A while ago I wrote about how to use the HackRF One as a spectrum analyzer, and mentioned that apart from using its sweep functionality, it could also be used as a real-time 20 MHz spectrum analyzer using any SDR software. I now had to learn about its limitations and possible pitfalls when using it this way.

I wanted to look at the spectrum put out by an RF transmitter when transmitting a simple sine wave, i.e., an unmodulated carrier. In particular, I wanted to know about any nearby spurs, so looking at it with a high-bandwidth SDR seemed to be a good idea. So I connected the transmitter to the HackRF One, using appropriate attenuation. Looking at the spectrum put out by the transmitter gave me a bit of a shock:

The transmitter seemed to put out around 192 kHz of junk around the carrier. In particular, there were spurs visible at -35 dBc. I was quite surprised by this performance of the transmitter and double-checked the result using a tinySA. Here is what it showed:

Below -25 dBm we see the phase noise of the tinySA. However, the largest spurs shown by the HackRF should be clearly visible at around -15 dBm. So, one of these two devices was lying to me. But which?

I remembered that the tinySA can also be used as a signal generator, so I connected it to the HackRF and put out an unmodulated sine wave. The result was exactly the same spectrum as shown in the first picture of this post. How likely is it that both the transmitter I was examining and the tinySA output the exact same spurs? So it was clear that the spectrum shown by the HackRF is not telling the truth and the spurs are in fact generated within the HackRF.

I am not entirely sure about the origin of these spurs. A reason may be the very limited dynamic range of the HackRF. As it is using an 8-bit ADC, its dynamic range is limited to 50 dB. However, I was using 16x decimation which should provide another 12 dB and those spurs were much higher than -62 dBc. There is the term Spurious Free Dynamic Range (SFDR) and maybe for the HackRF this is actually just 35 dB. Overall, I found that with a simple sine wave, I cannot input more than -50 dBm with LNA and VNA gain set to 0 dB without those spurs showing up above the noise floor.

So, what’s the conclusion here?

- Always be skeptical about your measurements, in particular if they are far off from what you would expect.
- Using the HackRF One, keep signal peaks lower than 35 dB above the noise floor, so that those spurs have no chance of showing up.
- If unsure, try to find a way to either confirm your measurements or any assumed error in your measurements.