Radar Target Simulation Guide: Range, Doppler, and EW Threat Scenarios on the E8267D

Radar target simulation produces a signal at a radar receiver that looks like an echo from a target, with a range, a radial velocity, and a radar cross section (RCS). To the receiver, that target is three numbers: a delay, a frequency offset, and a power level. Range maps to time because the echo arrives after the round trip. Velocity maps to frequency because a closing target raises the return frequency through Doppler shift. Size maps to amplitude because a larger RCS reflects more power.

An open-loop setup plays a prepared return each time the radar's timing triggers it. A closed-loop setup captures the radar's own transmitted pulse, modifies it, and sends it back. For more on the instrument itself, see what a signal generator does, RF signal generator basics, or the signal generator buying guide.

Many product pages on this topic focus on 77 GHz automotive simulators. This guide covers microwave radar and electronic warfare (EW) receivers from L to Ka band. Automotive radar at 76 to 81 GHz has dedicated simulators such as Keysight's E8718A.

If a test only needs a timed, shaped return at the receiver, a triggered signal generator can run it. If it needs the radar's own transmitted pulse returned, it needs a closed-loop simulator. A signal generator can typically run:

1. Receiver sensitivity and minimum detectable signal.
2. Pulse compression and range sidelobes.
3. Pulse repetition interval (PRI) tracking and pulse descriptor word (PDW) output.
4. Constant false alarm rate (CFAR) behavior against a modeled background.
5. Emitter identification in an EW receiver.

End-to-end coherence checks, pulse-to-pulse waveform changes made by the radar itself, and full-system tests typically need a closed-loop repeater or digital RF memory (DRFM)-based simulator.

Keysight Application Note 5992-0094EN makes the schedule case: lab testing runs early in a program and repeats easily, while flight testing comes later and costs more. For instruments beyond the source, see Keysight test equipment for aerospace and defense.

Compare certified used signal generators, with the E8267D at the top, and request a quote with the options your test plan needs.

A scenario comes down to a trigger, a delay, a waveform, and a level. Bench basics are in how to use a signal generator. Use these steps to set up a target on the E8267D:

1. Define each target's range, velocity, and RCS, along with the radar's carrier, pulse width, PRI, and waveform.
2. Connect the radar's sync to the E8267D trigger input and the RF output to the receiver through the planned attenuation.
3. Set the carrier and the level from the link budget.
4. Build the pulse or chirp (a frequency sweep within the pulse) in N7620B and write the Doppler offset into the I/Q waveform.
5. Set the trigger delay for the opening range, then sequence segments for range steps or added targets.
6. Add calibrated noise with Option 403 to set a known signal-to-noise ratio (up to 15 MHz of noise bandwidth when added to an arbitrary waveform, so noise does not span a wider chirp).
7. Verify level, pulse shape, and the Doppler offset on one of the certified used signal analyzers, which N7620B also uses for waveform corrections, before the receiver sees the signal.

The E8267D is scriptable over LAN or GPIB.

Threat simulation is the EW counterpart to radar target simulation. The receiver under test is a radar warning receiver (RWR) or electronic support measures (ESM) receiver, and the stimulus is a threat emitter, not a cybersecurity breach test. The same E8267D can drive emitter libraries, interleaved pulse trains, and coherent direction-finding tests:

• Emitter libraries stored as up to 8,192 segments and 16,384 sequences with Option 602.
• Several emitters interleaved in one I/Q waveform, within 80 MHz.
• PDW verification: compare the receiver's pulse descriptor words against the programmed PRI, width, and frequency.
• Coherent multi-source direction finding with Option HCC and the U3035P distribution network.

Keysight Application Note 5992-0094EN puts EW receiver loads at 8 to 10 million pulses per second, with most of the pulse density at X band. It traces one source's pulse density limit to its transition time, pulse width, and lockout period. On the E8267D, frequency switching takes under 16 ms typical (under 24 ms with I/Q on, longer with Option UNY), so pulse-to-pulse carrier hops are not practical. Write frequency changes within the 80 MHz baseband into the I/Q waveform instead.

The 2017 Keysight Application Note 5990-8430EN describes a four-port angle-of-arrival threat simulator built around four E8267D units paired with four 81180A AWGs. The system was designed to hold phase accuracy under 1 degree from 100 MHz to 20 GHz at the end of six-foot test cables. That figure is a system requirement, met with network analyzer correction at the unit under test, not an E8267D data sheet specification. Controlled phase shift between ports creates the simulated angle of arrival.

