ThinkRF R5700 Manual

ThinkRF R5700
Real-Time Spectrum Analyzer
with GNSS
Programmer's Guide
Version 1 0 0
October 20, 2018
Document no 75-0033-181020
Copyright © 2018 ThinkRF Corporation, all rights reserved
All product names are trademarks of their respective companies
This document contains information that is proprietary to ThinkRF Corporation

Important notice
The information in this
guide is furnished for
informational use only
and is subject to change
without notice ThinkRF
Corporation assumes no
responsibility or liability
for any errors or
inaccuracies that may
appear in this document
No part of this
publication may be
reproduced, published,
stored in an electronic
database, or transmitted,
in any form or by any
means, electronic,
mechanical, recording,
or otherwise, for any
purpose, without the
prior written permission
of ThinkRF Corporation
Trademarks
ThinkRF, the ThinkRF
logo and R5700 are
trademarks of ThinkRF
Corporation
All other brand or
product names are
trademarks or registered
trademarks of their
respective companies or
owners
ThinkRF Corp
390 March Road
Kanata, ON K2K 0G7
[phone]
HARDWARE WARRANTY AND LI ITATION OF LIABILITY
Read this warranty carefully before you use the product.
R5700 Real Time Spectrum Analyzers with GNSS are warranted for workmanship
and materials for a period of one (1) year from the date of shipment as identified by
the Customer’s packing slip or carrier waybill ThinkRF reserves the right to void the
warranty on any equipment that has been altered or damaged due to Customer
negligence, unauthorized repair, misuse of equipment, evidence of physical or
environmental damage, transportation abuse or removal of any ThinkRF
identification labels or serial numbers
It will remain the responsibility of the Customer, having obtained a Return Material
Authorization (RMA) and shipping instructions from ThinkRF, to return, at the
Customer's expense, the defective unit to ThinkRF’s repair facilities ThinkRF will
incur shipping charges for the return of warranty repaired equipment The RMA
number can be secured by calling ThinkRF Customer Service and Support (1-613-
369-5104) If the product does not fall within ThinkRF’s warranty period or the
product is found to be functioning as designed, then under the terms of ThinkRF’s
warranty policy, all costs of repairs and shipping will be charged directly to the
Customer ThinkRF will warrant repaired units for a period of 90 days from date of
shipment from ThinkRF to the Customer If the remaining period on the original
hardware warranty is greater than 30 days, then ThinkRF will honor this remaining
warranty period
THINKRF EXPRESSLY DISCLAIMS ALL OTHER WARRANTIES AND
CONDITIONS, WHETHER EXPRESS OR IMPLIED, INCLUDING WITHOUT
LIMITATION, WARRANTIES, CONDITIONS OR REPRESENTATIONS OF
WORKMANSHIP, MERCHANTABILITY, FITNESS FOR A PARTICULAR
PURPOSE, DURABILITY, OR THAT THE OPERATION OF THE HARDWARE OR
LICENSED SOFTWARE WILL BE ERROR FREE IN NO EVENT WILL THINKRF
BE LIABLE FOR INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL
DAMAGES
USE OF PRODUCTS IN HIGH RISK ACTIVITIES
THINKRF PRODUCTS ARE INTENDED FOR STANDARD INDOOR COMMERCIAL
USE WITHOUT THE APPROPRIATE NETWORK DESIGN ENGINEERING, THEY
MUST NOT BE USED FOR ANY “HIGH RISK ACTIVITY”, as described in this
paragraph Customer acknowledges and agrees that the products supplied
hereunder are not fault-tolerant and are not designed, manufactured or intended for
use or resale as on-line control equipment in hazardous environments requiring fail
safe performance including but not limited to the operation of nuclear facilities,
aircraft navigation or communication systems, air traffic control, direct life support
machines, or weapons systems, in which the failure of products could lead directly to
death, personal injury, or severe physical or environmental damage, all of which are
examples of “High Risk Activity” THINKRF AND ITS SUPPLIERS EXPRESSLY
DISCLAIM ANY EXPRESS OR IMPLIED WARRANTY OF FITNESS FOR HIGH
RISK ACTIVITIES
GNU General Public License
This device contains free firmware: you can redistribute it and/or modify it under the
terms of the GNU General Public License as published by the Free Software
Foundation, either version 2 of the License, or (at your option) any later version
This program is distributed in the hope that it will be useful, but WITHOUT ANY
WARRANTY; without even the implied warranty of MERCHANTABILITY or
FITNESS FOR A PARTICULAR PURPOSE See the GNU General Public License
for more details GNU General Public License is available at
http://www gnu org/licenses

