting from the n-th moving target to the receiving antenna, $f_{d_n}$ is the Doppler frequency shift caused by the radial velocity generated by the motion of the n-th moving target, and $n(t)$ is noises in the environment.

4.1.3. Rotating Target Measurement Scene

The rotating target measurement scene established based on the bistatic radar model is shown in Figure 5a. TX is the 5G signal-transmitting antenna, and RX is the signal-receiving antenna. $L_{T0}$ is the projected distance from the target rotation center to the transmitting antenna on the antenna connection line, and $L_{R0}$ is the projected distance from the target rotation center to the receiving antenna on the antenna connection line. $L_r$ is the distance from the rotation center to the antenna connection, and $r$ is the target rotation radius. In the simulation, the carrier frequency is 3.45 GHz, $L_{T0}=3.5 \mathrm{m}$, $L_{R0}=1 \mathrm{m}$, $L=L_{T0}+L_{R0}=4.5 \mathrm{m}$, $L_r=1 \mathrm{m}$, and $r=0.3 \mathrm{m}$. The frequency offset curves of different types of rotating targets are discussed below.

• Unilateral rotation target

The frequency offset curve of the target in different rotation directions is shown in Figure 5b when the speed of the unilateral rotating target is 2 rps. Except for two special cases where the target rotation center is on the centerline of the receiving and transmitting antenna line and the double base angle is zero, the Doppler frequency deviation curve generated by a uniformly rotating target resembles a sine curve, and its maximum and minimum values are not equal in size. Their size relationship is related to the target area and rotation direction. If the target area is known, the change in the target rotation direction can be determined based on it.

2.

Bilateral rotating target

The bilateral rotating target model can be established as shown in Figure 6. Set the position relationship as shown in Figure 3 with a speed of 2 rps. When the radius of both sides of the target is 0.3 m, the target frequency offset curve is as shown in Figure 7a. When the bilateral target radii are 0.3 m and 0.15 m, the target frequency offset curve is as shown in Figure 7b.

4.2. Target Detection Processing Method

For passive radar signal processing, the time–frequency cross-correlation method is often used to detect targets [17]. Generally, two signal-receiving channels are set up, namely, a reference signal channel for receiving direct waves and a monitoring channel for receiving target echoes. Then, adaptive filtering or extended cancellation algorithms are used to filter out direct waves and multipath clutter [18,19,20]. This paper mainly studies methods of target detection using channel response. The CSI-RS in the 5G signal can be used to estimate the channel between the transmitting and receiving antennas and obtain the Doppler frequency shift of the rotating target based on the channel response. When the 5G signal configuration is known, the corresponding reference signal can be generated locally to obtain the transmission signal. Rotating the target causes the channel between the transmitting and receiving antennas to change. The channel response is obtained by transmitting and receiving signals, and the information about the rotating target is obtained from the channel response.

4.2.1. Channel Estimation

The frequency domain least squares (LSs) method is a commonly used channel estimation method in OFDM systems. For OFDM systems that rely on a pilot symbol, the transmitted pilot symbol vector is $X_P$ and the received pilot symbol vector is $Y_p=X_p{H}_p+N_p$, where $N_p$ is the noise vector. The objective function of the method can be expressed as follows:

$$J\left({\widehat{H}}_P\right)={‖X_P{\widehat{H}}_P-Y_P‖}^2$$

(6)

To obtain the minimum value of $J\left({\widehat{H}}_P\right)$, set its partial derivative to 0, i.e., $\partial J\left({\widehat{H}}_P\right)/\partial {\widehat{H}}_P=0$, and the estimated channel response value is [21].

$${\widehat{H}}_P=\frac{Y_P}{X_P}$$

(7)

The flow chart of target frequency offset estimation based on 5G signals is shown in Figure 8 [22].