Keysight Application Note 5992-0094EN sets the minimum for angle-of-arrival work as locking the LOs of multiple sources together so they share the same phase, often with a calibration to align phase and timing. A shared 10 MHz reference alone holds the units' frequency, not their phase. For the E8267D, the data sheet lists the customized options HCC (connections for phase coherency above 250 MHz) and H1G (below 250 MHz), the U3035P distribution network for multiple-source phase coherency, and a baseband generator clock input for sharing a clock between units, so confirm the options on each listing. Keysight Application Note 5992-0839EN explains that most vector signal generators lose phase repeatability when the carrier frequency changes, so recalibrate phase alignment after each retune.

One RF output and 80 MHz of internal bandwidth limit scenario density. Dense multi-port scenarios typically call for a dedicated multi-channel threat simulation system. Direction-finding and monopulse benches typically need two or more E8267D units with matching options, including HCC, so request them together.

Serving radar and EW groups from one bench? Request a quote on a certified used E8267D with both test lists and your coherent unit count.

A 2022 Sensors review by Fontana and Di Lauro of the University of Milano-Bicocca lists the IEEE band ranges and calls the S and X bands of great interest for missile defense. Option 544 covers every radar band from L through Ka, and V band from 40 to 44 GHz.

IEEE Std 521-2026, the radar band letter standard, was approved by the IEEE SA Standards Board on June 4, 2026 and is listed by IEEE as superseding 521-2019, so confirm its band boundaries before a qualification document cites them.

The power column is the CW specification, which applies from 15 to 35 °C. With I/Q modulation through Option 602 it is the same above 3.2 GHz and +17 dBm at 0.4 to 3.2 GHz, and lower through Option 016. Check the link budget at 40 to 44 GHz. Automotive radar at 76 to 81 GHz is above the 44 GHz range of the instrument itself. For band-edge wavelengths, use the wavelength to frequency calculator.

Choose the E8257D for CW and simple pulses, including CW above 44 GHz and specified pulses to 50 GHz. Choose the E8267D when the waveform needs I/Q.

Per Keysight data sheet 5989-0698EN, the E8257D PSG analog signal generator is specified to 67 GHz with Option 567. It offers amplitude, frequency, and phase modulation (Option UNT) and pulse modulation (Option UNU or UNW), but no I/Q modulator. A certified used E8257D PSG analog signal generator can cover pulsed sensitivity (levels below -20 dBm need the Option 1E1 step attenuator, table below), local oscillator (LO) substitution, and component drive above 44 GHz. Check installed options per listing. Chirps, coded pulses, and interleaved emitters built with I/Q need the vector unit, as covered in types of signal generators.

Before you compare prices, start with the option codes on the listing. Then confirm the calibration, warranty, and support behind that exact unit.

Send these with your quote request:

• The highest carrier frequency in your band plan.
• The narrowest pulse width you test.
• The widest waveform bandwidth.
• The number of coherent units.
• The option codes you need: 544, 602, UNW, 016, 403, UNX or UNY, HCC, and the N7620B license. N7620B uses a spectrum or signal analyzer to correct images, flatness, and phase linearity, and the configuration guide lists Option 009 removable memory with it, so confirm both.
• The calibration documents your quality office requires.

Keysight Used equipment comes in working condition, with a 90-day warranty and calibration and accessories as listed. Keysight Premium Used equipment is refurbished at the factory that also manufactures and tests new products, passes the same final test as a new product, and comes with full calibration, the same warranty as a new instrument, and a final 101-point quality check. Up to 5 years of warranty options are available.

Keysight reports that 78% of its customers lose more than $25,000 a day when equipment fails, so weigh KeysightCare and warranty options alongside the price.

Options such as UK6 (commercial certificate with test data) and AMG (accredited calibration) are ordering options on a new instrument. For a used unit, check the calibration listed, and add a fresh calibration or a calibration plan through Keysight calibration services if your quality office needs one.

For procurement, Keysight Used pricing runs 40 to 90% below list price. Keysight Application Note 5992-0839EN calls over-specifying the source a potentially costly mistake when older, less expensive equipment could do the job.

Measure trigger-to-RF latency once on your bench before you trust a range setting. Data sheet 5989-0697EN gives the external trigger delay as "10 ns to 40 s plus latency", but it does not give a latency figure, so this guide gives none. The nominal 30 ns video-to-RF delay it lists above 3.2 GHz belongs to the pulse modulator path, not the baseband trigger.

Put the trigger on one oscilloscope channel and the detected RF envelope on another. Read the offset at your carrier and pulse settings, then subtract it from every range setting. Scene fidelity for clutter, multipath, and many targets depends on the waveform model your team builds, not on the generator alone.

Ready to size the bench? Browse certified used microwave signal generators and request a quote with your option list.

If your list is CW and simple pulses, or CW above 44 GHz, the certified used E8257D can cover CW to 67 GHz with Option 567 and specified pulses to 50 GHz with Option UNU or UNW, when the listed unit carries them, without I/Q.