Table of Contents
Abbreviations ................................................................................................................................... 7
List of Figures .................................................................................................................................. 8
List of Tables .................................................................................................................................... 9
Preface ............................................................................................................................................... 10
Audience ................................................................................................................................... 10
Conventions ............................................................................................................................ 10
Obtaining Documentation and Releases .......................................................................... 10
Document Feedback .............................................................................................................. 11
Obtaining Technical Assistance ......................................................................................... 11
R5700 Functional Overview .................................................................................................... 12
System Overview .................................................................................................................... 12
The Architecture ..................................................................................................................... 15
RF Receiver Front-End .......................................................................................................... 17
Direct-Conversion Receiver Technology 17
DC Offset Correction 17
IQ Offset Correction 18
Digital Signal Processing ..................................................................................................... 19
Digital Down Converter 19
Triggers .................................................................................................................................... 20
Frequency Domain Triggering 20
Periodic Triggering 21
External Triggering 21
Capture Controller ................................................................................................................. 22
Trace Capture Control 22
Sweep Capture Control 23
Synchronized Sweep 24
VITA-49 Radio Transport Protocol ...................................................................................... 26
Purpose .................................................................................................................................... 26
R5700's VRT Overview .......................................................................................................... 26
Packet Classes and Streams ............................................................................................... 27
Receiver Context Packet Class 27
Context Field Change Indicator 29
RF Reference Frequency 29
Gain 29
Temperature 29
Digitizer Context Packet Class 30
Context Field Change Indicator 31
Bandwidth 31
RF Frequency Offset 31
Reference Level 32
Formatted GPS Geolocation 32
Extension Context Packet Class 34

Context Field Change Indicator 35
IQ Swapped Indicator 35
New Stream Start ID 36
New Sweep Start ID 36
IF Data Packet Class 36
Picosecond Timestamp Words Format 37
Data Payload Format 37
Trailer Word Format 39
SCPI Command Set ..................................................................................................................... 42
SCPI Language Overview ..................................................................................................... 42
IEEE andated SCPI Commands ....................................................................................... 43
*CLS 43
*ESE/*ESE? 43
*ESR? 44
*IDN? 44
*OPC/*OPC? 44
*RST 44
*SRE/*SRE? 45
*STB? 45
*TST? 45
*WAI 46
SYSTem Commands .............................................................................................................. 46
:SYSTem:ABORt 46
:SYSTem:CAPTure:MODE? 46
:SYSTem:COMMunicate:HISLip:SESSion? 46
:SYSTem:COMMunicate:LAN:APPLy 47
:SYSTem:COMMunicate:LAN:CONFigure 47
:SYSTem:COMMunicate:LAN:DNS 48
:SYSTem:COMMunicate:LAN:GATEway 48
:SYSTem:COMMunicate:LAN:IP 49
:SYSTem:COMMunicate:LAN:MTU 49
:SYSTem:COMMunicate:LAN:NETMask 50
:SYSTem:COMMunicate:NTP 50
:SYSTem:ERRor[:NEXT]? 50
:SYSTem:ERRor:ALL? 51
:SYSTem:ERRor:CODE[:NEXT]? 51
:SYSTem:ERRor:CODE:ALL? 52
:SYSTem:ERRor:COUNt? 52
:SYSTem:FLUSh 52
:SYSTem:LOCK:HAVE? 53
:SYSTem:LOCK:REQuest? 53
:SYSTem:OPTions? 54
:SYSTem:SYNC:MASTer 54
:SYSTem:SYNC:WAIT 55
:SYSTem:VERSion? 55
:SYSTem:DATE 55
:SYSTem:TIME 56
:SYSTem:TIME:ADJust 56
:SYSTem:TIME:SYNC 56
STATus Commands ............................................................................................................... 58
:STATus:OPERation[:EVENt]? 59
:STATus:OPERation:CONDition? 59
:STATus:OPERation:ENABle 60
:STATus:OPERation:NTRansition 60
:STATus:OPERation:PTRansition 60

