Agilent E4406A Vector Signal Analyser

[G0HZU]

I bought one of these Agilent E4406A vector signal analysers a few days ago to play with for analogue and digital demod purposes. These versatile instruments can be purchased for just a few hundred pounds these days.

http://www.keysight.com/en/pd-1000002790%3Aepsg%3Apro-pn-E4406A/vsa-transmitter-tester-7-mhz-to-4-ghz?cc=US&lc=eng

I wondered how many other E4406A users are on here and what they use it for? I plan to use mine as a research tool to demodulate/verify various analogue and digital signals.

Therefore, I've bought mine purely for signal analysis rather than spectrum analysis and I plan to dump data from it and do the demodulation etc in a remote PC. At the moment I'm playing with some legacy Agilent SW tools that offer various demodulation personalities. I've so far managed to configure an old laptop to control the E4406A and take data from it via LAN or GPIB and this seems to run OK with the older Agilent SW and the E4406A after a bit of persuasion...

I've also loaded the latest firmware to mine over LAN and also calibrated the internal 10MHz oven via LAN as per the procedure in the manual. I'm probably going to replace the Lithium coin cell battery on the main CPU card.

Has anyone done this already? Is it easy to take apart and gain access to the battery? I've not had the covers off to look inside yet...

[G0HZU]

W2AEW did a couple of videos showing what an RTSA can do when analysing a VHF transmitter on keyup here:





So I had a play with the E4406A today and the Agilent SW to see if it could do something similar. I've only spent a few minutes on this but I managed to replicate the same results. The playback is very fluid and can be manually incremented to microsecond resolution. So the spectrum can be played back very slowly and watched as the radio transmitter locks up.

See the two images below.

I'm struggling a bit with the spectogram feature but I managed to get it to do something in the second image.
To get these plots I'm using some fairly modern analysis tools from Agilent that can be persuaded to work with the E4406A. This is just scratching the surface but there's a lot of things that can be done (in a PC)  with the data a E4406A can spit out. 

[G0HZU]

I did a quick and dirty youtube video to try and capture how fluid the data capture and playback is.

Maybe it can go faster as I did this via GPIB rather than high speed LAN between the E4406A and the PC.

The top right plot is the demodulated FM spectrum as I've included FM demodulation in the analysis. So it's possible to look at FM transmitter audio distortion etc.

But you can see it's quite impressive (unlike my video making skills )

https://youtu.be/T7wIXfE-2BE

[Neganur]

I've been eyeing one for a while now and I would use it to characterise amplifier stages etc.
The only real obstacle in my eyes is the 10 MHz span and I've been wondering if it's feasible to just do wider sweeps by combining 10 MHz pieces on an external computer.
I have not found any info on how much time it takes to change the span nor how fast the data transfer is. To my knowledge this is an FFT SA that should be quite fast.

[nctnico]

The only real obstacle in my eyes is the 10 MHz span and I've been wondering if it's feasible to just do wider sweeps by combining 10 MHz pieces on an external computer.

On a 'real' spectrum analyser a detailed sweep of a large span is slow as well. Stitching 10MHz sweeps together shouldn't be much slower if you can transfer the data at a reasonable speed.

[G0HZU]

Don't get too excited as I don't think the E4406A is really suitable to be used as a conventional spectrum analyser because of its very basic frequency plan in its downconverter section. So even if you program/control it to stitch together a wider sweep it will not give the same performance as a conventional analyser because it will be prone to displaying image/spurious terms at some parts of the sweep.

It really is best used as a signal analyser under tightly controlled conditions within its 10MHz span. Under these conditions it appears to be a very powerful tool.

I think I can demodulate pretty much anything using the combo of the E4406A and the Agilent SW. There appear to be dozens of demodulation personalities to choose from.

Here's an image of a simple (but low level and noisy) BPSK signal and also a 16QAM signal being demodulated and analysed for constellation and Error Vector Magnitude etc. I used an Agilent E4433B vector sig gen to generate these test signals. I think the analysis SW can go up to 1024 QAM but I can't test it for that! It can also do analogue demod of AM and FM and other odd things like RFID tags, bluetooth, WLAN, WIFI and various mobile phone formats eg 3/3.5G


 

[cyr]

I've been eyeing one for a while now and I would use it to characterise amplifier stages etc.
The only real obstacle in my eyes is the 10 MHz span and I've been wondering if it's feasible to just do wider sweeps by combining 10 MHz pieces on an external computer.
I have not found any info on how much time it takes to change the span nor how fast the data transfer is. To my knowledge this is an FFT SA that should be quite fast.

Using this tool you can grab about 5 10MHz chunks per second from the E4406:

http://ve2zaz.net/InstrCtl/InstrCtl.htm

It may be possible to optimze that more, it certainly captures many more frames per second in regular use (not tuning).

Also, I believe it's possible to get a stitched span up to 100MHz in WCDMA mode (option BAF) directly on the unit, although I haven't tested that.