The transmission resource grid of 5G signals can be represented as $G_{TX}$, where $G_{TX}$ is a matrix of size $N\times M$, and $M$ is the number of OFDM modulation symbols contained in the signal. The baseband modulation signal can be represented as follows:

$$x\left(t\right)={\displaystyle \sum _{m=0}^{M-1}{\displaystyle \sum _{n=0}^{N-1}{G}_{TX}}\left(n,m\right)\exp \left(j2\pi f_{n}t\right)rect\left(\frac{t-T/2-mT}{T}\right)}$$

(8)

where $T$ is period which includes the basic symbol length and the cyclic prefix length, $f_n=n\Delta f$ is the frequency of the n-th subcarrier in the baseband signal, and $rect\left(\cdot \right)$ is the rectangular window function.

Assuming the time delay of the target echo signal is $\tau$ and the Doppler frequency shift is $f_d$, the received signal can be represented as follows:

$$y\left(t\right)={\displaystyle \sum _{m=0}^{M-1}{\displaystyle \sum _{n=0}^{N-1}{G}_{RX}}\left(n,m\right)}\exp \left(j2\pi f_{d}t\right)rect\left(\frac{t-T/2-mT-\tau }{T}\right)$$

(9)

$$G_{RX}\left(n,m\right)=A_y\left(n,m\right)G_{TX}\left(n,m\right)\exp \left[j2\pi \left(-n\Delta f\tau +f_{d}mT\right)\right]$$

(10)

where $G_{TX}\left(n,m\right)$ is the transmission resource grid of the signal, $G_{RX}\left(n,m\right)$ is the resource grid obtained from the received signal, and $A_y\left(n,m\right)$ is the amplitude.

According to the LS method, the obtained channel response can be expressed as follows:

$$H\left(n,m\right)=\frac{G_{RX}\left(n,m\right)}{G_{TX}\left(n,m\right)}=A_y\left(n,m\right)\exp \left(-j2\pi n\Delta f\tau +j2\pi f_{d}mT\right)$$

(11)

In this paper, CSI-RS is applied to obtain channel responses, and the Equation (11) can be represented as follows:

$$H\left(n,m\right)=A_y\left(n,m\right)\exp \left(-j2\pi n\Delta f_{CSI}\tau +j2\pi f_{d}m{T}_{CSI}\right)$$

(12)

where $T_{CSI}$ is the period of the CSI-R, and $\Delta f_{CSI}$ is the interval between adjacent subcarriers of the CSI-RS. The dimension of the channel response matrix is $N_1\times M_1$, where $N_1$ is the number of subcarriers occupied by the CSI-RS in the frequency domain, and $M_1$ is the number of OFDM symbols occupied in the time domain.

4.2.2. Doppler Frequency Offset Estimation

According to Equation (12), there will be a phase shift caused by a Doppler frequency shift between different symbols on the same subcarrier. Therefore, the Doppler frequency shift produced by the rotating target can be calculated through the phase shift between symbols. Then, the rotation speed of the rotating target can be estimated based on the obtained Doppler frequency deviation versus the time curve.

In this experiment, the carrier frequency is much larger than the signal bandwidth, so the target Doppler frequency shifts obtained by different subcarriers can be approximately equal. To obtain the target Doppler frequency offset, the channel response obtained at different single subcarrier positions can be used for processing, that is, a time–frequency analysis of $H\left(i,m\right),i=0,1,2,\dots ,N_1-1$. However, due to frequency selectivity, the channel response obtained on a single subcarrier may have lower energy and greater interference. It is also possible to stack the channel responses at multiple subcarrier positions in the frequency domain before conducting a time–frequency analysis, i.e., conducting a time–frequency analysis on ${\displaystyle \sum _{i}H\left(i,m\right)}$. The time–frequency analysis serves to perform a short-time Fourier transform on the obtained channel response to obtain frequency domain information and time domain information at the same time. The time–frequency analysis schematic is shown in Figure 9. In data processing, it is necessary to choose an appropriate window length to achieve better results.

The channel response extracted using the n-th subcarrier can be represented as $H_n$, and the result of the time–frequency analysis on $H_n$ can be represented as follows:

$$ST\left(i,j\right)=STFT\left\{H_n\right\}$$

(13)

The size of the matrix $ST\left(i,j\right)$ is $I\times J$, where the column vector represents the result of the FFT transformation at the corresponding time $j$.