:STATus:PRESET 61
:STATus:QUEStionable[:EVENt]? 61
:STATus:QUEStionable:CONDition? 61
:STATus:QUEStionable:ENABle 62
:STATus:QUEStionable:NTRansition 62
:STATus:QUEStionable:PTRansition 62
:STATus:TEMPerature? 63
INPut Commands ................................................................................................................... 63
:INPut:ATTenuator 63
:INPut:ATTenuator:VARiable 63
:INPut:GAIN 64
:INPut:GAIN:HDR 65
:INPut:MODE 65
SOURce Commands .............................................................................................................. 66
:SOURce:REFerence:PLL 66
:SOURce:REFerence:PPS 66
SENSe Commands ................................................................................................................. 67
[:SENSe]:DECimation 67
[:SENSe]:FREQuency:CENTer 68
[:SENSe]:FREQuency:IF? 69
[:SENSe]:FREQuency:INVersion? 69
[:SENSe]:FREQuency:LOSCillator? 69
[:SENSe]:FREQuency:SHIFt 70
[:SENSe]:LOCK:REFerence? 70
[:SENSe]:LOCK:RF? 71
GNSS Commands ................................................................................................................... 71
:GNSS[:ENABle] 71
:GNSS:POSition 72
:GNSS:REFerence? 72
TRIGger Commands .............................................................................................................. 72
:TRIGger:TYPE 73
:TRIGger:LEVel 73
:TRIGger:PERiodic 74
TRACe Commands ................................................................................................................. 74
:TRACe:BLOCk:DATA? 75
:TRACe:BLOCk:PACKets 76
:TRACe:SPPacket 76
:TRACe:STReam:STARt 77
:TRACe:STReam:STOP 78
SWEep Commands ................................................................................................................ 78
:SWEep:LIST:ITERations 79
:SWEep:LIST:STARt 79
:SWEep:LIST:STATus? 80
:SWEep:LIST:STOP 80
:SWEep:ENTRy:COPY 80
:SWEep:ENTRy:COUNt? 81
:SWEep:ENTRy:DELETE 81
:SWEep:ENTRy:NEW 81
:SWEep:ENTRy:READ? 82
:SWEep:ENTRy:SAVE 82
:SWEep:ENTRy:ATTenuator 82
:SWEep:ENTRy:ATTenuator:VARiable 83
:SWEep:ENTRy:DECimation 83
:SWEep:ENTRy:FREQuency:CENTer 83

:SWEep:ENTRy:FREQuency:STEP 83
:SWEep:ENTRy:FREQuency:SHIFt 84
:SWEep:ENTRy:GAIN:HDR 84
:SWEep:ENTRy:MODE 84
:SWEep:ENTRy:DWELl 84
:SWEep:ENTRy:PPBlock 85
:SWEep:ENTRy:SPPacket 85
:SWEep:ENTRy:TRIGger:LEVel 85
:SWEep:ENTRy:TRIGger:TYPE 85
Appendix A: Connecting to RTSA ...................................................................................... 86
Simple 2-port TCP/IP Connection ....................................................................................... 86
Connection Using HiSLIP ..................................................................................................... 87
Appendix B: Protocols for Discovering RTSA ............................................................. 90
Discovery Using mDNS/DNS-SD ........................................................................................ 90
Discovery Using Broadcast UDP ........................................................................................ 90
Appendix C: SCPI Command Syntax ................................................................................ 92
Entering Commands .............................................................................................................. 92
Notation .................................................................................................................................... 93
Parameter types ...................................................................................................................... 93
Default Units ............................................................................................................................ 93
Appendix D: SCPI Status and Event Registers ........................................................... 95
Status Byte Register (SBR) .................................................................................................. 95
Standard Event Status Register (ESR) .............................................................................. 95
Operational Status Register (OSR) .................................................................................... 96
Questionable Status Register (QSR) ................................................................................. 96
Output Queue .......................................................................................................................... 97
Error and Event Queue ......................................................................................................... 97
Appendix E: SCPI Error Codes Used ................................................................................ 98
Appendix F: SCPI Commands Quick Reference ......................................................... 99
R5500 vs. R5700 List of Changes ...................................................................................... 105
References ..................................................................................................................................... 106
Document Revision History ................................................................................................. 107

Abbreviations
ADC Analog-to-Digital Converter
API Application Programming Interface
CIC Cascaded Integrator-Comb
DC Direct Current
DD Direct Digitizer
DDC Digital Down Converter
DDS Direct Digital Synthesizer
DSP Digital Signal Processing
FFT Fast Fourier Transform
FIR Finite Impulse Response
FPGA Field-Programmable Gate Array
GNSS Global Navigation Satellite System
GPIO General Purpose Input/Output
GPS Global Positioning System
GUI Graphical User Interface
HDR High Dynamic Range
IBW Instantaneous Bandwidth
IEEE Institute of Electrical and Electronics Engineers
IF Intermediate Frequency
IQ In-phase and Quadrature
LAN Local Area Network
B Mega-Bytes
SB Most Significant Byte
Sa Mega-Samples
NB Narrowband
NCO Numerically Controlled Oscillator
NTP Network Time Protocol
NTPD Network Time Protocol Daemon
PLL Phase-Locked Loop
RF Radio Frequency
RFE Receiver Front-End
RTSA Real Time Spectrum Analyzer
Sa/s Samples-per-Second
SCPI Standard Commands for Programmable Instruments
SH Super-Heterodyne
SHN Super-Heterodyne with narrower bandwidth
TCP/IP Transmission Control Protocol/Internet Protocol
TD Time Domain
TSF TimeStamp-Fractional
TSI TimeStamp-Integer
TS TimeStamp Mode
UTC Coordinated Universal Time
VCO Voltage Control Oscillator
VRT VITA-49 Radio Transport
WB Wideband
ZIF Zero Intermediate Frequency