[edavid]

I'm probably going to replace the Lithium coin cell battery on the main CPU card.

Has anyone done this already? Is it easy to take apart and gain access to the battery? I've not had the covers off to look inside yet...

It's harder than it should be... refer to the service guide for the CPU board removal procedure:

http://www.keysight.com/upload/cmc_upload/All/E4406-90178.pdf

[Neganur]

Using this tool you can grab about 5 10MHz chunks per second from the E4406:

http://ve2zaz.net/InstrCtl/InstrCtl.htm

Oh! Thanks for that link. That's enough to give me an idea of what could be achieved.
4 GHz span in 90 seconds is totally OK, if I know where an area of interest is I can always go and have a look manually.
Most of the interesting tests have a span of 10 MHz (2nd and 3rd Harmonic of an 865 MHz ISM BPSK signal) and if it can do additional demodulation of the most common types that's all I need.
The digital communication personalities are a nice bonus. Are they required for the demodulation of normal digital types like  16 QAM etc?

[G0HZU]

I'm very new to this instrument but normally the E4406A comes with something like 48Mb or 64Mb of onboard memory to store its firmware plus a limited suite of measurement personalities within itself. Mine is limited to 48Mb so I can't really demo how to install extra personalities. Mine came with GSM edge 202  which is fairly useless to me. There isn't much room left after the firmware plus option 202. Otherwise I'd perhaps investigate making a keygen to unlock all this obsolete stuff. But I only have 48Mb onboard

So I looked at old versions of the external support SW. This SW is meant to be used with Agilent's own DSP hardware platform but the early versions also supported the E4406A. This software is long obsolete and is unsupported and it was never free although you can get a 14 day free trial.

The version I'm running is much newer (but still long obsolete) and also supported a free trial (via flex?) but the E4406A isn't formally supported. However, there's a registry fix for including E4406A hardware support which I tried and this seems to work with my E4406A. It took me a fair bit of fiddling about to get it all to run. I dug around inside their code and found all kinds of bonus stuff like special demod modes and other hidden things it can demodulate that aren't listed in their glossy blurb. But I don't know what they are yet and so can't test them. eg Special Demod Modes 1 throu 9? Anyone know anything about this?

[cyr]

My unit came with license files for almost all options, as described here:

https://www.eevblog.com/forum/testgear/%27free%27-vsa-options/

I have no idea why, but I'm not complaining. Not that the various personalities are *that* useful, but they can't hurt. Constrained by the 48M flash though, maybe a DIY 64M upgrade could be possible - or a software mod to load files from LAN or SCSI...

[G0HZU]

The digital communication personalities are a nice bonus. Are they required for the demodulation of normal digital types like  16 QAM etc?

As far as I know the E4406A doesn't have a generic analog/digital personality option. So you are just limited to whatever mobile phone personality options it was shipped with.

However, the VSA software does all the various demod modes with option AYA. You can define the digital filter type, bit rate and loads more parameters for each demod type you choose.

http://cp.literature.agilent.com/litweb/pdf/5990-6387EN.pdf

[G0HZU]

I'm probably going to replace the Lithium coin cell battery on the main CPU card.

Has anyone done this already? Is it easy to take apart and gain access to the battery? I've not had the covers off to look inside yet...

It's harder than it should be... refer to the service guide for the CPU board removal procedure:

http://www.keysight.com/upload/cmc_upload/All/E4406-90178.pdf

Thanks... I think I'll wait a while before taking it apart. I generally avoid taking test gear apart unless really necessary. However, the service document states that the battery lasts for just 3 years typically so I reckon mine will probably die soon...

[G0HZU]

My unit came with license files for almost all options, as described here:

https://www.eevblog.com/forum/testgear/%27free%27-vsa-options/

I have no idea why, but I'm not complaining. Not that the various personalities are *that* useful, but they can't hurt. Constrained by the 48M flash though, maybe a DIY 64M upgrade could be possible - or a software mod to load files from LAN or SCSI...

That's interesting...  It would be nice if it were possible to dump the personality into the machine via LAN but I've got a lot to learn about this instrument and at present I know very little about what can be done with it to increase its versatility.

[G0HZU]

To show it can also do 'old school' analogue FM demodulation here's an image of it demodulating my Marconi 2024 sig gen set to 5kHz FM deviation and a 2.093kHz modulation frequency.

You can see it measure the peak deviation correctly and also the demodulated tone is measured at 2.093kHz in the demodulated spectrum in the lower left corner. It shows a deep Bessel null here as expected

It can also do AM and PM modes.

[PA0PBZ]

Thank you for starting this topic. I have the VSA also to look at and learn about the different digital modulation formats, and I also have a E4433B to feed it.
I knew about the 89600 software and planned to have a look at it, but somehow there's always more important things to do... Well, you finally made me install it and have some fun, I even managed to get a reasonable QAM64 display:



QAM256 however looked like spaghetti, not sure what is going wrong. Anyway, looks like I have 14 days left to find out 

[G0HZU]

Hi PA0PBZ
Which version of the software are you running? I started out looking at the first version that supported the E4406A that is dated 2001 (version 2?) and went through Version4 to Version 12.

