ThinkRF R5700 Manual

ThinkRF R5700/R5750
Real-Time Spectrum Analyzer
with GNSS
Programmer's Guide
Version 1 2 5
Oct 22, 2021
Document no 75-0033-211022
Copyright © 2018-present ThinkRF Corporation, all rights reserved
All product names are trademarks of their respective companies
This document contains information that is proprietary to ThinkRF Corporation

Important notice
The information in this
guide is furnished for
informational use only
and is subject to change
without notice ThinkRF
Corporation assumes no
responsibility or liability
for any errors or
inaccuracies that may
appear in this document
No part of this
publication may be
reproduced, published,
stored in an electronic
database, or transmitted,
in any form or by any
means, electronic,
mechanical, recording,
or otherwise, for any
purpose, without the
prior written permission
of ThinkRF Corporation
Trademarks
ThinkRF, the ThinkRF
logo and R5700/R5750
are trademarks of
ThinkRF Corporation
All other brand or
product names are
trademarks or registered
trademarks of their
respective companies or
owners
ThinkRF Corp
390 March Road
Kanata, ON K2K 0G7
[phone]
HARDWARE WARRANTY AND IMITATION OF IABI ITY
Read this warranty carefully before you use the product.
R5700/R5750 (or R57x0 for short) Real Time Spectrum Analyzers with GNSS are
warranted for workmanship and materials for a period of one (1) year from the date
of shipment as identified by the Customer’s packing slip or carrier waybill ThinkRF
reserves the right to void the warranty on any equipment that has been altered or
damaged due to Customer negligence, unauthorized repair, misuse of equipment,
evidence of physical or environmental damage, transportation abuse or removal of
any ThinkRF identification labels or serial numbers
It will remain the responsibility of the Customer, having obtained a Return Material
Authorization (RMA) and shipping instructions from ThinkRF, to return, at the
Customer's expense, the defective unit to ThinkRF’s repair facilities ThinkRF will
incur shipping charges for the return of warranty repaired equipment The RMA
number can be secured by calling ThinkRF Customer Service and Support (1-613-
369-5104) If the product does not fall within ThinkRF’s warranty period or the
product is found to be functioning as designed, then under the terms of ThinkRF’s
warranty policy, all costs of repairs and shipping will be charged directly to the
Customer ThinkRF will warrant repaired units for a period of 90 days from date of
shipment from ThinkRF to the Customer If the remaining period on the original
hardware warranty is greater than 30 days, then ThinkRF will honor this remaining
warranty period
THINKRF EXPRESSLY DISCLAIMS ALL OTHER WARRANTIES AND
CONDITIONS, WHETHER EXPRESS OR IMPLIED, INCLUDING WITHOUT
LIMITATION, WARRANTIES, CONDITIONS OR REPRESENTATIONS OF
WORKMANSHIP, MERCHANTABILITY, FITNESS FOR A PARTICULAR
PURPOSE, DURABILITY, OR THAT THE OPERATION OF THE HARDWARE OR
LICENSED SOFTWARE WILL BE ERROR FREE IN NO EVENT WILL THINKRF
BE LIABLE FOR INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL
DAMAGES
USE OF PRODUCTS IN HIGH RISK ACTIVITIES
THINKRF PRODUCTS ARE INTENDED FOR STANDARD INDOOR COMMERCIAL
USE WITHOUT THE APPROPRIATE NETWORK DESIGN ENGINEERING, THEY
MUST NOT BE USED FOR ANY “HIGH RISK ACTIVITY”, as described in this
paragraph Customer acknowledges and agrees that the products supplied
hereunder are not fault-tolerant and are not designed, manufactured or intended for
use or resale as on-line control equipment in hazardous environments requiring fail
safe performance including but not limited to the operation of nuclear facilities,
aircraft navigation or communication systems, air traffic control, direct life support
machines, or weapons systems, in which the failure of products could lead directly to
death, personal injury, or severe physical or environmental damage, all of which are
examples of “High Risk Activity” THINKRF AND ITS SUPPLIERS EXPRESSLY
DISCLAIM ANY EXPRESS OR IMPLIED WARRANTY OF FITNESS FOR HIGH
RISK ACTIVITIES
GNU General Public icense
This device contains free firmware: you can redistribute it and/or modify it under the
terms of the GNU General Public License as published by the Free Software
Foundation, either version 2 of the License, or (at your option) any later version
This program is distributed in the hope that it will be useful, but WITHOUT ANY
WARRANTY; without even the implied warranty of MERCHANTABILITY or
FITNESS FOR A PARTICULAR PURPOSE See the GNU General Public License
for more details GNU General Public License is available at
http://www gnu org/licenses