List of Figures
Figure 1: R5700 Functional Block Diagram 13
Figure 2: RF Receiver Front-end and Capture Controller Functional Block Diagram 16
Figure 3: DC Offset with Amplitude Roll-Off at +50MHz 18
Figure 4: IQ Offset Correction 18
Figure 5: DDC Functional Block Diagram 20
Figure 6: Association between Time and Frequency Domain 21
Figure 7: Synchronized Sweep using Sync-Word 25
Figure 8: Synchronized Sweep with a Missed Capture 25
Figure 9: Connectivity and 4 Different Packet Streams Supported by R5700 26
Figure 10: An Example Illustrating Uninverted and Inverted Spectrums 41
Figure 11: SCPI Language Hierarchical or Tree Structure Example 42
Figure 12: SCPI Measurement Function Block 43
Figure 13: Status Reporting Structure with Status & Enable Registers 58
Figure 14: 2-port TCP/IP connection to RTSA 86
Figure 15: HiSLIP and TCP connections to RTSA 88

List of Tables
Table 1: System Level Control/Status Commands with GNSS 14
Table 2: Radio RFE Modes and DSP Data Output Formats 16
Table 3: RF Front-End Control/Status Commands 18
Table 4: Trigger Control/Status Commands 21
Table 5: Trace Capture Control Commands 23
Table 6: Sweep Capture Control/Status Interface 23
Table 7: The Categories of VRT Packet Streams Supported by ThinkRF's R5700 26
Table 8: A List of Stream Identifiers As Used by ThinkRF for Different Packet Classes 27
Table 9: Receiver Context Packet Class Structure 28
Table 10: Receiver Context Indicator Field Positions 28
Table 11: Receiver Context Field Definition and Values 28
Table 12: RF Reference Frequency Word Format 29
Table 13: Gain Field Format 29
Table 14: Temperature Field Format 29
Table 15: Digitizer Context Packet Class Structure 30
Table 16: Digitizer Context Indicator Field Bit Positions 30
Table 17: Digitizer Context Field Values 31
Table 18: Bandwidth Word Format 31
Table 19: RF Frequency Offset Word Format 32
Table 20: Reference Level Field Format 32
Table 21: Formatted GPS Geolocation Fields 33
Table 22: Geolocation Angle (Degrees) Format 33
Table 23: Altitude Subfield Format 34
Table 24: Speed Over Ground Subfield Format 34
Table 25: Extension Context Packet Class Structure 34
Table 26: Extension Context Indicator Field Positions 35
Table 27: Extension Context Field Definition and Values 35
Table 28: New Stream Start ID Field Format 36
Table 29: New Sweep Start ID Field Format 36
Table 30: Output Data Width and Packing Method for Different Data Formats 36
Table 31: IF Data Class Field Values 37
Table 32: Stream Identifier Values for Different Data Output Formats 37
Table 33: 64-bit or Two Words Picosecond Timestamp Format 37
Table 34: {I14Q14} Data Payload Arrangement with Upper 2-bit Signed Extended to {I16 Q16} 38
Table 35: {I14} Data Payload Arrangement with Upper 2-bit Signed Extended to {I16} 38
Table 36: {I24} Data Payload Arrangement with Upper 8-bit Signed Extended to {I32} 39
Table 37: Trailer Word Format 39
Table 38: Trailer Indicator and Enable Bits 39
Table 39: Conditions Causing Abnormal Indicator State and Suggested Resolution 40
Table 40: RTSA Option Codes and the Corresponding Description 54
Table 41: Performance of The Gain Settings of R5700-418, 427 and Their Variants 64
Table 42: Maximum Threshold Level Where +/-3 dBm Error or Less Still Hold For A Given Attenuation
Level 74
Table 43: Max, Min, and Required Multiples for SPP and Samples-per-word for Different Data Output
Format 77
Table 44: HiSLIP Message Header Format 88
Table 45: ThinkRF Vendor Specific Message Type Value Definitions 89
Table 46: ThinkRF Data Channel Initialization Transaction 89

