Agilent E4406A Vector Signal Analyser

[G0HZU]

I bought one of these Agilent E4406A vector signal analysers a few days ago to play with for analogue and digital demod purposes. These versatile instruments can be purchased for just a few hundred pounds these days.

http://www.keysight.com/en/pd-1000002790%3Aepsg%3Apro-pn-E4406A/vsa-transmitter-tester-7-mhz-to-4-ghz?cc=US&lc=eng

I wondered how many other E4406A users are on here and what they use it for? I plan to use mine as a research tool to demodulate/verify various analogue and digital signals.

Therefore, I've bought mine purely for signal analysis rather than spectrum analysis and I plan to dump data from it and do the demodulation etc in a remote PC. At the moment I'm playing with some legacy Agilent SW tools that offer various demodulation personalities. I've so far managed to configure an old laptop to control the E4406A and take data from it via LAN or GPIB and this seems to run OK with the older Agilent SW and the E4406A after a bit of persuasion...

I've also loaded the latest firmware to mine over LAN and also calibrated the internal 10MHz oven via LAN as per the procedure in the manual. I'm probably going to replace the Lithium coin cell battery on the main CPU card.

Has anyone done this already? Is it easy to take apart and gain access to the battery? I've not had the covers off to look inside yet...

[G0HZU]

W2AEW did a couple of videos showing what an RTSA can do when analysing a VHF transmitter on keyup here:





So I had a play with the E4406A today and the Agilent SW to see if it could do something similar. I've only spent a few minutes on this but I managed to replicate the same results. The playback is very fluid and can be manually incremented to microsecond resolution. So the spectrum can be played back very slowly and watched as the radio transmitter locks up.

See the two images below.

I'm struggling a bit with the spectogram feature but I managed to get it to do something in the second image.
To get these plots I'm using some fairly modern analysis tools from Agilent that can be persuaded to work with the E4406A. This is just scratching the surface but there's a lot of things that can be done (in a PC)  with the data a E4406A can spit out. 

[G0HZU]

I did a quick and dirty youtube video to try and capture how fluid the data capture and playback is.

Maybe it can go faster as I did this via GPIB rather than high speed LAN between the E4406A and the PC.

The top right plot is the demodulated FM spectrum as I've included FM demodulation in the analysis. So it's possible to look at FM transmitter audio distortion etc.

But you can see it's quite impressive (unlike my video making skills )

https://youtu.be/T7wIXfE-2BE

[Neganur]

I've been eyeing one for a while now and I would use it to characterise amplifier stages etc.
The only real obstacle in my eyes is the 10 MHz span and I've been wondering if it's feasible to just do wider sweeps by combining 10 MHz pieces on an external computer.
I have not found any info on how much time it takes to change the span nor how fast the data transfer is. To my knowledge this is an FFT SA that should be quite fast.

[nctnico]

The only real obstacle in my eyes is the 10 MHz span and I've been wondering if it's feasible to just do wider sweeps by combining 10 MHz pieces on an external computer.

On a 'real' spectrum analyser a detailed sweep of a large span is slow as well. Stitching 10MHz sweeps together shouldn't be much slower if you can transfer the data at a reasonable speed.

[G0HZU]

Don't get too excited as I don't think the E4406A is really suitable to be used as a conventional spectrum analyser because of its very basic frequency plan in its downconverter section. So even if you program/control it to stitch together a wider sweep it will not give the same performance as a conventional analyser because it will be prone to displaying image/spurious terms at some parts of the sweep.

It really is best used as a signal analyser under tightly controlled conditions within its 10MHz span. Under these conditions it appears to be a very powerful tool.

I think I can demodulate pretty much anything using the combo of the E4406A and the Agilent SW. There appear to be dozens of demodulation personalities to choose from.

Here's an image of a simple (but low level and noisy) BPSK signal and also a 16QAM signal being demodulated and analysed for constellation and Error Vector Magnitude etc. I used an Agilent E4433B vector sig gen to generate these test signals. I think the analysis SW can go up to 1024 QAM but I can't test it for that! It can also do analogue demod of AM and FM and other odd things like RFID tags, bluetooth, WLAN, WIFI and various mobile phone formats eg 3/3.5G


 

[cyr]

I've been eyeing one for a while now and I would use it to characterise amplifier stages etc.
The only real obstacle in my eyes is the 10 MHz span and I've been wondering if it's feasible to just do wider sweeps by combining 10 MHz pieces on an external computer.
I have not found any info on how much time it takes to change the span nor how fast the data transfer is. To my knowledge this is an FFT SA that should be quite fast.

Using this tool you can grab about 5 10MHz chunks per second from the E4406:

http://ve2zaz.net/InstrCtl/InstrCtl.htm

It may be possible to optimze that more, it certainly captures many more frames per second in regular use (not tuning).

Also, I believe it's possible to get a stitched span up to 100MHz in WCDMA mode (option BAF) directly on the unit, although I haven't tested that.

[edavid]

I'm probably going to replace the Lithium coin cell battery on the main CPU card.

Has anyone done this already? Is it easy to take apart and gain access to the battery? I've not had the covers off to look inside yet...

It's harder than it should be... refer to the service guide for the CPU board removal procedure:

http://www.keysight.com/upload/cmc_upload/All/E4406-90178.pdf

[Neganur]

Using this tool you can grab about 5 10MHz chunks per second from the E4406:

http://ve2zaz.net/InstrCtl/InstrCtl.htm

Oh! Thanks for that link. That's enough to give me an idea of what could be achieved.
4 GHz span in 90 seconds is totally OK, if I know where an area of interest is I can always go and have a look manually.
Most of the interesting tests have a span of 10 MHz (2nd and 3rd Harmonic of an 865 MHz ISM BPSK signal) and if it can do additional demodulation of the most common types that's all I need.
The digital communication personalities are a nice bonus. Are they required for the demodulation of normal digital types like  16 QAM etc?