The global maximum value index is obtained by detecting the amplitude of the FFT result corresponding to a certain time $j$, and the frequency corresponding to the index is the target Doppler frequency at that time, which can be expressed as follows:

$$f_d\left(j\right)=\arg \underset{0\le i\le I-1}{\max }\left\{\mathrm{abs}\left[ST\left(i,j\right)\right]\right\}$$

(14)

where $f_d\left(j\right)$ is the target Doppler frequency offset index at the corresponding time $j$, $\mathrm{abs}\left(\cdot \right)$ represents the modulus value, and $\arg \max \left(\cdot \right)$ represents the index corresponding to the global maximum.

For multiple targets, the global maximum cannot detect all targets. Instead, local maximum detection can be used to extract the frequency offset of multiple targets by sorting the local maximum or setting a threshold, which can be represented as follows:

$$f_{d_k}\left(j\right)=\arg \underset{k,0\le i\le I-1}{\mathrm{findpeaks}}\left\{\mathrm{abs}\left[ST\left(i,j\right)\right]\right\}$$

(15)

where $f_{d_k}\left(j\right)$ is the Doppler frequency offset index of the k-th target at time $j$, and $\arg \underset{k,0\le i\le I-1}{\mathrm{findpeaks}}\left(\cdot \right)$ represents the index corresponding to the maximum of the k-th along the vector index $i$. When the number of targets is known, the local maximum values can be directly sorted to obtain the frequency offset of all targets. Inversely, if the number of targets is unknown, the algorithm of constant false alarm rate [23,24] detection can be applied to generate an adaptive threshold; thus, the local maximum value exceeding the threshold will be determined as a target.

4.2.3. Interference Suppression

• Direct wave and multipath clutter suppression

The signals received by the receiving antenna include target echoes, direct waves from the transmitting antenna, and multipath signals reflected by other obstacles in the environment. After the signal is synchronized, the delay and frequency offset of the direct wave are both 0. According to Equation (12), the direct wave will add a constant to the corresponding symbol and subcarrier position in the matrix $H\left(n,m\right)$. The delay of the multipath signal relative to the direct wave is $\tau$, and the frequency offset is 0, which is expressed as a constant complex number in $H\left(n,m\right)$. So, a strong peak will appear in the spectrum at zero frequency. Therefore, it is necessary to suppress the zero-frequency component of the signal to obtain the Doppler frequency offset of the target, which can be achieved by removing the average value of the signal or using a filter.

Using the rotation model shown in Figure 5, the target echo intensity is set to 0 dB, the direct wave intensity is set to 20 dB, and the signal-to-noise ratio is 15 dB. In the simulation, the period of the CSI-RS signal is set to five time slots, that is, 50 ms. Figure 10a,b shows the time–frequency analysis results and extracted frequency offset curve after removing the signal mean value. Figure 10c shows the error between the actual measurement value and the theoretical value. It can be seen that the error is small and random, which has a small impact on the measurement of the frequency offset variation period.

For the filter, the equal ripple design method is used to design a bandpass filter with an order of 226. After filtering, delay compensation is performed on the signal. The time–frequency analysis results and the extracted frequency offset curve are shown in Figure 11a–c and show the error between the actual measurement value and the theoretical value. The reason why the starting position in Figure 11b is 0 for tens of milliseconds is that the filter initially acts on the signal, resulting in poor filtering performance. In data processing, it is possible to discard data with poor filtering performance at the forefront of the wave.

2.

Random phase noise suppression

In the experiment, the signal-receiving and transmitting antennas are separated, which would lead to the problem of clock desynchronization. Clock desynchronization may result in random phase shifts that need to be processed to obtain more accurate Doppler shifts. Multiple antennas can be used to receive signals in the experiment. If two receiving antennas share a crystal oscillator, the clock offset of the two antennas at the same time will be the same. Taking advantage of this characteristic, the cross-antenna cross-correlation (CACC) method or the cross-antenna signal ratio (CASR) method can be used to eliminate random phase shifts [25,26]. In this paper, we use the CASR method to eliminate random phase shifts.