Table of Contents
Abbreviations ................................................................................................................................... 7
ist of Figures .................................................................................................................................. 8
ist of Tables .................................................................................................................................... 9
Preface ............................................................................................................................................... 10
Audience ................................................................................................................................... 10
Conventions ............................................................................................................................ 10
Obtaining Documentation and Releases .......................................................................... 10
Document Feedback .............................................................................................................. 11
Obtaining Technical Assistance ......................................................................................... 11
R57x0 Functional Overview .................................................................................................... 12
System Overview .................................................................................................................... 12
The Architecture ..................................................................................................................... 15
RF Receiver Front-End .......................................................................................................... 17
Direct-Conversion Receiver Technology 18
DC Offset Correction 18
IQ Offset Correction 18
Digital Signal Processing ..................................................................................................... 20
Digital Down Converter 20
Triggers ..................................................................................................................................... 21
Frequency Domain Triggering 21
Periodic Triggering 22
External Triggering 22
Capture Controller .................................................................................................................. 22
Trace Capture Control 23
Sweep Capture Control 23
Synchronized Sweep 25
VITA-49 Radio Transport Protocol ...................................................................................... 27
Purpose ..................................................................................................................................... 27
R57x0's VRT Overview .......................................................................................................... 27
Packet Classes and Streams ............................................................................................... 28
Receiver Context Packet Class 28
Context Field Change Indicator 30
RF Reference Frequency 30
Gain 30
Digitizer Context Packet Class 30
Context Field Change Indicator 32
Bandwidth 32
RF Frequency Offset 32
Reference Level 32
Formatted GPS Geolocation 33
Extension Context Packet Class 35
Context Field Change Indicator 36
IQ Swapped Indicator 36
New Stream Start ID 37
New Sweep Start ID 37
IF Data Packet Class 37

Picosecond Timestamp Words Format 39
Data Payload Format 39
Trailer Word Format 40
SCPI Command Set ..................................................................................................................... 43
SCPI anguage Overview ..................................................................................................... 43
IEEE Mandated SCPI Commands ....................................................................................... 44
*CLS 44
*ESE/*ESE? 44
*ESR? 45
*IDN? 45
*OPC/*OPC? 45
*RST 45
*SRE/*SRE? 46
*STB? 46
*TST? 46
*WAI 47
SYSTem Commands .............................................................................................................. 47
:SYSTem:ABORt 47
:SYSTem:CAPTure:MODE? 47
:SYSTem:COMMunicate:HISLip:SESSion? 48
:SYSTem:COMMunicate:LAN:APPLy 48
:SYSTem:COMMunicate:LAN:CONFigure 48
:SYSTem:COMMunicate:LAN:DEFault 49
:SYSTem:COMMunicate:LAN:DNS 49
:SYSTem:COMMunicate:LAN:GATEway 50
:SYSTem:COMMunicate:LAN:IP 50
:SYSTem:COMMunicate:LAN:MTU 51
:SYSTem:COMMunicate:LAN:NETMask 51
:SYSTem:COMMunicate:NTP 52
:SYSTem:ERRor[:NEXT]? 52
:SYSTem:ERRor:ALL? 52
:SYSTem:ERRor:CODE[:NEXT]? 53
:SYSTem:ERRor:CODE:ALL? 53
:SYSTem:ERRor:COUNt? 53
:SYSTem:FLUSh 54
:SYSTem:LOCK:HAVE? 54
:SYSTem:LOCK:REQuest? 55
:SYSTem:OPTions? 55
:SYSTem:SYNC:MASTer 56
:SYSTem:SYNC:WAIT 56
:SYSTem:VERSion? 56
:SYSTem:DATE 57
:SYSTem:TIME 57
:SYSTem:TIME:ADJust 58
:SYSTem:TIME:SYNC 58
STATus Commands ............................................................................................................... 59
:STATus:OPERation[:EVENt]? 60
:STATus:OPERation:CONDition? 60
:STATus:OPERation:ENABle 61
:STATus:OPERation:NTRansition 61
:STATus:OPERation:PTRansition 61
:STATus:PRESET 62
:STATus:QUEStionable[:EVENt]? 62
:STATus:QUEStionable:CONDition? 62
:STATus:QUEStionable:ENABle 63