[G0HZU]

I'm very new to this instrument but normally the E4406A comes with something like 48Mb or 64Mb of onboard memory to store its firmware plus a limited suite of measurement personalities within itself. Mine is limited to 48Mb so I can't really demo how to install extra personalities. Mine came with GSM edge 202  which is fairly useless to me. There isn't much room left after the firmware plus option 202. Otherwise I'd perhaps investigate making a keygen to unlock all this obsolete stuff. But I only have 48Mb onboard

So I looked at old versions of the external support SW. This SW is meant to be used with Agilent's own DSP hardware platform but the early versions also supported the E4406A. This software is long obsolete and is unsupported and it was never free although you can get a 14 day free trial.

The version I'm running is much newer (but still long obsolete) and also supported a free trial (via flex?) but the E4406A isn't formally supported. However, there's a registry fix for including E4406A hardware support which I tried and this seems to work with my E4406A. It took me a fair bit of fiddling about to get it all to run. I dug around inside their code and found all kinds of bonus stuff like special demod modes and other hidden things it can demodulate that aren't listed in their glossy blurb. But I don't know what they are yet and so can't test them. eg Special Demod Modes 1 throu 9? Anyone know anything about this?

[cyr]

My unit came with license files for almost all options, as described here:

https://www.eevblog.com/forum/testgear/%27free%27-vsa-options/

I have no idea why, but I'm not complaining. Not that the various personalities are *that* useful, but they can't hurt. Constrained by the 48M flash though, maybe a DIY 64M upgrade could be possible - or a software mod to load files from LAN or SCSI...

[G0HZU]

The digital communication personalities are a nice bonus. Are they required for the demodulation of normal digital types like  16 QAM etc?

As far as I know the E4406A doesn't have a generic analog/digital personality option. So you are just limited to whatever mobile phone personality options it was shipped with.

However, the VSA software does all the various demod modes with option AYA. You can define the digital filter type, bit rate and loads more parameters for each demod type you choose.

http://cp.literature.agilent.com/litweb/pdf/5990-6387EN.pdf

[G0HZU]

I'm probably going to replace the Lithium coin cell battery on the main CPU card.

Has anyone done this already? Is it easy to take apart and gain access to the battery? I've not had the covers off to look inside yet...

It's harder than it should be... refer to the service guide for the CPU board removal procedure:

http://www.keysight.com/upload/cmc_upload/All/E4406-90178.pdf

Thanks... I think I'll wait a while before taking it apart. I generally avoid taking test gear apart unless really necessary. However, the service document states that the battery lasts for just 3 years typically so I reckon mine will probably die soon...

[G0HZU]

My unit came with license files for almost all options, as described here:

https://www.eevblog.com/forum/testgear/%27free%27-vsa-options/

I have no idea why, but I'm not complaining. Not that the various personalities are *that* useful, but they can't hurt. Constrained by the 48M flash though, maybe a DIY 64M upgrade could be possible - or a software mod to load files from LAN or SCSI...

That's interesting...  It would be nice if it were possible to dump the personality into the machine via LAN but I've got a lot to learn about this instrument and at present I know very little about what can be done with it to increase its versatility.

[G0HZU]

To show it can also do 'old school' analogue FM demodulation here's an image of it demodulating my Marconi 2024 sig gen set to 5kHz FM deviation and a 2.093kHz modulation frequency.

You can see it measure the peak deviation correctly and also the demodulated tone is measured at 2.093kHz in the demodulated spectrum in the lower left corner. It shows a deep Bessel null here as expected

It can also do AM and PM modes.

[PA0PBZ]

Thank you for starting this topic. I have the VSA also to look at and learn about the different digital modulation formats, and I also have a E4433B to feed it.
I knew about the 89600 software and planned to have a look at it, but somehow there's always more important things to do... Well, you finally made me install it and have some fun, I even managed to get a reasonable QAM64 display:



QAM256 however looked like spaghetti, not sure what is going wrong. Anyway, looks like I have 14 days left to find out 

[G0HZU]

Hi PA0PBZ
Which version of the software are you running? I started out looking at the first version that supported the E4406A that is dated 2001 (version 2?) and went through Version4 to Version 12.

I think that support for the E4406A runs from Version2 through to Version9 but E4406A support is possible on later versions with a (semi official?) registry fix from Agilent.

The later B version of the SW (Version 19) looks good but I'm not sure if this can be made to work with the E4406A. However, the B version SW works with the Agilent E4440A PSA analyser and my E4406A has the same CPU module and analog IF and digital IF modules as a PSA analyser so maybe it can work with the E4406A. But there may be a firmware limitation that prevents this in the E4406A?

I saw what you did with yours in this thread here:
https://www.eevblog.com/forum/testgear/%27free%27-vsa-options/

Interesting stuff!

[PA0PBZ]

Hi,

I got the latest version (12) of the 89600A software from here: http://www.keysight.com/main/software.jspx?ckey=1303376
and of course the registry fix. I noticed that while the instrument on itself can do a 10MHz span, the software only goes to 8.
I use the LAN connection and it seems to work fine.

[G0HZU]

QAM256 however looked like spaghetti, not sure what is going wrong. Anyway, looks like I have 14 days left to find out 

I had the same issue but I found it worked perfectly at higher symbol rates. eg I turned the 256QAM signal up to 512kbpson the E4433B and the 89600 SW and the errors went right down and the constellation looked really clean

I think it's more realistic to run it at a symbol rate like this

[1design]

If you use the equalizer you might also improve a bit your EVM reading.
Try also increasing the number of symbols, this wil show if the source has any phase noise or amplitude and phase imbalance issues.