Taking the channel response extracted from a subcarrier as an example, the channel response can be divided into static path components and dynamic path components. For the i-th antenna, the obtained channel response can be written as follows [25]:

$$h^i\left(t\right)=\left[h_s^i\left(t\right)+h_d^i\left(t\right)\exp \left(j2\pi f_{d}t\right)\right]\exp \left[j\theta \left(t\right)\right]$$

(16)

where $h_s^i(t)$ is the static path component in the i-th antenna channel response, $h_d^i\left(t\right)\exp \left(j2\pi f_{d}t\right)$ is the dynamic path component, $h_d^i\left(t\right)$ is a constant in the dynamic path component, and $\theta (t)$ is a random phase offset.

For antennas $i$ and $i+1$ using the same oscillator, the signal ratio can be expressed as follows [26]:

$$h^i\left(t\right)=\left[h_s^i\left(t\right)+h_d^i\left(t\right)\exp \left(j2\pi f_{d}t\right)\right]\exp \left[j\theta \left(t\right)\right]$$

(17)

For a rotating target, it is approximately fixed in a short period, during which channel states $h_s^i\left(t\right)$ and $h_d^i\left(t\right)$ are constant. It can be seen that $R\left(t\right)$ and $\exp \left(j2\pi f_{d}t\right)$ have the same periodicity, so the CASR method can remove phase noises while utilizing the periodic changes in phase to obtain Doppler frequency shift information.

4.3. Summary of Detection Methods

In summary, the overall process of using 5G signals for rotating target detection can be obtained as shown in Figure 12. When a 5G base station is used for measurement, it is necessary to obtain the configuration parameters of the CSI-RS signal. Firstly, demodulate the 5G signal obtained by the receiving antenna to obtain the resource grid, and then extract the CSI-RS signal based on the CSI-RS configuration parameter to obtain the channel response. The next step is to suppress random phase noise and zero frequency components in the channel response. The signal after interference suppression is subjected to time–frequency analysis, and the target frequency offset is extracted from the results of the time–frequency analysis. After smoothing the frequency offset curve, the rotating target speed is obtained through FFT. The key to the method proposed in this paper is to understand the parameters of CSI-RS signals and obtain the parameters of 5G base stations. If the configuration parameters of 5G base stations cannot be directly queried, other methods need to be found to obtain them.

To make this method more widely used, it is necessary to develop applications that can obtain configuration information of any 5G base station and perform signal demodulation in order to further integrate it with the signal processing method in this paper.

5. Experiments and Data Analysis

In experiments, the CSI-RS signal period is 20 ms, and the maximum unambiguous Doppler frequency is 50 Hz. The measurable Doppler frequency shift range is [−25 Hz, 25 Hz]. For a unilateral rotation target, when the signal carrier frequency is 3.55 GHz, the rotation radius is 0.3 m, and the double base angle is 0, the maximum measurable speed is 0.56 rps. The presence of the double base angle makes the maximum measurable speed slightly greater than 0.56 rps. The experiment is conducted in two measurement scenarios.

5.1. 5G Experimental Base Station Testing

In the first measurement scenario, an experiment is conducted using a 5G base station in a 5G laboratory. The CSI-RS signal parameters of 5G base stations in the laboratory are shown in

Table 4. CSI-RS parameter table for 5G base station in 5G laboratory.

Parameter	Parameter Value	Parameter	Parameter Value
Num RB	273 RB	Subcarrier Location	0
Symbol Locations	4	Period	40 slots
Density	3	Slot Offset	24 slots

. The measurement scenario is shown in Figure 13a, and the model is shown in Figure 13b.