Preface
This preface describes the audience for, the organization of, and conventions used in this
document It also identifies related documentation and explains how to access electronic
documentation
Audience
This document is written for software developers wishing to develop and/or maintain a
software interface to the R5700 and who have a basic understanding, familiarity and
experience with network test and measurement equipment
Conventions
This section describes the conventions used in this document
Grayed-out Font
Indicates a command or a feature is not yet available in the current release
Courier Font
Illustrates this is an example for a command or a concept
Light Blue Font
Contains hyperlink to the referenced source that can be clicked on
Normal Bold Font
When used within a sentence or a paragraph, it emphasizes an idea to be paid attention
to particularly
Red Font
Conveys special information of that section
Note: This symbol means take note Notes contain helpful suggestions or references to
additional information and material
Caution: This symbol means be careful In this situation, you might do something that
could result in equipment damage or loss of data
Warning: This symbol means danger You are in a situation that could cause bodily
injury Before you work on any equipment, be aware of the hazards involved with
electrical circuitry and be familiar with the standard practices for preventing accidents
Obtaining Documentation and Releases
You can access the most current ThinkRF documentation and the latest release bundles
at http://www thinkrf com/resources

Document Feedback
Please send your comments about this document or our other documentation to
support@thinkrf com
Thank you, we appreciate your comments
Obtaining Technical Assistance
The ThinkRF Support website provides online documents for resolving technical issues
with ThinkRF products at www thinkrf com/resources
For all customers who hold a valid end-user license, ThinkRF provides technical
assistance 9 AM to 5 PM Eastern Time, Monday to Friday Contact us at
www thinkrf com/support/ or by calling +1.613.369.5104
Before contacting Support, please have the following information available:
•R5700's serial number and product version, which are located on the identification
label on the R5700's underside
•The firmware version running on the R5700
•Versions of ThinkRF software you are using, potentially including the S240, API
libraries to third-party applications
•The operating system and version you are using

R5700 Functional Overview
R5700 Functional Overview
This section overviews the R5700's functionality and protocols used, and summarizes the
SCPI command sets for controlling the individual functions
Note: This is a living and evolving document. We welcome your feedback.
The features and functionality described in this section may exist in the current product
firmware release or are scheduled for a future product firmware release (grayed out
commands and/or text) Please refer to Appendix F: SCPI Commands Quick Reference
for the complete list of commands and the availability information No hardware upgrade
is required at each feature release (unless specified though unlikely)
System Overview
The R5700 Real Time Spectrum Analyzer (RTSA) with GNSS (Global Navigation
Satellite System) provides the benefits of a high-performance software-defined RF
receiver, digitizer and analyzer along with integrated GNSS technology offering location
and time information in one package With patent-pending software-defined RF receiver
technology, the RTSA provides industry leading combined sensitivity, tuning range, wide
instantaneous bandwidth (IBW) and scan rate Additionally, it provides real-time
sophisticated triggering and capture control Figure 1 illustrates an RTSA solution
system example
The R5700 is designed for stand-alone, remote and/or distributed wireless signal
analysis Whether using as a single unit or a network of radio sensors, R5700 is ideal for
monitoring, management and surveillance of transmitters, whether they are in-building or
spread across a geographic area Applications include, but are not limited to:
•5G wireless technology;
•test and measurement;
•monitoring and surveillance;
•research;
•OEM integration
The R5700 hardware largely consists of:
•a hybrid super-heterodyne, direct-conversion and direct-digitization RF receiver
front-end (RFE);
•receiver front end inputs and outputs to support clock synchronization, and IF
outputs for high-end digitization;
•a 125 MSample/sec 14-bit wideband (WB) ADC with a dynamic range of greater
than 70 dB;
•a 325 kSample/sec 24-bit narrowband (NB) ADC with a dynamic range in excess of
100 dB;
•a GNSS module with embedded 10MHz reference clock source for further RTSA’s
time synchronization;
ThinkRF R5700 Real Time Spectrum Analyzer Programmer's Guide 12

R5700 Functional Overview
•a Xilinx's Zynq FPGA with built-in dual-core ARM®-based processor, Gigabit
Ethernet interface and custom embedded digital signal processing (DSP) logic;
•1 GB of DDR3 shared between firmware and real-time caching of digitized data;
•a general purpose input/output (GPIO) port
Figure 1: R5700 Functional Block Diagram
ThinkRF's products conform with standardized protocols for interoperability ThinkRF
provides application programming interfaces (APIs) designed for easy integration with
third-party applications Standard protocols include the Standard Commands for
Programmable Instruments (SCPI) protocol (page 42) for controlling and obtaining status
from the RTSA and the VITA-49 Radio Transport (VRT) protocol (page 26) for digitized
data and its associated context information
In addition, API libraries, written in C/C++, Python, MATLAB and/or NI LabVIEW, are
provided for quick interfacing, data acquisition and as well as for spectral analysis The
Python API is built within the PyRF development framework and is open-source under
BSD licensing PyRF handles the low-level details of real-time acquisition, signal
processing and visualization, and provides feature rich libraries, example applications
and source code, all specific to the requirements of signal analysis Usage examples are
provided through the available source codes of the Graphical User Interfaces (GUIs) or
any applications included in each release package
Refer to Appendix A for how to connect to an RTSA and Appendix B for the protocol on
how to find any RTSAs available on the local network The source code provided for the
aforementioned APIs and GUIs/applications would serve as examples
The R5700 provides system level control and status commands as defined in Table 1
13 ThinkRF R5700 Real Time Spectrum Analyzer Programmer’s Guide