[G0HZU]

I did some more testing on my E4406A yesterday and found something a bit odd...

The front panel says the input is OK to 26V DC and this seems a very strange number. I did some testing and found that the input is not DC blocked on mine.

So I decided to take the covers off to see what was inline at the front end. It seems to go directly into an SMA (7dB?) attenuator. But I did some more tests and there seems to be a DC block after the attenuator. I think this may be built into the attenuator back end. It can't be fitted 'backwards' in my case because the SMA connector gender at each end doesn't allow this.

There appears to be a 7dB (SMA) attenuator at the input that is rated to several Watts. This doesn't seem to be rated to handle 26V DC even though it has cooling fins etc. Maybe the 26V DC spec is just for a short term application of DC.

It's unlikely that my attenuator has 'lost' its DC blocking at the input and assuming that my E4406A is typical then it's worth noting that the input is resistive with about 80R shunt resistance. So be careful how you connect things to it if you assume it is DC blocked. Mine isn't!

[KJDS]

I'd take a guess at the attenuator being about 5W.

26V into 80 ohms is 8.5W, so it's possible that it's capable of handling that, but as you suggest it's not a sensible thing to do for any length of time.

[G0HZU]

I'd take a guess at the attenuator being about 5W.

Yes, I'd say the attenuator type is rated/advertised for about 5W but probably to a spec with a few weasel words in the small print

I think it's probably designed like this to withstand the RF power from a direct connection from a mobile handset. But mine appears to have a built in DC block at the other end of the SMA attenuator. This is inside the attenuator?

Maybe this is there to protect the next stage in the RF front end from the attenuated DC from the max 26V fed at the input?

[G0HZU]

While I had the covers off I had a closer look at the block diagram and the various coax cables between the modules. There is the ability to feed a signal directly into the digital IF at baseband if a cable is disconnected.

The appeal here is that the system phase noise should be very low. Much lower than any of my mid range lab grade sig gens can achieve so they are useless as a test signal here. So I quickly tried a homemade 7.5MHz free running LC oscillator with a loaded Q of about 30. This should be capable of <<-150dBc/Hz at 10kHz offset.

I tried this (via an anti alias LPF) in the E4406A and the E4406A limited out at -136dBc/Hz at maybe 3-10kHz offsets. Not bad! The idea would be to use an external LO and mixer to make a fairly decent phase noise measuring capability if a coax relay was fitted here. Note: My E4406A has the 14bit IF module which will help here.

The external LO could be something like an AD9912 or AD9914 DDS that can deliver very low phase noise. This is still way off what something like a E5052A SSA can achieve in terms of phase noise floor but it's a big step up from a decent lab grade analyser in this respect.

I also had to play inside the advanced FFT menus to get the last few dB of performance when so low down in signal level.

The plot below is on 15dB/div not 10dB in order to get it on the screen. The Err logo on the screen is because the analyser is not happy that I broke the signal path to allow this signal to be fed into it. So it failed to complete its regular self test signal routine.

[Neganur]

Actually a question regarding the 89600  software. I remember requesting a trial license to see how well it works with the 3000X series oscilloscope.
Does the software need a license to run with the E4406A or is there a license on the device itself like on some infiniium oscilloscopes?

[G0HZU]

In the case of version 12 of the 89600 SW you just download it and run it and select the option of a 14 day trial and it will self start the trial immediately even if you are offline. You don't need to get authorisation or a key from Agilent to self start the trial.

If you connect an instrument via LAN or GPIB to the PC it should auto detect the scope/analyser and if it's a supported instrument then you are good to go

Agilent dropped the E4406A support after version 10 but you can run a registry fix that means it supports the E4406A up to V12.

There is no licence required to be inside the E4406A analyser. The SW is licensed inside the PC and it should work with any hardware that is supported. I think the one licence covers all hardware because the trial doesn't know I was going to try connecting an E4406A analyser. If I had a different model analyser or scope here then it will detect it and run with it if it is in the list of supported instruments.

I can't comment on what scopes the 89600A SW supports but I can imagine it would be a very powerful tool with the right scope

[bingo600]

While I had the covers off I had a closer look at the block diagram and the various coax cables between the modules. There is the ability to feed a signal directly into the digital IF at baseband if a cable is disconnected.

The appeal here is that the system phase noise should be very low. Much lower than any of my mid range lab grade sig gens can achieve so they are useless as a test signal here. So I quickly tried a homemade 7.5MHz free running LC oscillator with a loaded Q of about 30. This should be capable of <<-150dBc/Hz at 10kHz offset.

I tried this (via an anti alias LPF) in the E4406A and the E4406A limited out at -136dBc/Hz at maybe 3-10kHz offsets. Not bad! The idea would be to use an external LO and mixer to make a fairly decent phase noise measuring capability if a coax relay was fitted here. Note: My E4406A has the 14bit IF module which will help here.

The external LO could be something like an AD9912 or AD9914 DDS that can deliver very low phase noise. This is still way off what something like a E5052A SSA can achieve in terms of phase noise floor but it's a big step up from a decent lab grade analyser in this respect.

I also had to play inside the advanced FFT menus to get the last few dB of performance when so low down in signal level.

The plot below is on 15dB/div not 10dB in order to get it on the screen. The Err logo on the screen is because the analyser is not happy that I broke the signal path to allow this signal to be fed into it. So it failed to complete its regular self test signal routine.

G0HZU

Could you elaborate some more on this setup ?

I have a E4406 and this is quite interesting.

Have you seen
http://www.ke5fx.com/gpib/readme.htm
http://www.ke5fx.com/gpib/pn.htm

I seem to remember that John mentioned -140dB wo. modifications in one of his posts.