5.1.1. Unilateral Target

The radius of the unilateral rotation target is 0.3 m, and the data with a speed of 0.5 rps and clockwise rotation are analyzed as an example. To obtain better display results, the initial 1 s of data are discarded. Figure 14a shows the time–frequency analysis results of the channel response without interference suppression, Figure 14b shows the time–frequency analysis after random phase noise suppression, and Figure 14c shows the time–frequency analysis after suppressing the zero frequency component. Figure 14d shows the smoothed frequency offset curve extracted by peak detection, in which the blue solid line represents the actual measurement results, and the red dashed line represents the theoretical values derived from the rotating target model. Figure 15a shows the error between the measured Doppler frequency and the theoretical value. The initial large error is due to the poor filtering effect of the filter when it first acts on the data. It can be seen that the overall error is small, and the experimental results are consistent with the theoretical model. The errors are mainly caused by model measurement errors and the FFT spectral resolution. From the spectrum graph Figure 15b, it can be observed that the measured speed is 0.500488 rps, with an error of 0.1%. For the frequency offset curves corresponding to different rotation directions at the same position, as shown in Figure 15c, it can be seen that the relationship between the maximum and minimum values of the frequency offset curves corresponding to different rotation directions is different.

5.1.2. Bilateral Rotating Target

In the bilateral rotating target experiment, data measurements are conducted on two types of bilateral targets as shown in Figure 16a,b. Taking the counterclockwise speed of 0.375 rps as an example for analysis, the time–frequency analysis results are shown in Figure 17a when the model has the same radius. The radii of the two targets are both 0.3 m. The result of frequency offset extraction is shown in Figure 17c and the spectrum is shown in Figure 17e. The obtained speed is 0.757 rps, which is twice the actual speed. The reason for this is that, when the radii are the same, the frequency offset curves of the two targets are the same, with only half a cycle of time delay. When the radii of the two targets are 0.3 m and 0.15 m, respectively, the time–frequency analysis results are shown in Figure 17b,d, and the corresponding spectrum is shown in Figure 17f. The obtained speed is 0.378 rps, with an error of 0.8%.

5.2. 5G Commercial Base Station Testing

Based on the 5G experimental base station experiment, a measurement experiment using a 5G commercial base station is also designed. In this measurement scenario, the accuracy of target speed estimation is verified using a commercial 5G base station. Unilateral rotating target models with radii of 0.3 m and 0.15 m are tested. The measurement scenario is shown in Figure 18a, and the obtained CSI-RS signal parameters of the 5G base station are shown in

Table 5. CSI-RS signal parameters of the 5G commercial base station.

Parameter	Parameter Value	Parameter	Parameter Value
Num RB	273 RB	Subcarrier Location	2
Symbol Location	4	Period	40 slots
Density	3	Slot Offset	4 slots

.

The measurement results of the unilateral target rotating model with a radius of 0.3 m are shown in the red line in Figure 18b and

Table 6. Results of unilateral targets with a radius of 0.3 m.

Theoretical Speed (rps)	Measured Speed (rps)	Error
0.125	0.122	2.4%
0.25	0.244	2.4%
0.5	0.5005	0.1%
0.625	0.6225	0.4%
0.75	1.5	100%

. The measurement results of the unilateral target rotating model with a radius of 0.15 m are shown in the blue line in Figure 18b and

Table 7. Results of unilateral targets with a radius of 0.15 m.

Theoretical Speed (rps)	Measured Speed (rps)	Error
0.125	0.1221	2.3%
0.25	0.2563	2.5%
0.5	0.5005	0.1%
0.625	0.6226	0.38%
0.75	0.7568	0.9%
0.875	0.8789	0.45%

. When the rotation radius of the unilateral target is 0.3 m and the theoretical speed is 0.75 rps, the reason for the error of 100% is that the Doppler frequency exceeds the measurement range, resulting in Doppler blur.

5.3. Analysis of Computational Load and Processing Time

This paper uses Matlab for signal processing, and the computer CPU used is an Intel(R) Core(TM) i5-9300H CPU. According to the processing flowchart shown in Figure 12,

Table 8. Analysis of computational complexity for each processing step.

