Modulation Analysis with an RTSA

A modulated signal is a story written in phase and amplitude. Demodulation is reading the story. EVM is asking how legibly the writer wrote.

6.1 From Spectrum to Symbols: The Demodulation Chain

A spectrum tells you which frequencies are present and how strong they are. It does not tell you what they are saying. That is the job of demodulation.

The demodulation chain that follows the FFT in an RTSA looks like this: channel selection picks the band of interest from the wideband capture, carrier acquisition finds the exact center frequency of the signal, symbol clock recovery finds the symbol rate and phase of the modulation, equalization compensates for channel-induced amplitude and phase distortion, symbol decision maps each received complex sample to the nearest constellation point, error metrics computes EVM, MER, BER, and any standard-specific quality measures, and decoding (where applicable) recovers bits, frames, and protocol-level structure.

Each stage is its own discipline. A 5G NR modulation analysis tool like the one in Aaronia RTSA Suite PRO contains tens of thousands of lines of code spread across these seven stages. But the architecture is the same for every standard. Once you understand the chain, every protocol-specific implementation becomes a variation on a theme.

The output of the chain is a constellation diagram, an EVM number, and (often) decoded data. That trio answers the question every RF engineer eventually faces: is the signal good enough?

6.2 Digital Modulation Families

Digital modulations encode bits onto a carrier by varying its amplitude, phase, frequency, or all three.

Amplitude shift keying (ASK) is the simplest. Encode a 1 by transmitting the carrier, encode a 0 by turning it off, or use multiple amplitude levels for higher bit rates. Sensitive to fading and rare in modern wireless beyond simple RFID and key fobs.

Frequency shift keying (FSK) encodes bits by shifting the carrier frequency between predefined values. Binary FSK uses two frequencies. Gaussian FSK (GFSK) shapes the frequency transitions to limit the spectrum, used in Bluetooth Low Energy and many low-power IoT radios. FSK is robust against amplitude variation and easy to demodulate, which is why it dominates short-range and IoT applications.

Phase shift keying (PSK) encodes bits by shifting the carrier phase. BPSK uses two phases (0 and π). QPSK uses four phases, encoding two bits per symbol. 8-PSK uses eight, encoding three bits per symbol. PSK has constant envelope (no amplitude variation), so it works with efficient saturated power amplifiers. Used heavily in satellite links and older cellular.

Quadrature amplitude modulation (QAM) encodes bits by combining amplitude and phase. 16-QAM uses 16 distinct combinations of in-phase and quadrature amplitudes. 64-QAM uses 64. 256-QAM, 1024-QAM, and 4096-QAM push higher and higher. Each doubling of constellation points adds one bit per symbol but demands more SNR to decode reliably. Modern Wi-Fi, 5G NR, and DOCSIS cable systems use up to 4096-QAM in clean conditions.

Orthogonal frequency division multiplexing (OFDM) is not a single modulation but a multiplexing scheme. Split a wideband channel into hundreds or thousands of orthogonal narrowband subcarriers, modulate each subcarrier with QAM, and transmit them in parallel. OFDM tolerates multipath gracefully (each subcarrier sees a flat channel) and scales to wide bandwidths cleanly. Used in Wi-Fi 4 and later, LTE, 5G NR, DVB-T, and most modern wideband systems.

Spread spectrum modulates the carrier with a pseudorandom code that spreads the signal over a much wider bandwidth than the data alone needs. Direct sequence (DSSS) and frequency hopping (FHSS) are the two flavors. Used in CDMA, GPS, military communications, and some IoT systems where jamming resistance or low-probability-of-intercept matters.

6.3 Constellation Diagrams and EVM

A constellation diagram plots the I and Q components of received symbols as a scatter plot in the complex plane. Each cluster of dots is a constellation point. A perfect modulator produces dots that land exactly on the ideal points. A real modulator produces dots that scatter around the ideal points due to noise, imperfections, and channel distortion.

The error vector for one symbol is the complex difference between the received point and the ideal point:

Error vector magnitude (EVM) is the RMS of the error vectors across many symbols, normalized by the average constellation power:

EVM is usually expressed as a percentage of the reference signal amplitude or in dB. For 5G NR 256-QAM, the standard requires EVM better than 3.5 percent (about -29 dB) at the transmitter output. For Wi-Fi 7 1024-QAM, the requirement is even tighter, around 1.4 percent (-37 dB). These numbers are physics constraints. Below the threshold, the constellation points blur together and bit errors explode.

What EVM Tells You About Your Hardware

A high EVM means something is wrong. The diagnostic value is in the pattern of the error.