/Bingo

[G0HZU]

G0HZU Could you elaborate some more on this setup ?
I have a E4406 and this is quite interesting.

All I am doing is injecting a signal at the final IF (7.5MHz) direct into the digital IF. This has a 14bit ADC clocked at 30MHz.

My E4406A has the same analogue and digital IF modules (and CPU module) as the £££ Agilent PSA. But the phase noise performance is limited by the quailty of the local oscillators ahead of this final digital IF.
So by bypassing the front end converters I can get very low phase noise performance.

Obviously, I need to provide my own LO and mixer because I don't just want to look at 7.5MHz... So I can use a high performance DDS as an external LO with an external mixer and feed in direct at the 7.5MHz digital IF via a screened coaxial relay switch.

Look at my earlier plot. The phase noise 3kHz from the carrier is about -136dBc/Hz. This is about 24dB better than my legendary HP8568B at a similar offset. (or maybe 55dB better than a Rigol DSA815 at this offset!)

The standard E4406A can achieve -140dBc/Hz performance but only at offsets of several hundred kHz.

[edavid]

It's worth mentioning that some E4406As have the B7C baseband I/Q input option, so they don't have to be modified for this (or they are pre-modified).

[G0HZU]

That's a good point...

The B7C IQ baseband option is a highly desirable (but rare and expensive) option that requires a complete new card/module inside the analyser.

The B7C IQ baseband option is much more powerful than the simple fudge I am doing above because it presumably has dedicated ADCs in the addon card for each of the front panel I and Q baseband inputs. These two BNC inputs are usually seen as being blanked off in the top left corner of the front panel of a regular E4406A. I would really like to have this option but it is very rare and an E4406A with this option usually commands a much higher price

[davorin]

The screenshots from the Agilent Windows Software....is this freely available and just connects via TCP/IP or GPIB to the E4406?
Or does it need something else?

[PA0PBZ]

The screenshots from the Agilent Windows Software....is this freely available and just connects via TCP/IP or GPIB to the E4406?
Or does it need something else?

The link is in the thread, see reply #17. It's a 14 day time trial but there's ways...
I used TCP/IP to connect to the E4406A

[davorin]

Must have missed that one from all those nice screenshots (o;

So would you recommend this instrument for analyzing/Debugging MiWi, WLAN and other Radio signals?

[PA0PBZ]

I'm using it to play around with the various signals and modulation techniques and I'm still learning so I'm not qualified to do any kind of recommendation. However, since both the hardware and software are quite old I guess you should try to find something more modern if you are going to use this in a business, like the TEK RSA306.

http://thesignalpath.com/blogs/2014/11/04/tektronix-rsa306-usb-real-time-spectrum-analyzer-review-and-experiments/

[davorin]

Well I'm planning to use it privately....and secondly...the Tektronix is way out of Budget (o;

Would fit perfectly with my other "old" Equipment ;-)

[KJDS]

Well I'm planning to use it privately....and secondly...the Tektronix is way out of Budget (o;

Would fit perfectly with my other "old" Equipment ;-)

YHM

[davorin]

Hmm...people mention here that the SA part span is limited to 10MHz....
But on this Youtube video I see it set to 100MHz span....

[Wuerstchenhund]

Hmm...people mention here that the SA part span is limited to 10MHz....
But on this Youtube video I see it set to 100MHz span....

That's with the W-CDMA option. Other options and Basic mode are limited to 10MHz.

[davorin]

Makes perfectly sense then....the "W-" (o;

Still a nice and fast device...seems it is also running HP-UX 10.x?

[Wuerstchenhund]

Still a nice and fast device...seems it is also running HP-UX 10.x?

HP-UX/RT, an embedded (cut down) variant of HP-UX 8.x or 9.x if I remember right. The firmware console is similar to later HP9000 PA-RISC workstations, i.e. the 712 Series. pr the 744 VME controller (which is basically what the controller in this thing is).

It's the same as Agilent's old high end Spectrum Analyzer series PSA (the E4406A is essentially a cut down PSA).

[davorin]

Just made a little contact with HP-UX today on my 16702A (o;
Bad it requires to boot from another HP-UX machine...

The onscreen drawing updates are quite fast for an older machine....dunno about the remote software tool...
But seems a better choice than using my CRTUs for analyzing modulation....

[Wuerstchenhund]

Just made a little contact with HP-UX today on my 16702A (o;

HP-UX was great, I spent a lot of time with it on the larger servers (K-Class, R-Class) and supercomputers (V2500/V2600). It had a nice utility called SAM (System AdMinistrator) which made the basic setup pretty simple.

The onscreen drawing updates are quite fast for an older machine....dunno about the remote software tool...
But seems a better choice than using my CRTUs for analyzing modulation....

Well, both E4406A and CRTU were designed for cell phone testing but they are different devices used in different scenarios. The E4406A is a great signal analyzer but a pretty bad spectrum analyzer. The CRTU is a better spectrum analyzer, plus it's a RF generator, Protocoll Analyzer (under Windows2000) and automatic tester, but it's not a great signal analyzer.

[davorin]

Well would be a great combination to get a hand on a E4406A as well....maybe I sell one of my 2 CRTU-RUs even (o;

Hmm..I was more back then the SunOS 4.1.3 guy....configuring SunISDN card and had a hard time to find a provider who supported HDLC protocol for dial-up internet connections...and at workplace at CompuServe Switzerland (remember CompuServe? ;o) I had a Sun E250 as foot warmer under the desk (o;

But I still like the X-Motif interface on the 16702A.....not sure if the E4406A can be controlled remotely as well via a X11...