Step	Number of Floating Point Addition	Number of Floating Point Multiplication	Description
Random phase noise suppression	$2N_1\times M_1+2M_1$	$4M_1$	$\mathrm{Add} \mathrm{up} \mathrm{the} \mathrm{channel} \mathrm{responses} \mathrm{obtained} \mathrm{from} N_1$$\mathrm{subcarriers}; \mathrm{the} \mathrm{channel} \mathrm{response} \mathrm{has} M_1$ complex sampling points.
Zero frequency component suppression	$2N_{HPF}\times M_1$	$2(N_{HPF}+1)\times M_1$	$\mathrm{Signal} \mathrm{has} M_1$$\mathrm{complex} \mathrm{sampling} \mathrm{points}; \mathrm{the} \mathrm{order} \mathrm{of} \mathrm{the} \mathrm{HPF} \mathrm{filter} \mathrm{is} N_{HPF}=48$.
Time–frequency analysis	$\begin{array}{l}2J\times I\times {\log }_{2}I\\ +2J\times \frac{I}{2}\times {\log }_{2}I\end{array}$	$4J\times \frac{I}{2}\times {\log }_{2}I$	$I$ is length of FFT; $J$ is the number of sliding windows.
Doppler frequency offset curve extraction	$J\times 2(I-2)$	\	Peak search $J$ times, with $I$ data searched each time.
Smooth filtering	$N_{LPF}\times J$	$(N_{LPF}+1)\times J$	Signal has $J$$\mathrm{real} \mathrm{sampling} \mathrm{points}; \mathrm{the} \mathrm{order} \mathrm{of} \mathrm{the} \mathrm{LPF} \mathrm{filter} \mathrm{is} N_{LPF}=31$.
FFT	$\begin{array}{l}2N_{FFT}\times {\log }_2{N}_{FFT}\\ +2\frac{N_{FFT}}{2}\times {\log }_2{N}_{FFT}\end{array}$	$4\times \frac{N_{FFT}}{2}\times {\log }_2{N}_{FFT}$	$N_{FFT}$$\mathrm{is} \mathrm{length} \mathrm{of} \mathrm{FFT} \mathrm{and} N_{FFT}=4096$.

shows the computational complexity of each step.

The computational load and processing time are mainly determined by the amount of data used in data processing. The data processing in this paper generally takes several seconds. Taking the data in Section 5.1.1 as an example, $N_1=400$, $M_1=1000$, $I=1024$, and $J=989$, the data processing takes 5.891 s.

6. Conclusions

WiFi, 4G LTE, and other signals are widely used in passive radar. The rise of 5G has led scholars to study passive radar based on 5G. In addition to the classic processing methods of passive radar, some scholars have studied signal processing methods based on certain signals within 5G, such as signal processing methods based on SSB signals. This paper focuses on whether other signals in 5G can be used for target detection and proposes a method of using CSI-RS signals of 5G for channel estimation and extracting Doppler frequency offset from channel responses. Meanwhile, compared to other studies using passive radars based on 5G for vehicle detection or personnel localization, the method in this paper focuses more on detecting weak and small targets at short distances.

In order to verify the correctness of the method proposed in this paper, the rotating target was chosen as the detection object, as the actual motion state of the rotating target, such as velocity, can be more easily obtained. In this paper, a rotating target echo model is established, including bilateral rotating targets and unilateral rotating targets. Additionally, the frequency offset curve characteristics of different types of rotating targets are analyzed. The impact of interference signals and receiver phase noise in actual measurements is also analyzed. At the same time, a rotating target model for actual measurement is established. This paper conducted measurement experiments in different environments and parameter configurations, and compared the measurement results with theoretical values, providing data for research on passive radar based on 5G. According to the experiment results, the speed estimation error does not exceed 5% within the measurable range. The results have verified the feasibility and correctness of the detection method for rotating target detection and velocity estimation using CSI-RS signals. This paper can provide a foundation and direction for further research and application of passive radar based on 5G. The limitations of this method and its application in other scenarios can be further studied in the future.