• Symmetric scatter around every point: thermal noise. SNR is the limit. Either reduce the noise figure or increase signal power.
• Each cluster smeared along an arc: phase noise on the LO. Improve oscillator quality or apply phase noise compensation.
• Each cluster smeared radially: amplitude noise or AGC instability.
• Each cluster shifted diagonally: I/Q imbalance. Calibrate.
• Constellation rotated as a whole: residual carrier frequency offset. Improve carrier tracking.
• Constellation rotated as a function of time: oscillator drift. Improve frequency stability.
• Outer constellation points scatter more than inner: power amplifier compression. Back off the input power or improve PA linearity.
• Constellation tilted in a regular pattern across symbols: residual symbol clock error. Improve clock recovery.

A practiced engineer reads constellation diagnoses the way a doctor reads an x-ray. The pattern is the diagnosis.

MER vs EVM

Modulation error ratio (MER) is the inverse-power version of EVM:

MER is preferred in cable and broadcast contexts. EVM is preferred in cellular and Wi-Fi. They carry the same information.

6.4 Symbol Clock Recovery and Carrier Tracking

Two synchronization problems sit between the FFT and the constellation: figuring out when each symbol begins and ends (symbol clock recovery), and figuring out exactly what the carrier frequency is at any moment (carrier tracking).

Symbol clock recovery. The transmitter emits symbols at a known nominal rate. The receiver does not know exactly when each symbol starts. Estimating that timing is symbol clock recovery. Common algorithms include early-late gate, Mueller-Muller (a digital algorithm that uses successive symbol differences to estimate timing error), and Gardner (better at low SNR). In an RTSA, symbol clock recovery is automatic for most standards.

Carrier frequency offset. The receiver and transmitter reference oscillators differ by a small amount, typically tens to hundreds of parts per million. At 3.5 GHz, a 1 ppm error is 3.5 kHz of carrier offset. That offset rotates the constellation continuously and must be removed before symbol decisions can be made. Tracking algorithms include the Costas loop (for PSK), decision-directed phase tracking (for QAM), and pilot-based tracking (for OFDM, where pilot subcarriers carry known data).

Phase noise. Even if the carrier is perfectly locked on average, instantaneous phase wanders due to oscillator phase noise. High-quality reference oscillators (OCXOs, atomic) reduce this; cheap crystals make it worse. The Aaronia SPECTRAN V6 PLUS uses precision reference oscillators with optional external 10 MHz reference input, allowing users to lock to a rubidium or GPSDO source for ultra-low phase noise measurements.

6.5 Modern Wireless Standards: A Walkthrough

What does each major standard look like through an RTSA's eyes?

Wi-Fi 6 / 6E / 7

Wi-Fi 6 uses OFDMA on top of OFDM, with up to 1024-QAM on individual subcarriers. Wi-Fi 6E extends to 6 GHz. Wi-Fi 7 doubles channel bandwidth to 320 MHz, pushes modulation to 4096-QAM, and adds multi-link operation (MLO) where one device uses multiple bands simultaneously.

For RTSA analysis: Wi-Fi 7 320 MHz channels need at least 320 MHz of RTBW to capture in one shot. The SPECTRAN V6 PLUS 2000XA-6 with 490 MHz RTBW handles this with margin. Constellation density at 4096-QAM means EVM tolerances around -37 dB are non-negotiable.

Bluetooth Low Energy (BLE)

BLE 5.x supports 1M PHY (1 megasymbol/second GFSK), 2M PHY (2 megasymbol/second GFSK), and Coded PHY (S=2 and S=8 forward error correction for range extension). LE Audio adds isochronous channels.

For RTSA analysis: BLE bursts are short (around 376 microseconds for advertising packets) and channel-hopping at up to 1600 hops/second. POI matters. Aaronia's 10 nanosecond POI captures every burst, every hop, with margin. Modulation classification works on a single advertising burst.

5G NR

OFDM with subcarrier spacings of 15, 30, 60, 120, or 240 kHz. Channel bandwidths up to 100 MHz in FR1 (sub-6 GHz) and up to 400 MHz in FR2 (mmWave). Modulation up to 256-QAM (downlink) and 64-QAM or higher (uplink).

For RTSA analysis: 5G NR EVM measurement requires precise OFDM symbol timing and pilot-based carrier tracking. Aaronia RTSA Suite PRO's 5G NR preset handles this end-to-end.

LoRa

Chirp spread spectrum (CSS) with spreading factors from 7 to 12. Each symbol is a frequency-modulated chirp lasting from milliseconds to seconds depending on SF. The chirp shape itself encodes the data.

For RTSA analysis: the waterfall display shows LoRa packets as diagonal stripes; the slope of the stripe indicates the spreading factor. Demodulation requires de-chirping (multiplication by the conjugate chirp) followed by FFT. Aaronia's RTSA Suite PRO has dedicated LoRa decoder blocks.

Zigbee / 802.15.4

DSSS with O-QPSK (offset QPSK) at 250 kbps, 16 channels in 2.4 GHz ISM. Used heavily in smart home, industrial sensor networks, and Thread/Matter ecosystems. Decoding a Zigbee frame from RTSA-captured I/Q is the kind of weekend project that fits in 200 lines of Python.