:STATus:QUEStionable:NTRansition 63
:STATus:QUEStionable:PTRansition 63
:STATus:TEMPerature? 64
INPut Commands .................................................................................................................... 64
:INPut:ATTenuator 64
:INPut:ATTenuator:VARiable 65
:INPut:GAIN 65
:INPut:GAIN:HDR 66
:INPut:MODE 66
SOURce Commands .............................................................................................................. 67
:SOURce:REFerence:PLL 67
:SOURce:REFerence:PPS 68
SENSe Commands ................................................................................................................. 68
[:SENSe]:DECimation 68
[:SENSe]:FREQuency:CENTer 69
[:SENSe]:FREQuency:IF? 70
[:SENSe]:FREQuency:LOSCillator? 70
[:SENSe]:FREQuency:SHIFt 71
[:SENSe]:LOCK:REFerence? 71
[:SENSe]:LOCK:RF? 72
GNSS Commands ................................................................................................................... 72
:GNSS[:ENABle] 72
:GNSS:ADELay 73
:GNSS:CONStellation 73
:GNSS:DYNamic:MODE 74
:GNSS:POSition? 75
:GNSS:REFerence? 76
TRIGger Commands .............................................................................................................. 76
:TRIGger:TYPE 76
:TRIGger:LEVel 77
:TRIGger:PERiodic 78
TRACe Commands ................................................................................................................. 78
:TRACe:BLOCk:DATA? 79
:TRACe:BLOCk:PACKets 79
:TRACe:SPPacket 80
:TRACe:STReam:STARt 81
:TRACe:STReam:STOP 81
SWEep Commands ................................................................................................................ 82
:SWEep:LIST:ITERations 83
:SWEep:LIST:STARt 83
:SWEep:LIST:STATus? 84
:SWEep:LIST:STOP 84
:SWEep:ENTRy:COPY 84
:SWEep:ENTRy:COUNt? 85
:SWEep:ENTRy:DELETE 85
:SWEep:ENTRy:NEW 85
:SWEep:ENTRy:READ? 85
:SWEep:ENTRy:SAVE 86
:SWEep:ENTRy:ATTenuator 86
:SWEep:ENTRy:ATTenuator:VARiable 87
:SWEep:ENTRy:DECimation 87
:SWEep:ENTRy:FREQuency:CENTer 87
:SWEep:ENTRy:FREQuency:STEP 87
:SWEep:ENTRy:FREQuency:SHIFt 88

:SWEep:ENTRy:GAIN:HDR 88
:SWEep:ENTRy:MODE 88
:SWEep:ENTRy:DWELl 88
:SWEep:ENTRy:PPBlock 89
:SWEep:ENTRy:SPPacket 89
:SWEep:ENTRy:TRIGger:LEVel 89
:SWEep:ENTRy:TRIGger:TYPE 89
Appendix A: Connecting to RTSA ...................................................................................... 90
Simple 2-port TCP/IP Connection ....................................................................................... 90
Connection Using HiS IP ..................................................................................................... 91
Appendix B: Protocols for Discovering RTSA ............................................................. 94
Discovery Using mDNS/DNS-SD ........................................................................................ 94
Discovery Using Broadcast UDP ........................................................................................ 94
Appendix C: SCPI Command Syntax ................................................................................ 96
Entering Commands .............................................................................................................. 96
Multiple Commands in a Single Message 96
Notation .................................................................................................................................... 97
Parameter types ...................................................................................................................... 97
Default Units ............................................................................................................................ 98
Appendix D: SCPI Status and Event Registers ........................................................... 99
Status Byte Register (SBR) .................................................................................................. 99
Standard Event Status Register (ESR) .............................................................................. 99
Operational Status Register (OSR) .................................................................................. 100
Questionable Status Register (QSR) ............................................................................... 100
Output Queue ........................................................................................................................ 101
Error and Event Queue ....................................................................................................... 101
Appendix E: SCPI Error Codes Used .............................................................................. 102
Appendix F: SCPI Commands Quick Reference ....................................................... 103
R55x0 vs. R57x0 ist of Changes ...................................................................................... 109
References ..................................................................................................................................... 110
Document Revision History ................................................................................................. 111

Abbreviations
ADC Analog-to-Digital Converter
API Application Programming Interface
CIC Cascaded Integrator-Comb
DC Direct Current
DD Direct Digitizer
DDC Digital Down Converter
DDS Direct Digital Synthesizer
DSP Digital Signal Processing
FFT Fast Fourier Transform
FIR Finite Impulse Response
FPGA Field-Programmable Gate Array
GNSS Global Navigation Satellite System
GPIO General Purpose Input/Output
GPS Global Positioning System
GUI Graphical User Interface
HDR High Dynamic Range
IBW Instantaneous Bandwidth
IEEE Institute of Electrical and Electronics Engineers
IF Intermediate Frequency
IQ In-phase and Quadrature
AN Local Area Network
MB Mega-Bytes
MSB Most Significant Byte
MSa Mega-Samples
NB Narrowband
NCO Numerically Controlled Oscillator
NTP Network Time Protocol
NTPD Network Time Protocol Daemon
P Phase-Locked Loop
RF Radio Frequency
RFE Receiver Front-End
RTSA Real Time Spectrum Analyzer
Sa/s Samples-per-Second
SCPI Standard Commands for Programmable Instruments
SH Super-Heterodyne
SHN Super-Heterodyne with narrower bandwidth
TCP/IP Transmission Control Protocol/Internet Protocol
TD Time Domain
TSF TimeStamp-Fractional
TSI TimeStamp-Integer
TSM TimeStamp Mode
UTC Coordinated Universal Time
VCO Voltage Control Oscillator
VRT VITA-49 Radio Transport
WB Wideband
ZIF Zero Intermediate Frequency