R5700 Functional Overview
Table 1: System Level Control/Status Commands with GNSS
SCPI Command Description
:SYSTem Page 46
:ABORt Aborts the current data capturing process and puts the RTSA system into
a normal manual mode (i e sweep, trigger, and streaming will be aborted)
:CAPTure
:MODE? Gets the current capture mode of the RTSA (i e sweeping, streaming or
block mode)
:COMMunicate
:HISLip
:SESSion? Returns the HiSLIP connection’s session ID
:LAN<commands> Subset of commands for configuring/querying RTSA's LAN settings
:ERRor
[:NEXT]? Returns the next error code and message from the SCPI error/event
queue
:ALL? Returns all the error codes and messages from the SCPI error/event
queue
:CODE
[:NEXT]? Returns next the error code from the SCPI error/event queue
:ALL? Returns all the error codes from the SCPI error/event queue
:COUNt? Returns the number of errors in the SCPI error/event queue
:FLUSh Clears the R5700's internal data storage buffer of any remaining data that
has not transferred out of the RTSA
:LOCK
:HAVE? Returns the current lock state of the task specified
:REQuest? Requests the R5700 to provide a lock on a specific task such that only the
application that has the lock can perform the task
:OPTions? Returns comma separated 3-digit values to represent the hardware
option(s) or features available with a particular RTSA model
:SYNC
:MASTer[?] Sets an RTSA unit to be the master or slave for a synchronization trigger
system with multiple units Affects :TRIGger:TYPE PULSe or WORD
:WAIT[?] Sets the delay time in nanoseconds that the system must wait after
receiving the trigger signal before performing data capture
:VERSion? Returns the SCPI version number that the instrument complies with
:DATE[?] Sets/reads date
:TIME[?] Sets/reads time
:SYNC[?] Sets/ gets the System time synchronization source via network or SCPI,
or disable
:STATus Page 57
:OPERation
[:EVENt]? Queries the Operation Status Register for any operation event
:CONDition? Queries the Operation Condition Register for any operation event
:ENABle[?] Enables or queries bits in the Operation Enable Register
:NTRansition[?] Enables or queries bits in the Operation Negative Transition Register
:PTRansition[?] Enables or queries bits in the Operation Positive Transition Register
ThinkRF R5700 Real Time Spectrum Analyzer Programmer's Guide 14

R5700 Functional Overview
SCPI Command Description
:PRESET Presets the R5500 (similar to *RST)
:QUEStionable
[:EVENt]? Queries the Questionable Status Register for any questionable event
:CONDition? Queries the Questionable Condition Register for any questionable event
:ENABle[?] Enables or queries bits in the Questionable Enable Register
:NTRansition[?] Enables or queries bits in the Questionable Negative Transition Register
:PTRansition[?] Enables or queries bits in the Questionable Positive Transition Register
:TEMPerature? Returns the R5700's internal ambient temperature
:GNSS
[:Enable][?] Enables or queries the status of the GNSS module
:POSition Queries the last known GNSS position in degrees latitude, degrees
longitude and altitude in meters
:REFerence? Queries which timing reference source used to discipline the 10 MHz
GNSS reference oscillator
See SCPI Command Set section (page 42 onward) for further details on the commands
Caution pertaining to multi-users: See Appendix A: Connecting to RTSA for important
notes on this caution
The Architecture
The R5700 is an integrated wireless radio receiver, digitizer/analyzer and GNSS
technology It has an embedded capture controller that enables users to:
•define and execute real-time and sophisticated triggers, traces and sweeps;
•configure the radio RFE and DSP in association with those traces or sweeps;
•obtain device’s location position and time as provided by the GNSS through VRT
packets (page 32); and
•have time-stamped with data output
Traces and sweeps are controlled by the capture controller as illustrated in the Digitizer
portion of Figure 2 A trace and a sweep are defined as a single (block or continuously
streamed) capture and a series of captures, respectively, each with their associated
hardware configurations
When the GNSS module is enabled, GNSS position and time information is sent to users
through VRT context packets roughly every second (see VRT’s Formatted GPS
Geolocation section) Besides two existing internal and external 10 MHz reference clock
sources, the GNSS module also provides a third 10MHz reference clock source option to
provide synchronized time-stamp for VRT packets (see SOURce Commands)
15 ThinkRF R5700 Real Time Spectrum Analyzer Programmer’s Guide