6.6 Worked Example: Measuring EVM on a QPSK Burst

A SPECTRAN V6 PLUS captures a QPSK signal at 1 megasymbol/second centered at 2.4 GHz. The capture file is a 100-millisecond SigMF recording.

In RTSA Suite PRO, the workflow looks like:

1. Open the capture file. The graph editor loads the SigMF data.
2. Add a Frequency Translation block to bring the band of interest to baseband.
3. Add a Decimator block to drop the rate to 4 megasamples per second.
4. Add a Root Raised Cosine matched filter block with rolloff 0.35.
5. Add a Symbol Clock Recovery block with Mueller-Muller algorithm.
6. Add a Carrier Tracking block with decision-directed Costas loop.
7. Add a QPSK Demodulator block.
8. Add an EVM Computer block, which displays the running EVM value and the constellation diagram.

The graph runs in real time. EVM converges within tens of symbols. The constellation diagram shows the four QPSK clusters, each with a tight scatter that indicates good signal quality.

Same analysis in Python:

import numpy as np
from scipy.signal import resample_poly, lfilter
from sigmf import sigmffile

# Load capture
handle = sigmffile.fromfile('qpsk_capture.sigmf-meta')
fs = handle.get_global_field('core:sample_rate')
iq = handle.read_samples()

# Decimate to 4x symbol rate (1 Msps symbol -> 4 Msps complex)
decim = int(fs / 4e6)
iq_dec = resample_poly(iq, 1, decim)

# Matched filter (root raised cosine, beta=0.35, span=8 symbols)
def rrc(beta, span_symbols, sps):
    N = span_symbols * sps
    t = np.arange(-N//2, N//2 + 1) / sps
    h = np.zeros_like(t)
    for i, ti in enumerate(t):
        if ti == 0:
            h[i] = 1 - beta + 4*beta/np.pi
        elif abs(ti) == 1/(4*beta):
            h[i] = (beta/np.sqrt(2)) * (
                (1 + 2/np.pi)*np.sin(np.pi/(4*beta)) +
                (1 - 2/np.pi)*np.cos(np.pi/(4*beta)))
        else:
            num = np.sin(np.pi*ti*(1-beta)) + 4*beta*ti*np.cos(np.pi*ti*(1+beta))
            den = np.pi*ti*(1 - (4*beta*ti)**2)
            h[i] = num/den
    return h / np.sqrt(np.sum(h**2))

mf_taps = rrc(0.35, 8, 4)
iq_filtered = lfilter(mf_taps, 1, iq_dec)

# Symbol decision (4x oversampled, simple decimation for clean signals)
sps = 4
symbols = iq_filtered[::sps]

# Decision: nearest QPSK constellation point
qpsk_points = np.array([1+1j, 1-1j, -1+1j, -1-1j]) / np.sqrt(2)
decisions = qpsk_points[np.argmin(np.abs(symbols[:, None] - qpsk_points[None, :]), axis=1)]

# Normalize and compute EVM
symbols_n = symbols / np.sqrt(np.mean(np.abs(symbols)**2))
decisions_n = decisions / np.sqrt(np.mean(np.abs(decisions)**2))
error = symbols_n - decisions_n
evm_rms = np.sqrt(np.mean(np.abs(error)**2))
evm_db = 20 * np.log10(evm_rms)
evm_pct = evm_rms * 100

print(f"EVM: {evm_pct:.2f}% RMS, {evm_db:.1f} dB")

Run this on a clean SPECTRAN V6 PLUS capture and you get an EVM around 1 to 2 percent for a well-designed transmitter. Run it on a degraded signal and the number climbs into the 5 to 10 percent range.

The same logic extends to QAM constellations of any size. Replace qpsk_points with a 16-QAM, 256-QAM, or 1024-QAM grid, and the rest of the code is identical.

6.7 What Modulation Analysis Tells You About a System

Modulation analysis is not just a measurement. It is a diagnostic.

If a 5G NR base station shows EVM well within spec, the transmitter is healthy. If it's drifting toward the limit over hours, something is heating up: a power amplifier, a crystal oven, a reference. If it's degrading at one specific frequency, the IF or LO chain has a problem at that frequency. If outer constellation points scatter more than inner ones, the PA is compressing.

A field engineer with an RTSA can walk a cell site, measure EVM on the air, and diagnose problems before they show up as customer complaints. A factory test station can sweep EVM across temperature and supply voltage and reject parts that drift too much. A regulatory inspector can confirm that a transmitter meets emissions masks before granting type approval.

In every case, the measurement is the same: capture I/Q, run the demodulation chain, compute EVM, examine the constellation. Different signal, different standard, same diagnostic. That is what makes the RTSA the right instrument for this work. Streaming I/Q, deterministic POI, and a software framework that runs the demodulation chain end-to-end. Hardware sees the signal; software extracts the meaning.