## 2 System Model and Atmospheric Error Analysis
### Signal Model of the GNSS-BSAR System  
The general structure of the GNSS signal is given in Figure 2. In GNSS-BSAR system, the large signal bandwidth enables fine range resolution. Considering the capabilities of the existing experimental equipment, this work selected the GPS L5 signal as the illuminator of opportunity for both model analysis and experimental test, which can achieve a range resolution of 15 m. For navigation and positioning, GNSS signals generally have a three-layer modulation structure. The bottom layer is the L-band carrier with a frequency of 1176.45 MHz. The middle layer is the ranging code signal in the form of pseudorandom noise (PRN). The ranging code is modulated in BPSK mode, with a time length of 1 ms, a chip length of 10,230, and a bandwidth of 20.46 MHz. Similar to the pulse modulation signal in the radar system, the GPS system improves the anti-noise performance of the system through spread spectrum modulation of the ranging code. The top layer is data code. The data code is also modulated in BPSK mode, and its length is 20 times than the ranging code. The data code carries satellite navigation data, such as satellite ephemeris, time, and other information. It is crucial for navigation and positioning functions, but it is redundant for radar applications and will interfere with the Doppler phase of the signal. Therefore, it must be demodulated before performing SAR imaging. The signal transmitted by a single GPS satellite can be expressed as:  
\[S(t)=\sum_{n=0}^{N}\text{rect}\Big{(}\frac{t-nT_{p}}{T_{p}}\Big{)}C\big{(}t-nT _{p}\big{)}D(t)\exp(j2\pi f_{c}t) \tag{1}\]  
where \(t\) represents time, \(C(\cdot)\) represents the ranging code (also called \(CA\) code), \(T_{p}\) represents the equivalent pulse repetition period, and \(D(\cdot)\) represents the data code. \(f_{c}\) represents the signal carrier frequency. Since the amplitude and initial phase of the signal have no impact on the analysis, they are ignored in the equation. Figure 2: Typical structure of a GNSS signal (taking GPS as an example). The signal received by the reference channel is the delay of the GPS signal, that is:  
\[S_{d}(t) =S\bigg{[}t-\frac{R_{d}(t)}{c}\bigg{]} \tag{2}\] \[=\sum\limits_{n=0}^{N}\text{rect}\bigg{[}\frac{t-nT_{p}-R_{d}(t)/c }{T_{p}}\bigg{]}C\bigg{[}t-nT_{p}-\frac{R_{d}(t)}{c}\bigg{]}\times\] \[D\bigg{[}t-\frac{R_{d}(t)}{c}\bigg{]}\exp\bigg{\{}j2\pi f_{c} \bigg{[}t-\frac{R_{d}(t)}{c}\bigg{]}\bigg{\}}\]  
where \(R_{d}(t)\) represents the distance from transmitter to receiver. The point target echo received by the imaging channel can be expressed as:  
\[S_{r}(t) =S\bigg{[}t-\frac{R(t)}{c}\bigg{]} \tag{3}\] \[=\sum\limits_{n=0}^{N}\text{rect}\bigg{[}\frac{t-nT_{p}-R(t)/c}{ T_{p}}\bigg{]}C\bigg{[}t-nT_{p}-\frac{R(t)}{c}\bigg{]}\times\] \[D\bigg{[}t-\frac{R(t)}{c}\bigg{]}\exp\bigg{\{}j2\pi f_{c}\bigg{[} t-\frac{R(t)}{c}\bigg{]}\bigg{\}}\]  
where \(R(t)=R_{t}(t)+R_{r}(t)\), \(R_{t}(t)\) represents the distance from the transmitter to the target, and \(R_{r}(t)\) represents the distance from the target to the receiver. \(R(t)\) is the total propagation distance of the reflected echo. Utilizing the data code tracked by the reference channel, carrier demodulation and data code demodulation are performed to obtain the baseband echo signal. Since the GPS ranging code signal has a small tolerance for Doppler shifts, the Doppler center frequency of the navigation satellite relative to the receiver should be demodulated when the carrier is demodulated.