ist of Figures
Figure 1: R57x0 Functional Block Diagram 13
Figure 2: RF Receiver Front-end and Capture Controller Functional Block Diagram 16
Figure 3: DC Offset with Amplitude Roll-Off at +50MHz 18
Figure 4: IQ Offset Correction 19
Figure 5: DDC Functional Block Diagram 20
Figure 6: Association between Time and Frequency Domain 21
Figure 7: Synchronized Sweep using Sync-Word 25
Figure 8: Synchronized Sweep with a Missed Capture 26
Figure 9: Connectivity and 4 Different Packet Streams Supported by R57x0 27
Figure 10: An Example Illustrating Uninverted and Inverted Spectrums 42
Figure 11: SCPI Language Hierarchical or Tree Structure Example 43
Figure 12: SCPI Measurement Function Block 44
Figure 13: Status Reporting Structure with Status & Enable Registers 59
Figure 14: 2-port TCP/IP connection to RTSA 90
Figure 15: HiSLIP and TCP connections to RTSA 92

ist of Tables
Table 1: System Level Control/Status Commands with GNSS 13
Table 2: Radio RFE Modes and DSP Data Output Formats 17
Table 3: RF Front-End Control/Status Commands 19
Table 4: Trigger Control/Status Commands 22
Table 5: Trace Capture Control Commands 23
Table 6: Sweep Capture Control/Status Interface 24
Table 7: The Categories of VRT Packet Streams Supported by ThinkRF's R57x0 27
Table 8: A List of Stream Identifiers as Used by ThinkRF for Different Packet Classes 28
Table 9: Receiver Context Packet Class Structure 29
Table 10: Receiver Context Indicator Field Positions 29
Table 11: Receiver Context Field Definition and Values 29
Table 12: RF Reference Frequency Word Format 30
Table 13: Gain Field Format 30
Table 14: Digitizer Context Packet Class Structure 31
Table 15: Digitizer Context Indicator Field Bit Positions 31
Table 16: Digitizer Context Field Values 32
Table 17: Bandwidth Word Format 32
Table 18: RF Frequency Offset Word Format 32
Table 19: Reference Level Field Format 33
Table 20: Formatted GPS Geolocation Fields 34
Table 21: Geolocation Angle (Degrees) Format 34
Table 22: Altitude Subfield Format 35
Table 23: Speed Over Ground Subfield Format 35
Table 24: Extension Context Packet Class Structure 35
Table 25: Extension Context Indicator Field Positions 36
Table 26: Extension Context Field Definition and Values 36
Table 27: IQ Swapped Field Format 37
Table 28: New Stream Start ID Field Format 37
Table 29: New Sweep Start ID Field Format 37
Table 30: Output Data Width and Packing Method for Different Data Formats 38
Table 31: IF Data Class Field Values 38
Table 32: Stream Identifier Values for Different Data Output Formats 38
Table 33: 64-bit or Two Words Picosecond Timestamp Format 39
Table 34: {I14Q14} Data Payload Arrangement with Upper 2-bit Signed Extended to {I16 Q16} 39
Table 35: {I14} Data Payload Arrangement with Upper 2-bit Signed Extended to {I16} 40
Table 36: {I24} Data Payload Arrangement with Upper 8-bit Signed Extended to {I32} 40
Table 37: Trailer Word Format 40
Table 38: Trailer Indicator and Enable Bits 41
Table 39: Conditions Causing Abnormal Indicator State and Suggested Resolution 42
Table 40: RTSA Option Codes and the Corresponding Description 56
Table 41: Performance of The Gain Settings of R57x0-418, 427 and Their Variants 66
Table 42: Dynamic Platform Models Supported by the GNSS Module 74
Table 43: Dynamic Platform Model Details 75
Table 44: Maximum Threshold Level Where +/-3 dBm Error or Less Still Hold For A Given Attenuation
Level 77
Table 45: Max, Min, and Required Multiples for SPP and Samples-per-word for Different Data Output
Format 80
Table 46: HiSLIP Message Header Format 92
Table 47: ThinkRF Vendor Specific Message Type Value Definitions 92
Table 48: ThinkRF Data Channel Initialization Transaction 92