[Wuerstchenhund]

Well would be a great combination to get a hand on a E4406A as well....maybe I sell one of my 2 CRTU-RUs even (o;

It's a nice device, but for the great fun you'd also need the Agilent 89600A VSA software 

Hmm..I was more back then the SunOS 4.1.3 guy....configuring SunISDN card and had a hard time to find a provider who supported HDLC protocol for dial-up internet connections...and at workplace at CompuServe Switzerland (remember CompuServe? ;o) I had a Sun E250 as foot warmer under the desk (o;

I remember the E250. It was a nice box but I never managed to get one for some reason, so I ended up with E3000s, E3500s and E4500s (the E3x00s were nice deskside machines, and not too loud). But then, I was more a HP-UX and AIX guy anyways, plus a fair bit of IRIX and ReliantUNIX 

But I still like the X-Motif interface on the 16702A.....not sure if the E4406A can be controlled remotely as well via a X11...

I never tried but I can't see why not. And in theory it should be possible to connect an external SCSI hard drive (the E4406A has an SCSI port) and a SCSI CDROM, and either install HP-UX/RT to the disk or install a full HP-UX 9.x variant for the 744 on it, and copy the VSA software across.

[davorin]

Hmm...the Agilent 89600A VSA software seems an expensive bastard...but read it could be bypassed in a way?

Hmm..Irix....always loved those small SGI espresso machines back then...but back then I switched to Mac...as they had 68k inside and I never liked Intel CPUs with the strange memory layout (o;

[G0HZU]

The E4406A is really just a signal analyser that is designed to be used under very controlled lab conditions. It isn't really meant to be used as a spectrum analyser because of the crude nature of the frequency plan in the RF downconverter section. It has no image rejection and has areas in its 7MHz to 4GHz frequency range that will have poor spurious performance.

However, when used as a signal analyser for known signals it is a very powerful tool. I use mine with the 89600 SW and I also use it with an Agilent vector sig gen that has a dual arb generator built in.

eg it's possible to capture (offair?) signals using the E4406A and the 89600 SW and then export the data to the supported sig gen to be able to replay it back in a continuous loop in the sig gen. This can be at a different frequency or power level and you can also modify the captured data before sending it to the sig gen.

In my case, my fairly old Agilent vector sig gen has the required dual arb generator but it isn't supported by the 89600 SW so I created a Windows app to convert the captured data to the format expected by my sig gen and I can then upload it to my sig gen to fully replicate the captured offair signal in the sig gen.

[davorin]

What model of vector signal generator do you use?

Sounds interesting...

[G0HZU]

I've got two Agilent vector sig gen models with different options but they are both quite old and rapidly becoming obsolete in terms of their usefulness as research tools.

The one with the dual arb generator option is the Agilent E4433B ESGD sig gen. But it isn't supported by V12 of the 89600 SW so I created an app to convert and upload the data to the sig gen in the format it is used to. i.e. it expects to see separate I and Q data files. It works up to something like a 35MHz modulation BW.

If I had the Agilent E4438C sig gen I think the 89600 SW could generate data files that can be sent to it directly.

Note that the alternative (quick and dirty) way to do the above is to do it with a modern SDR Rx and Tx combo to capture and replay stuff.
 

[davorin]

Is it also possible to capture/display longer periods up to several 100msecs?

This signal below was captured with a Signalhund SA44B, though display time is limited a little over 100msec....

[G0HZU]

Is it also possible to capture/display longer periods up to several 100msecs?

I think it depends on the signal and how you set up the system. eg for narrowband signals you can capture many seconds of data until you hit the memory limit.

You can also look at signals on the 89600 SW via the LAN interface and this runs continuously although it isn't really capturing all the data although it is still useful in this mode as long as you don't mind missing some data. For many applications this doesn't really matter and you can still demodulate many waveforms in this continuous mode.

I finally got round to swapping the RTC battery over in mine today. It didn't take that long and I needed an excuse to try out a cheapo Worx cordless screwdriver anyway

There are loads of Torx screws to remove and some care is needed when removing both the digital IF, SCSI and the CPU cards.

But it went smoothly and the only tricky bit was pulling out the CPU card as you have to pull quite hard yet you also have to maintain a lot of control in order to keep the card moving slowly (and level) to avoid snag damage. There's a warning label on the rear panel about this and also in the battery replacement  instructions.

It's a shame that battery access isn't simpler especially if it only lasts a few years per battery. 

[davorin]

Speaking of the 89600 software......

Which is the latest VSA software version which can support the E4406A with the registry hack? Is v 12 the last version known to work?

[Wuerstchenhund]

Which is the latest VSA software version which can support the E4406A with the registry hack?

12.02

[G0HZU]

I've not tried connecting to it beyond V12 so I'm afraid I don't know. Beyond V12 the SW was changed from 89601A to 89601B so I suspect there were quite a few changes made at this point. I think the later versions need Win7 or newer and the standalone laptop I use with it is an old dual core PC running WinXP. So I'm sticking with V12 as it does what I want for now.
However, I did download V19 a while back and had a play with it on my main PC but I didn't try to connect to the E4406A.

I'm mainly using the E4406A + the SW to grab offair signals so I can replicate them by sending the captured data to a vector sig gen and then I play around with the replicated signal on the bench. For stuff like this it works really well and I don't need any extra features for now

[davorin]

Well I just quickly installed v12 on a Parallels virtual instance eon OSX running Win 8.1 pro...and in demo mode the software works quite well and fast. No hickups, freezes or crashes...
not sure if it still works with newer agilent io library though...

[davorin]

Okay...my E4406A arrived today and sits now besides my desk (o;

IP configured, reg hack installed...but when launching VSA Software 12.0x it tells me that no suitable Input hardware was found...

Something I missed?

Also Keysight IO connection expert doesn't recognize it...

Or does it work only via GPIB?


This is from the VSA software boot log:

[G0HZU]

I've used it OK with both GPIB and LAN.