R5700 Functional Overview
Figure 2: RF Receiver Front-end and Capture Controller Functional Block Diagram
(Note: The GPS (GNSS) o tion is included in this model)
The R5700 supports different RFE modes of operation and subsequent DSP capabilities
as per Table 2 and as described in the following subsections
Table 2: Radio RFE Modes and DSP Data Output Formats
ode Description Freq Range
(MHz)
IBW
(MHz)
DSP Data Output Format
None CIC/Dec Frequency Shift
ZIF Zero-IF Receiver 50 - max 100 I14 Q14 I14 Q14 I14 Q14
SH Super-Heterodyne
Receiver
50 - max 40 I14 I14 Q141I14 Q14
SHN SH Receiver with
narrower BW
50 - max 10 I14 I14 Q141I14 Q14
HDR High Dynamic Range
Receiver
50 - max 0 1 I24 - -
DD Direct Digitization
Receiver
0 009 - 50250 I14 I14 Q141I14 Q14
1 For SH and SHN modes, when the decimation is used, a frequency shift of 35MHz will be applied
automatically to bring the R5700's center frequency back to the zero IF Thus, the data output will
be I and Q
2 In DD mode, there is no frequency tuning except for performing frequency shift When
decimation is applied, the decimation will be around the zero frequency
R5700 complies to VRT protocol for sending digitized IF data packets and their
associated context information depending on the capture mode It is very important to
follow the VRT's IF Data Packet Class section (page 36) for the exact VRT data output
formats as well as packing method
ThinkRF R5700 Real Time Spectrum Analyzer Programmer's Guide 16

R5700 Functional Overview
RF Receiver Front-End
The Receiver portion of Figure 2 shows a block diagram of the RFE within the R5700
The architecture consists of a super-heterodyne (SH) front-end with a back-end that
utilizes an I/Q mixer similar to that in a direct-conversion (or zero-IF) receiver
Depending on the frequency of the signals being analyzed, one of the three receiver
signal processing paths is selected Signals in the frequency range 9kHz to 50MHz are
directly digitized, while all other signals are translated to the frequencies of the first IF
block via one of the other two signal processing paths The IF block consists of a bank of
multiple SAW filters SAW filter selection depends on the frequency of the input signal
The output of the SAW filter feeds the I/Q mixer
The three signal processing paths are further classified into different modes of operation
for the capture engine as shown in Table 2 The radio modes ZIF, SH, SHN and HDR
support tuning the center frequency from 50MHz to the maximum frequency supported by
the particular product model (ex 8GHz, 18GHz, and 27GHz for R5700-x08, -x18, and
-x27, respectively, where x is a model number variant)
The ZIF, SH and SHN radio modes support a tuning resolution of 10Hz Digital
frequency shifting is then used to enhance the tuning resolution to the nearest 1Hz
(±0 23Hz) The frequency shifting technology used is an embedded Numerically
Controlled Oscillator (NCO) based Direct Digital Synthesizer (DDS) as described in the
Digital Down Converter subsection
The HDR radio mode supports a tuning resolution of 10Hz No further fine tuning is
available
The remaining radio mode, DD, supports 50MHz IBW Direct Digitization of the baseband
from the external RF IN Hence, this mode does not support frequency tuning of the
radio although the DSP's frequency shift mode may be applied
Direct-Conversion Receiver Technology
Direct-conversion (or ZIF) receivers are ideal for signal analysis of wideband waveforms,
such as 4G/LTE, Wi-Fi and Bluetooth With that benefit comes the drawback of both IQ
and DC offsets which are inherent to direct-conversion technology
DC Offset Correction
The R5700's WB ADC sampling rate is 125 MSa/s, intermediate frequency (IF) is 0 and
the entire IF bandwidth is 125MHz The analog filter results in an amplitude roll-off at
approximately +50MHz around the center frequency Fc, as illustrated in Figure 3
Direct-conversion receivers have a DC offset at the center of the band The offset is
primarily compensated for in real-time in the receiver hardware but there always is some
residual offset that (depending on the application and bandwidth of interest) might need
to be compensated for in software Several options such as calibration or dynamic offset
compensation in software have been described in the open literature
17 ThinkRF R5700 Real Time Spectrum Analyzer Programmer’s Guide