Preface
This preface describes the audience for, the organization of, and conventions used in this
document It also identifies related documentation and explains how to access electronic
documentation
Audience
This document is written for software developers wishing to develop and/or maintain a
software interface to the R5700/R5750 and who have a basic understanding, familiarity
and experience with network test and measurement equipment
Conventions
This section describes the conventions used in this document
Grayed-out Font
Indicates a command or a feature is not yet available in the current release
Courier Font
Illustrates this is an example for a command or a concept
Light Blue Font
Contains hyperlink to the referenced source that can be clicked on
Normal Bold Font
When used within a sentence or a paragraph, it emphasizes an idea to be paid attention
to particularly
Red Font
Conveys special information of that section
Note: This symbol means take note Notes contain helpful suggestions or references to
additional information and material
Caution: This symbol means be careful In this situation, you might do something that
could result in equipment damage or loss of data
Warning: This symbol means danger You are in a situation that could cause bodily
injury Before you work on any equipment, be aware of the hazards involved with
electrical circuitry and be familiar with the standard practices for preventing accidents
Obtaining Documentation and Releases
You can access the most current ThinkRF documentation and the latest release bundles
at http://www thinkrf com/resources

Document Feedback
Please send your comments about this document or our other documentation to
support@thinkrf com
Thank you, we appreciate your comments
Obtaining Technical Assistance
The ThinkRF Support website provides online documents for resolving technical issues
with ThinkRF products at www thinkrf com/resources
For all customers who hold a valid end-user license, ThinkRF provides technical
assistance 9 AM to 5 PM Eastern Time, Monday to Friday Contact us at
www thinkrf com/support/ or by calling +1.613.369.5104
Before contacting Support, please have the following information available:
•R57x0's serial number and product version, which are located on the identification
label on the R57x0's underside
•The firmware version running on the R57x0
•Versions of ThinkRF software you are using, potentially including the S240, API
libraries to third-party applications
•The operating system and version you are using

R57x0 Functional Overview
R57x0 Functional Overview
This section overviews the R57x0's functionality and protocols used, and summarizes the
SCPI command sets for controlling the individual functions
Note: This is a living and evolving document. We welcome your feedback.
The features and functionality described in this section may exist in the current product
firmware release or are scheduled for a future product firmware release (grayed out
commands and/or text) Please refer to Appendix F: SCPI Commands Quick Reference
for the complete list of commands and the availability information No hardware upgrade
is required at each feature release (unless specified though unlikely)
System Overview
The R5700/R5750 (or R57x0 for short) Real Time Spectrum Analyzer (RTSA) with GNSS
(Global Navigation Satellite System) provides the benefits of a high-performance
software-defined RF receiver, digitizer and analyzer along with integrated GNSS
technology offering location and time information in one package With patent-pending
software-defined RF receiver technology, the RTSA provides industry leading combined
sensitivity, tuning range, wide instantaneous bandwidth (IBW) and scan rate
Additionally, it provides real-time sophisticated triggering and capture control Figure 1
illustrates an RTSA solution system example
The R57x0 is designed for stand-alone, remote and/or distributed wireless signal
analysis Whether using as a single unit or a network of radio sensors, R57x0 is ideal for
monitoring, management and surveillance of transmitters, whether they are in-building or
spread across a geographic area Applications include, but are not limited to:
•5G wireless technology;
•test and measurement;
•monitoring and surveillance;
•research;
•OEM integration
The R57x0 hardware largely consists of:
•a hybrid super-heterodyne, direct-conversion and direct-digitization RF receiver
front-end (RFE);
•receiver front end inputs and outputs to support clock synchronization, and IF
outputs for high-end digitization;
•a 125 MSamples/sec 14-bit wideband (WB) ADC with a dynamic range of greater
than 70 dB;
•a 325 kSamples/sec 24-bit narrowband (NB) ADC with a dynamic range in excess
of 100 dB;
•a GNSS module with embedded 10MHz reference clock source for further RTSA’s
time synchronization;
•a Xilinx's Zynq FPGA with built-in dual-core ARM®-based processor, Gigabit
Ethernet interface and custom embedded digital signal processing (DSP) logic;
ThinkRF R5700/R5750 Real Time Spectrum Analyzer Programmer's Guide 12