GPIB is much easier to set up but with LAN you have to set up the IP correctly and I also used a crossover cable. You also have to install the correct registry update for the OS you are using. I use an old dual core laptop running WinXP with the E4406A and so I used the 32bit registry file.

There is also a 64 bit registry file for 64bit OS. Which are you using?

[davorin]

Hmm...I'm using 64bit OS....

Just now removed the new Keysight IO lib and replaced it with the VSA 89600 supplied Agilent IO lib...
Now it checks both addresses during Startup, GPIB and LAN....

Crossover? What's that? (o;

I'm running my home network with several switches and dual SM fibre cables between rooms ;o)


So where can I find the 64-bit reg file Version?

[davorin]

Found it...in the same Agilent forum topic as the last post (o;

Not sure if it will still work when replacing the Agilent IO lib with newer Keysight IO lib...

Here a quick AM modulated signal coming from a R&S SMT03...

[davorin]

Experimenting now with the E4406A and the VSA software (o;

Haven't figured out yet how to capture and demodulate Microchip MiWi signals at 868MHz...think those modules default to OOK...

So which demodulator I have to choose? The only Thing coming close was RFID demodulator...as I haven't found any specific ASK/OOK demodulator.

[fisafisa]

Hi.
I want to try this software next few days.
I have got a 4406A too, I downloaded the version 12 as per the link earlier in this forum.
Where is the patch?

Thanks

[0xfede]

Hi folks,

another happy E4406A owner here. The one from EQT is arrived and is working fine despite the missing serial numbers.
When I'll have some spare time I'll give a shot to the 89601A which looks promising.

@fisafisa:
I found the registry fix on the keysight forum, precisely here:
http://www.keysight.com/owc_discussions/servlet/JiveServlet/download/83-18386-59940-3445/e4406.zip

[fisafisa]

Thanks

[fisafisa]

Will the software run in a virtual machine under linux?
If not it means resurrecting an old laptop!

[0xfede]

Hi again folks.

I'm here because I'm getting trouble connecting the 89600 to the E4406A.
After all the installation I'm stuck with this message:
Cannot find a supported input. Option 300(Hardware Connectivity) is not installed on this system. Inputs will simulate an Agilent VSA E1439 70MHz IF 95Ms/sec ADC.
Of course I've added and successfully identified the instrument in Agilent Connection Expert and I see briefly it in the 89600 loading window just before the message.
My system is WIN XP 32bit SP2, E4406A Hardware is FW A.10.08
If I use SCPI commands via telnet it works fine.
Both TELNET and Socket ports are ON.
I've tried fresh windows installation with 89600 V9.02, V11.21, V12.02
I'm sure that I'm missing something, any help will be greatly appreciated.

Thanks,
0xFEDE

[davorin]

What does "Help -> About Agilent VSA" show when you click then on the "boot log" button?

Did you install the Agilent IO lib with the 89600 software or was there a previous Agilent IO installation?

[0xfede]

@Davorin
Thanks for your answer. Yes I installed it.
I found the cause in the demo license that has not authorized the option 200 and 300.

DOH! 

[davorin]

Will the software run in a virtual machine under linux?
If not it means resurrecting an old laptop!

Don't have any vmware stuff on my Linux box...but I can tell for sure it will run on OSX under Parallels (o;
Doesn't run on VMWare Fusion though as it recognizes the host application...

[0xfede]

And it works under Oracle VM VirtualBOX on Win 7 64bit.   

Best,
0xFEDE

[fisafisa]

windows 7 as avirtual OS or as the real OS hosting some other OS?

Filippo

[0xfede]

Sorry, it's the host sw.
For the virtual I use Win XP SP II.

0xFEDE

[davorin]

Trying to use the E4406A with the software to demodulate a FSK 868MHz Signal coming from a Microchip MiWi transmitter...

Only think I know is the bit rate of 20kBits/sec of the Transmitter, and that it transmits slightly below 868MHz.
The Microchip datasheet doesn't mention which FSK it actually uses, but as 4 bits are used to generate the frequency shifting I assume FSK16.

Still can't get any meaningful readings out of the VSA software...

[PA0PBZ]

I think MiWi supports frequency hopping, so good luck following that on the VSA 
Also, where did you get the 20 Kbps from, what chip are we talking about?
Can you see any carrier on the VSA?

[davorin]

It's a MRF89XA transceiver....but isn't FSK the same as frequency hopping?
The 20kbs is programmed in software...

Yes the carrier can be seen clearly..here two transceivers communicating:

[davorin]

Maybe another question...what are you using the E4406A for?

[0xfede]

Attached you will find a quick and dirty measurement of a low baud rate application of the MRF89XA @868 MHZ.

[davorin]

Nice :-) How did you set it up?

At least I could see now the spectrum of a demodulated FM broadcast Station with clear 19kHz pilote tone (o;

[PA0PBZ]

It's a MRF89XA transceiver....but isn't FSK the same as frequency hopping?
 

No, frequency hopping means that the whole carrier jumps (semi) randomly to another channel, FSK stays on the same channel but shifts the carrier a bit around. So while FSK shifts the carrier a little bit around the zero position (a few KHz to 20-30 KHz up and down) when it does frequency hopping it can shift 100's of KHz and starts the FSK from that new position. Anyway, if you can see the carrier and it does not disappear there is no frequency hopping...

[0xfede]

@davorin
The DUT is a commercial product I've designed several years ago. It uses a custom protocol (not developed by me) that has to be mantained for retrocompatibility.
I connected the DUT to the E4406A trough an HP 778D and a 20db PAD. The other port is connected to the Master transceiver (based on an hybrid module and it is not my design).
The 89600 software is quite complex to set up (but very powerful too) and I can't remember all the settings. If you need it I may send you the setup file.
For the differences between FHSS and FSK I'll make a measurement of another device (based on silabs SI103x). I hope I'll have time on Thursday to make some shots.