I think that support for the E4406A runs from Version2 through to Version9 but E4406A support is possible on later versions with a (semi official?) registry fix from Agilent.

The later B version of the SW (Version 19) looks good but I'm not sure if this can be made to work with the E4406A. However, the B version SW works with the Agilent E4440A PSA analyser and my E4406A has the same CPU module and analog IF and digital IF modules as a PSA analyser so maybe it can work with the E4406A. But there may be a firmware limitation that prevents this in the E4406A?

I saw what you did with yours in this thread here:
https://www.eevblog.com/forum/testgear/%27free%27-vsa-options/

Interesting stuff!

[PA0PBZ]

Hi,

I got the latest version (12) of the 89600A software from here: http://www.keysight.com/main/software.jspx?ckey=1303376
and of course the registry fix. I noticed that while the instrument on itself can do a 10MHz span, the software only goes to 8.
I use the LAN connection and it seems to work fine.

[G0HZU]

QAM256 however looked like spaghetti, not sure what is going wrong. Anyway, looks like I have 14 days left to find out 

I had the same issue but I found it worked perfectly at higher symbol rates. eg I turned the 256QAM signal up to 512kbpson the E4433B and the 89600 SW and the errors went right down and the constellation looked really clean

I think it's more realistic to run it at a symbol rate like this

[1design]

If you use the equalizer you might also improve a bit your EVM reading.
Try also increasing the number of symbols, this wil show if the source has any phase noise or amplitude and phase imbalance issues.

[G0HZU]

I did some more testing on my E4406A yesterday and found something a bit odd...

The front panel says the input is OK to 26V DC and this seems a very strange number. I did some testing and found that the input is not DC blocked on mine.

So I decided to take the covers off to see what was inline at the front end. It seems to go directly into an SMA (7dB?) attenuator. But I did some more tests and there seems to be a DC block after the attenuator. I think this may be built into the attenuator back end. It can't be fitted 'backwards' in my case because the SMA connector gender at each end doesn't allow this.

There appears to be a 7dB (SMA) attenuator at the input that is rated to several Watts. This doesn't seem to be rated to handle 26V DC even though it has cooling fins etc. Maybe the 26V DC spec is just for a short term application of DC.

It's unlikely that my attenuator has 'lost' its DC blocking at the input and assuming that my E4406A is typical then it's worth noting that the input is resistive with about 80R shunt resistance. So be careful how you connect things to it if you assume it is DC blocked. Mine isn't!

[KJDS]

I'd take a guess at the attenuator being about 5W.

26V into 80 ohms is 8.5W, so it's possible that it's capable of handling that, but as you suggest it's not a sensible thing to do for any length of time.

[G0HZU]

I'd take a guess at the attenuator being about 5W.

Yes, I'd say the attenuator type is rated/advertised for about 5W but probably to a spec with a few weasel words in the small print

I think it's probably designed like this to withstand the RF power from a direct connection from a mobile handset. But mine appears to have a built in DC block at the other end of the SMA attenuator. This is inside the attenuator?

Maybe this is there to protect the next stage in the RF front end from the attenuated DC from the max 26V fed at the input?

[G0HZU]

While I had the covers off I had a closer look at the block diagram and the various coax cables between the modules. There is the ability to feed a signal directly into the digital IF at baseband if a cable is disconnected.

The appeal here is that the system phase noise should be very low. Much lower than any of my mid range lab grade sig gens can achieve so they are useless as a test signal here. So I quickly tried a homemade 7.5MHz free running LC oscillator with a loaded Q of about 30. This should be capable of <<-150dBc/Hz at 10kHz offset.

I tried this (via an anti alias LPF) in the E4406A and the E4406A limited out at -136dBc/Hz at maybe 3-10kHz offsets. Not bad! The idea would be to use an external LO and mixer to make a fairly decent phase noise measuring capability if a coax relay was fitted here. Note: My E4406A has the 14bit IF module which will help here.

The external LO could be something like an AD9912 or AD9914 DDS that can deliver very low phase noise. This is still way off what something like a E5052A SSA can achieve in terms of phase noise floor but it's a big step up from a decent lab grade analyser in this respect.

I also had to play inside the advanced FFT menus to get the last few dB of performance when so low down in signal level.

The plot below is on 15dB/div not 10dB in order to get it on the screen. The Err logo on the screen is because the analyser is not happy that I broke the signal path to allow this signal to be fed into it. So it failed to complete its regular self test signal routine.

[Neganur]

Actually a question regarding the 89600  software. I remember requesting a trial license to see how well it works with the 3000X series oscilloscope.
Does the software need a license to run with the E4406A or is there a license on the device itself like on some infiniium oscilloscopes?