R57x0 Functional Overview
•1 GB of DDR3 shared between firmware and real-time caching of digitized data;
•a general purpose input/output (GPIO) port
Figure 1: R57x0 Functional Block Diagram
ThinkRF's products conform with standardized protocols for interoperability ThinkRF
provides application programming interfaces (APIs) designed for easy integration with
third-party applications Standard protocols include the Standard Commands for
Programmable Instruments (SCPI) protocol (page 43) for controlling and obtaining status
from the RTSA and the VITA-49 Radio Transport (VRT) protocol (page 27) for digitized
data and its associated context information
In addition, API libraries, written in C/C++, Python, MATLAB and/or NI LabVIEW, are
provided for quick interfacing, data acquisition and as well as for spectral analysis The
Python API is built within the PyRF development framework and is open-source under
BSD licensing PyRF handles the low-level details of real-time acquisition, signal
processing and visualization, and provides feature rich libraries, example applications
and source code, all specific to the requirements of signal analysis Usage examples are
provided through the available source codes of the Graphical User Interfaces (GUIs) or
any applications included in each release package
Refer to Appendix A for how to connect to an RTSA and Appendix B for the protocol on
how to find any RTSAs available on the local network The source code provided for the
aforementioned APIs and GUIs/applications would serve as examples
The R57x0 provides system level control and status commands as defined in Table 1
Table 1: System Level Control/Status Commands with GNSS
SCPI Command Description
:SYSTem Page 47
:ABORt Aborts the current data capturing process and puts the RTSA system into
a normal manual mode (i e sweep, trigger, and streaming will be aborted)
:CAPTure
13 ThinkRF R57x0 Real Time Spectrum Analyzer Programmer’s Guide

R57x0 Functional Overview
SCPI Command Description
:MODE? Gets the current capture mode of the RTSA (i e sweeping, streaming or
block mode)
:COMMunicate
:HISLip
:SESSion? Returns the HiSLIP connection’s session ID
:LAN<commands> Subset of commands for configuring/querying RTSA's LAN settings
:ERRor
[:NEXT]? Returns the next error code and message from the SCPI error/event
queue
:ALL? Returns all the error codes and messages from the SCPI error/event
queue
:CODE
[:NEXT]? Returns next the error code from the SCPI error/event queue
:ALL? Returns all the error codes from the SCPI error/event queue
:COUNt? Returns the number of errors in the SCPI error/event queue
:FLUSh Clears the R57x0's internal data storage buffer of any remaining data that
has not transferred out of the RTSA
:LOCK
:HAVE? Returns the current lock state of the task specified
:REQuest? Requests the R57x0 to provide a lock on a specific task such that only the
application that has the lock can perform the task
:OPTions? Returns comma separated 3-digit values to represent the hardware
option(s) or features available with a particular RTSA model
:SYNC
:MASTer[?] Sets an RTSA unit to be the master or slave for a synchronization trigger
system with multiple units Affects :TRIGger:TYPE PULSe or WORD
:WAIT[?] Sets the delay time in nanoseconds that the system must wait after
receiving the trigger signal before performing data capture
:VERSion? Returns the SCPI version number that the instrument complies with
:DATE[?] Sets/reads date
:TIME[?] Sets/reads time
:SYNC[?] Sets/ gets the System time synchronization source via network or SCPI,
or disable
:STATus Page 59
:OPERation
[:EVENt]? Queries the Operation Status Register for any operation event
:CONDition? Queries the Operation Condition Register for any operation event
:ENABle[?] Enables or queries bits in the Operation Enable Register
:NTRansition[?] Enables or queries bits in the Operation Negative Transition Register
:PTRansition[?] Enables or queries bits in the Operation Positive Transition Register
:PRESET Presets the R57x0 (similar to *RST)
:QUEStionable
[:EVENt]? Queries the Questionable Status Register for any questionable event
:CONDition? Queries the Questionable Condition Register for any questionable event
:ENABle[?] Enables or queries bits in the Questionable Enable Register
:NTRansition[?] Enables or queries bits in the Questionable Negative Transition Register
ThinkRF R5700/R5750 Real Time Spectrum Analyzer Programmer's Guide 14

R57x0 Functional Overview
SCPI Command Description
:PTRansition[?] Enables or queries bits in the Questionable Positive Transition Register
:TEMPerature? Returns the R57x0's internal ambient temperature
:GNSS Page 72
[:Enable][?] Enables or queries the status of the GNSS module
:ADELay[?] Sets/reads antenna cable delay compensation
:CONStellation[?] Sets one or two satellite constellations to be tracked or reads back
:DYNamic
:MODE[?] Sets/queries the dynamic platform model of the GNSS module
:POSition Queries the last known GNSS position in degrees latitude, degrees
longitude and altitude in meters
:REFerence? Queries which timing reference source used to discipline the 10 MHz
GNSS reference oscillator
See SCPI Command Set section (page 43 onward) for further details on the commands
Caution pertaining to multi-users: See Appendix A: Connecting to RTSA for important
notes on this caution
The Architecture
The R57x0 is an integrated wireless radio receiver, digitizer/analyzer and GNSS
technology It has an embedded capture controller that enables users to:
•define and execute real-time and sophisticated triggers, traces and sweeps;
•configure the radio RFE and DSP in association with those traces or sweeps;
•obtain device’s location position and time as provided by the GNSS through VRT
packets (page 33); and
•have time-stamped with data output
Traces and sweeps are controlled by the capture controller as illustrated in the Digitizer
portion of Figure 2 A trace and a sweep are defined as a single (block or continuously
streamed) capture and a series of captures, respectively, each with their associated
hardware configurations
When the GNSS module is enabled, GNSS position and time information is sent to users
through VRT context packets roughly every second (see VRT’s Formatted GPS
Geolocation section) Besides two existing internal and external 10 MHz reference clock
sources, the GNSS module also provides a third 10MHz reference clock source option to
provide synchronized time-stamp for VRT packets (see SOURce Commands)
15 ThinkRF R57x0 Real Time Spectrum Analyzer Programmer’s Guide