Best,
0xFEDE

[harha]

Hello
My E4406A has a low frequency drop off at about 200Khz--some have wondered about if the front end  7dB attenuator also have a dc block inbuilt!
I have replaced this attenuator with a pecision narda--and the answer is simple-yes the original made by weinschel have a dc bloc,so now my E4406A goes down to a few Hz.Now using an external dc block when needed.
Hardy

[TSL]

Santa brought an E4406A with the IQ option to my lab to day

I've been reading the docs and checking out its menu's, the only option missing is the IF out !

It needs a new CPU battery so I'll have to wait a few days or so for that to arrive before I take it apart

Haven't yet put a signal into it, just yet. Maybe in the next day or so once I've rebuilt the engineering PC.

[asilva10]

Just received my E4406A today - not much experience in this area.
I would like only to use the Spectrum Analyzer portion to zoom-out details that my current SA (HP8590A) cannot reach at the same accuracy level.

My question is how to eliminate the green trace that basically follows the yellow? I know that they are related to I-Q stuff - someone can help me here with this basic stuff since I am just using the min RF inut port?

[0xfede]

Just push the zoom button (below the screen). Then with the 'next window' button you'll cycle between IQ window and spectrum window.

Best,
0xfede

[asilva10]

Just push the zoom button (below the screen). Then with the 'next window' button you'll cycle between IQ window and spectrum window.

Best,
0xfede

Hi Oxfede,

thank you. I did that and I have full screen with the spectrum but both traces (yellow and green) show up. I would like to see just one. We have some screenshots at this website showing this but I was not to do the same.

[0xfede]

Then click the 'View/Trace' button, 'Trace Display' and select the 'Current' or the 'Average'.

[asilva10]

Then click the 'View/Trace' button, 'Trace Display' and select the 'Current' or the 'Average'.

It worked!!  Thank you!!

[PA5Y]

Hi ?

I have an E4406A and an old version of softplot. The instrument is listed and I appear to get a correct IDN when using the Spectrum analysis tab. I have the instrument set to 192.168.0.106 SCPI Port 2025. These are the settings that I have in softplot. The instrument and the PC that softplot is installed on is connected via a gigabit switch and the NIC is on 192.168.0.60.

Are there any peculiarities that I need to be aware of?

I am also very interested in getting a working version of the VSA software, could you point me in the right direction, I saw some old references earlier in this thread but the links did not work?

Many thanks

Conrad PA5Y (G0RUZ)

PS Windows firewall is configured to allow Softplot

[PA5Y]

Problem solved, I was trying to use the Spectrum Analyser tab in softplot whereas I should have been using the Modulation Analyser tab. All is well.

Regards

Conrad PA5Y

[zmetzing]

Santa brought an E4406A with the IQ option to my lab to day

I've been reading the docs and checking out its menu's, the only option missing is the IF out !

I'm eagerly awaiting my E4406A from the ebays, complete with I&Q baseband inputs. (There's another one on there right now if anyone is interested).

The IF output can be added by following the instructions in this thread:

https://www.eevblog.com/forum/testgear/agilent-e4406a-opt-300-diy-cable/

[zmetzing]

Ahh, she arrived today! Only a 12-bit Digital IF board, but you can't have everything.

Could someone point me to an archived copy of the HP 89601 v12 software? I can't seem to find it anywhere on Keysight's site.. only the new version which doesn't support the E4406A anymore.

Thanks!

[Wuerstchenhund]

Could someone point me to an archived copy of the HP 89601 v12 software? I can't seem to find it anywhere on Keysight's site.. only the new version which doesn't support the E4406A anymore.

Try this:
http://www.keysight.com/main/software.jspx?cc=GB&lc=eng&ckey=1303376&nid=-32408.626685.02&id=1303376

[KE5FX]

Has anyone run across a copy of the N2714A performance verification and adjustment software for the E4406A?

[harha]

Have any tried vsa  89601B-newer version than ver. 12- with E4406A??
Hardy

[Wuerstchenhund]

Have any tried vsa  89601B-newer version than ver. 12- with E4406A??

It doesn't work, and there's no hack I'm aware off to make it work.

[Daxxin]

where download last working version of 89600 for the E4406A?

[PA0PBZ]

where download last working version of 89600 for the E4406A?

You could read the thread, it's not that big...

https://www.eevblog.com/forum/testgear/agilent-e4406a-vector-signal-analyser/msg645924/#msg645924

[Andrey_UR]

Hello colleagues!

Whether there is an opportunity to prolong the term of work of the 89600 program? I have installed the program a year ago and didn't use it, and now I want to resume work. How do you solve this problem at full-time employment with the E4406A?

Thanks a lot
Andrey

[RCHRDM]

Hello

Does anyone know what the user name and password are for the E4406A?  I am trying to connect an FTP client.

Richard

[S57UUU]

I've just brought home from Hamradio Friedrichshafen an Agilent E4406A. Now playing with it, and quite impressed with both amplitude and frequency accuracy.

I noticed there are two plugged holes marked "I input" and "Q input" on the front panel. A baseband analyzer would be very nice to have, so I searched the web, and found out about the B7C option. But that one has FOUR inputs!
Does installing it include drilling some holes? More probably, a new front panel comes with it.
But then, why the TWO holes? My guess is that there exists some other (simpler/cheaper) baseband option. Looking at the block diagram in the service manual, there are two extra inputs (J8,J9) on the A10 module, with cables marked "to front panel" connected to them. These are connected, via some switches, to the same A/D input as  J7, where the 7.5MHz IF comes in. So, a true quadrature sampling baseband analyzer is not possible using these inputs, but a real signal (I only) baseband analyzer would still be very useful, for example as a backend for "mix to zero" phase noise measurement.