R5700 Functional Overview
D C
O f f s e t
F c - 5 0 M H z F c + 5 0 M H z
1 2 5 M H z
F c
A n a l o g f i l t e r
Figure 3: DC Offset with Amplitude Roll-Off at +50MHz
If the application only needs to utilize up to 50MHz of IBW, a simple alternative to DC
offset compensation is to use the SH mode of operation
IQ Offset Correction
Direct-conversion receivers have phase and/or amplitude offsets between in-phase (I)
and quadrature (Q) components of the baseband signal Due to this, when an FFT is
performed on digitized baseband data where there is a signal tone present, there will be
an ‘image’ at the same frequency offset from the center frequency as the tone itself This
is illustrated in Figure 4
S i g n a l
I m a g e
X d B
F r e q u e n c y
F
c
F r e q u e n c y
F
c
F c + F s
F c - F s
c a l i b r a t e I Q
Figure 4: IQ Offset Correction
A correction algorithm would be needed to adjust this offset necessary for signal analysis,
especially for the ZIF mode The ThinkRF's APIs have included a correction
Table 3: RF Front-End Control/Status Commands
SCPI Command Description
:INPut Page 63
:ATTenuator[?] Enables/disables the front-end's attenuation for R5700-408 & their
variants only
ThinkRF R5700 Real Time Spectrum Analyzer Programmer's Guide 18

R5700 Functional Overview
SCPI Command Description
:VARiable[?] Sets the variable attenuation for R5700-418 and -427 & their variants
:GAIN[?] Sets the input gain stage for R5700-418, -427 & their variants
:HDR[?] Sets gain level for the NB ADC of of the HDR signal path
:MODE[?] Selects the receiver mode of operation
:SOURce Page 66
:REFerence
:PLL[?] Selects the 10MHz reference clock source
:PPS[?] Selects the PPS input source
[:SENSe] Page 67
:DECimation[?] Sets the decimation rate as an exponent of 2 (i e rate = 2level where level =
0, 1, 2 - 10)
:FREQuency
:CENTer[?] Sets the center frequency of the RFE
:IF? Queries the IF frequencies that are used for the current input mode and
center frequency
:INVersion? Queries if a spectral inversion is required at a given frequency
:LOSCillator? Gets the frequency of the external LO 1, 2 or 3 in corresponding to
current the RTSA's center frequency
:SHIFt[?] Sets the frequency shift value (not available for HDR mode)
:LOCK
:REFerence? Queries the lock status of the PLL reference clock
:RF? Queries the lock status of the RFE's PLL
See SCPI Command Set section (page 42 onward) for further details on each set of
commands
Digital Signal Processing
The R5700 has embedded DSP blocks to provide further signal processing capabilities,
such as DDC with up to 10 levels of decimation and FFT computation
Digital Down Converter
The DDC block takes the frequency band of interest and shifts it down in frequency, then
provides decimation of the sampling rate to one that is lower and consistent with the
bandwidth of the signal of interest This enables channelization of signals having
bandwidth smaller than the IBW
Referring to Figure 5, the DDC has two major elements, an NCO (DDS) and a down
sampling with filtering The NCO generates a complex sinusoid, which is mixed with the
IQ input using a complex multiplier, to shift or offset the signal spectrum from the selected
carrier frequency This process provides the frequency fine-tuning (and shifting) feature
as mentioned in the previous subsections
19 ThinkRF R5700 Real Time Spectrum Analyzer Programmer’s Guide

R5700 Functional Overview
Figure 5: DDC Functional Block Diagram
The complex multiplication is then followed by either a finite impulse response (FIR) filter
or cascaded integrator-comb (CIC) filters with a FIR filter combined The CIC filter has a
‘droop’ associated with it in the passband In order to compensate for this droop, the CIC
filter is followed by a compensating FIR filter Each filter type has its own decimator
This whole process effectively reduces the sample rate and filters the signal to remove
adjacent channels, minimize aliasing, and maximize the received signal-to-noise ratio
Note: The use of the NCO converts the in-phase signal (I data) input of the receiver's
DD, SH and SHN processing paths to complex I and Q data output See Table 2
Triggers
Triggers provide a means of qualifying the storage of captured time domain IQ data
based on an external, periodic or frequency domain event Triggering can be considered
a means of filtering signals of interest for the purposes of subsequent visualization
and/or analysis
The following describes the different types of triggers and their common controls
Selection of different types is mutually exclusive
Frequency Domain Triggering
Frequency domain triggering relies on the embedded real-time FFT mechanism to
transform the sampled signal from the time domain to the frequency domain The R5700
uses a 1024 point real-time FFT core embedded within the FPGA to transform 1024 time
domain IQ samples to 1024 frequency domain FFT bins Each bin is an average of the
spectral activity over a range of 125MHz divided by the DDC decimation rate divided by
the 1024 FFT points
The frequency domain triggering supported by R5700 is a level trigger type, used to
capture any signal above the noise floor within a specified frequency range The user
defines a single amplitude level within a frequency range The frequency range
encompasses all FFT bins with center frequencies within the range defined by START
and STOP If the sampled signal amplitude exceeds the defined trigger level at any
ThinkRF R5700 Real Time Spectrum Analyzer Programmer's Guide 20
NCO (DDS)
fsfs
fsIout
Qout
Iin
Qin