R57x0 Functional Overview
Figure 2: RF Receiver Front-end and Capture Controller Functional Block Diagram
(Note: The GPS (GNSS) o tion is included in R57x0, but no I/Q Out and HIF)
The R57x0 supports different RFE modes of operation and subsequent DSP capabilities
as per Table 2 and as described in the following subsections
ThinkRF R5700/R5750 Real Time Spectrum Analyzer Programmer's Guide 16

R57x0 Functional Overview
Table 2: Radio RFE Modes and DSP Data Output Formats
Mode Description Freq
Range
(MHz)
IBW3
(MHz)
Ouput
Format
(No DSP)
DSP Data Output Format
Decim-
ation
Frequency
Shift
IBW3
(MHz)
ZIF Zero-IF
Receiver
50 - max 100 I14 Q14 I14 Q14 I14 Q14 100 /
decimation
SH Super-
Heterodyne
Receiver
50 - max 40 I14 I14 Q141I14 Q14 100 /
decimation
SHN SH Receiver
with narrower
BW
50 - max 10 I14 I14 Q141I14 Q14 100 /
decimation
HDR High Dynamic
Range
Receiver
50 - max 0 1 I24 – – –
DD Direct
Digitization
Receiver
0 009 -
502
50 I14 I14 I14 Q14 No shifting:
50 / dec
With shifting:
100 / dec
1 For SH and SHN modes, when the decimation is used, a frequency shift of 35MHz will be applied
automatically to bring the R57x0's center frequency back to the zero IF Thus, the data output will
be I and Q
2 In DD mode, there is no frequency tuning except for performing frequency shift When
decimation is applied, the decimation will be around the DD’s center frequency of 0 Hz, plus the
frequency shift value when used
3 IBW here refers also to the usable operating BW of the full hardware BW (which is of the sample
rate, varies depending on the RFE mode and I/Q format)
R57x0 complies to VRT protocol for sending digitized IF data packets and their
associated context information depending on the capture mode It is very important to
follow the VRT's IF Data Packet Class section (page 37) for the exact VRT data output
formats as well as packing method
RF Receiver Front-End
The Receiver portion of Figure 2 shows a block diagram of the RFE within the R57x0
The architecture consists of a super-heterodyne (SH) front-end with a back-end that
utilizes an I/Q mixer similar to that in a direct-conversion (or zero-IF) receiver
Depending on the frequency of the signals being analyzed, one of the three receiver
signal processing paths is selected Signals in the frequency range 9kHz to 50MHz are
directly digitized, while all other signals are translated to the frequencies of the first IF
block via one of the other two signal processing paths The IF block consists of a bank of
multiple SAW filters SAW filter selection depends on the frequency of the input signal
The output of the SAW filter feeds the I/Q mixer
The three signal processing paths are further classified into different modes of operation
for the capture engine as shown in Table 2 The radio modes ZIF, SH, SHN and HDR
support tuning the center frequency from 50MHz to the maximum frequency supported by
the particular product model (ex 8GHz, 18GHz, and 27GHz for R57x0-408, -418, and -
427, respectively)
The ZIF, SH and SHN radio modes support a tuning resolution of 10Hz Digital
frequency shifting is then used to enhance the tuning resolution to the nearest 1Hz
17 ThinkRF R57x0 Real Time Spectrum Analyzer Programmer’s Guide