My question is:   is there a version of the firmware that supports such a mode, or maybe this functionality is hidden in some "personality"? I have searched the menus, but found nothing, not even a "grayed out" option anywhere. My firmware is revision A.10.08 from 20070628.

Marko Cebokli

[colorado.rob]

This is a bit of a necropost, but this is *the* thread that comes up when searching Google on the topic of E4406A and the 89600 VSA software.  I just got this working so I thought I would share what was involved.  This will allow one to use unsupported VSA software with their unsupported Agilent E4406A.  I have tried to keep this post informative and within the community guidelines (https://www.eevblog.com/forum/chat/important-hacking-information-on-the-forum/).

I went through the process of setting up 89600 version 12.02.  This is the latest version of the software that can be used with the E4406A.  This version is no longer supported and it is no longer possible to get a license for it.

I have this working on a Linux host, running VirtualBox 6, with a Windows 10 guest.  I could not get this working when using qemu-kvm.  This assumes you are running 64-bit host and guest OSes.

The process I went through was:

 * Download the ckinfo tool which you may be able to find on popular source repositories.
 * Search the interwebs for the VSA 89600 user key.  You may need Google Translate.  These typically show you how to find it by disassembling the executable.  You don't need to actually do that as they typically post the key they found.  It's the same key for all instances.
 * Download the 64-bit registry hack to allow version 12.02 to work with the E4406A from here: https://community.keysight.com/servlet/JiveServlet/download/54787-1-5193/e4406+64+Bit+OS.zip
 * Download both version 11 and version 12 of the VSA software from Keysight.
 * Install VSA software version 11 -- I did not install the AgilentIO drivers from this version.
 * Start the software in demo mode.
 * Go to Utilities|License|Modify and copy the site code. (If this key ends in an X, you are running VSA version 12 & you will not be able to generate a license.)
 * Run ckinfo to generate a license (see below).
 * Enter in the "Encrypting Key" output by ckinfo.exe into the Site Key entry.
 * Verify that the options needed are now licensed.
 * Exit the VSA software.
 * Upgrade to version 12 & install the AgilentIO libraries.
 * Apply the 64-bit registry hack (and verify that the entries have been added)
 * Go into the Agilent Connection Expert and set up your device.  If using a LAN, make sure you use "remote instrument name" and not "socket port number".
 * Start VSA version 12. It should detect the instrument.

I ran ckinfo under wine.

Code: [Select]

$ wine ckInfo.exe /createKey site
CrypKey Copy Protection Information v1.14

Key Information...
+ Site Code            : <enter site code for your machine here>
+ User Key             : <enter the user key downloaded from the interwebs>                               
+ Easy Licence?        : No                                                   
+ Number Of Licences   : 1                                                   
+ Network Licence?     : No                                                   
+ Licence Duration     : Unlimited                                           
+ Key Level            : 65535                                               
+ Key Options          : 1-6,8-16                                             

Key Validation - OK
Creating Key   - xxxx
Encrypting Key - xxxx

Press any key to continue...

The "Encrypting Key" is the one you want.

[RCHRDM]

Thanks for this.  I too went through this process and made some notes, as follows.  I have not done this for a while but it seemed to work at the time.


Instructions for Installing Agilent 89601A Vector Signal Analysis Software
(For use with the HP E4406A)

1.   Unzip the “89600_FIX,” “e4406 32 bit 0s,” and “e4406 65 Bit OS” files.
2.   Run “e4406 32 Bit” or “e4406 64 Bit OS” (depending upon your OS) and “e4406” to change the PC’s registration files.
3.   Run the version 12 VSA installer.  It will unzip its contents into the “C:\glacier_cd” directory.
4.   Go to that directory and run “autoplay.”
5.   When the VSA installer starts, choose “Install 8600 Series Software.”
6.   In the “Select Products and Features” window, select “Agilent 89600 VSA” and “Floating License Support.”
7.   After the installer has finished, a “Hardware Support” window will appear.
8.   Select “Agilent I/O libraries” and click “Install Hardware Support.”
9.   After this installation has finished, go to C:\Windows\vsa\licenses and move the “license.lic” file into the “licenses” folder.
10.   Start “LMTOOLS” from programs, Agilent 89600 license support and choose "configuration using license file/”
11.   Point to license file in above folder.
12.   Also check "lmtools ignore license file path...."
13.   The VSA software will now run and recognize the E4406A.

[KE5FX]

Where are you guys finding 12.02?  All I can find on Keysight's site is version 12.00.

[colorado.rob]

Where are you guys finding 12.02?  All I can find on Keysight's site is version 12.00.

That is version 12.02 -- you'll see after you install it.

[colorado.rob]

Thanks.  There are a few things that are unclear to me from your instructions.

1.   Unzip the “89600_FIX,” “e4406 32 bit 0s,” and “e4406 65 Bit OS” files.

What is "89600_FIX"?  I've never heard of it.  Where does this come from?

9.   After this installation has finished, go to C:\Windows\vsa\licenses and move the “license.lic” file into the “licenses” folder.

What are the precise source and destination paths for license.lic?  Which "licenses" folder? Does it come from C:\Windows\vsa\licenses?  If so, what is the destination directory?  Otherwise, what is that the source path of this file? 

[n8ur]

The URL for the E4406A/89600 registry hack file shown in reply #98 no longer works.  Is there anyone here who has that file and would be willing to provide it to me?

Thanks!
John

[PA0PBZ]

Find it attached, rename from .txt to .reg to process.

[jwrodgers]

on the keysight community website I searched today for e4406 64 bit and found the attached.