R57x0 Functional Overview
(±0 23Hz) The frequency shifting technology used is an embedded Numerically
Controlled Oscillator (NCO) based Direct Digital Synthesizer (DDS) as described in the
Digital Down Converter subsection
The HDR radio mode supports a tuning resolution of 10Hz No further fine tuning is
available
The remaining radio mode, DD, supports 50MHz IBW Direct Digitization of the baseband
from the external RF IN Hence, this mode does not support frequency tuning of the
radio although the DSP's frequency shift mode may be applied
Direct-Conversion Receiver Technology
Direct-conversion (or ZIF) receivers are ideal for signal analysis of wideband waveforms,
such as 4G/5G/LTE, Wi-Fi and Bluetooth With that benefit comes the drawback of both
IQ and DC offsets which are inherent to direct-conversion technology
DC Offset Correction
The R57x0's WB ADC sampling rate is 125 MSa/s, intermediate frequency (IF) is 0 and
the entire IF bandwidth is 125MHz The analog filter results in an amplitude roll-off at
approximately +50MHz around the center frequency Fc, as illustrated in Figure 3
Direct-conversion receivers have a DC offset at the center of the band The offset is
primarily compensated for in real-time in the receiver hardware but there always is some
residual offset that (depending on the application and bandwidth of interest) might need
to be compensated for in software Several options such as calibration or dynamic offset
compensation in software have been described in the open literature
D C
O f f s e t
F c - 5 0 M H z F c + 5 0 M H z
1 2 5 M H z
F c
A n a l o g f i l t e r
Figure 3: DC Offset with Amplitude Roll-Off at +50MHz
If the application only needs to utilize up to 50MHz of IBW, a simple alternative to DC
offset compensation is to use the SH mode of operation
IQ Offset Correction
Direct-conversion receivers have phase and/or amplitude offsets between in-phase (I)
and quadrature (Q) components of the baseband signal Due to this, when an FFT is
performed on digitized baseband data where there is a signal tone present, there will be
an ‘image’ at the same frequency offset from the center frequency as the tone itself This
is illustrated in Figure 4
ThinkRF R5700/R5750 Real Time Spectrum Analyzer Programmer's Guide 18

R57x0 Functional Overview
S i g n a l
I m a g e
X d B
F r e q u e n c y
F
c
F r e q u e n c y
F
c
F c + F s
F c - F s
c a l i b r a t e I Q
Figure 4: IQ Offset Correction
A correction algorithm would be needed to adjust this offset necessary for signal analysis,
especially for the ZIF mode The ThinkRF's APIs have included a correction
Table 3: RF Front-End Control/Status Commands
SCPI Command Description
:INPut Page 64
:ATTenuator[?] Enables/disables the front-end's attenuation for R57x0-408 & their
variants only
:VARiable[?] Sets the variable attenuation for R57x0-418 and -427 & their variants
:GAIN[?] Sets the input gain stage for R57x0-418, -427 & their variants
:HDR[?] Sets gain level for the NB ADC of of the HDR signal path
:MODE[?] Selects the receiver mode of operation
:SOURce Page 67
:REFerence
:PLL[?] Selects the 10MHz reference clock source
:PPS[?] Selects the PPS input source
[:SENSe] Page 68
:DECimation[?] Sets the decimation rate as an exponent of 2 (i e rate = 2level where level =
0, 1, 2 - 10)
:FREQuency
:CENTer[?] Sets the center frequency of the RFE
:IF? Queries the IF frequencies that are used for the current input mode and
center frequency
:LOSCillator? Gets the frequency of the external LO 1, 2 or 3 in corresponding to
current the RTSA's center frequency
:SHIFt[?] Sets the frequency shift value (not available for HDR mode)
:LOCK
:REFerence? Queries the lock status of the PLL reference clock
19 ThinkRF R57x0 Real Time Spectrum Analyzer Programmer’s Guide

R57x0 Functional Overview
SCPI Command Description
:RF? Queries the lock status of the RFE's PLL
See SCPI Command Set section (page 43 onward) for further details on each set of
commands
Digital Signal Processing
The R57x0 has embedded DSP blocks to provide further signal processing capabilities,
such as DDC with up to 10 levels of decimation and FFT computation
Digital Down Converter
The DDC block takes the frequency band of interest and shifts it down in frequency, then
provides decimation of the sampling rate to one that is lower and consistent with the
bandwidth of the signal of interest This enables channelization of signals having
bandwidth smaller than the IBW
Referring to Figure 5, the DDC has two major elements, an NCO (DDS) and a down
sampling with filtering The NCO generates a complex sinusoid, which is mixed with the
IQ input using a complex multiplier, to shift or offset the signal spectrum from the selected
carrier frequency This process provides the frequency fine-tuning (and shifting) feature
as mentioned in the previous subsections
Figure 5: DDC Functional Block Diagram
The complex multiplication is then followed by either a finite impulse response (FIR) filter
or cascaded integrator-comb (CIC) filters with a FIR filter combined The CIC filter has a
‘droop’ associated with it in the passband In order to compensate for this droop, the CIC
filter is followed by a compensating FIR filter Each filter type has its own decimator
This whole process effectively reduces the sample rate and filters the signal to remove
adjacent channels, minimize aliasing, and maximize the received signal-to-noise ratio
Note: The use of the NCO converts the in-phase signal (I data) input of the receiver's
DD, SH and SHN processing paths to complex I and Q data output See Table 2
ThinkRF R5700/R5750 Real Time Spectrum Analyzer Programmer's Guide 20
NCO (DDS)
fsfs
fsIout
Qout
Iin
Qin