Key Takeaway
HiCellTek provides real-time 5G NR monitoring directly from an Android smartphone: SSB-RSRP and SSB-SINR per beam, NR-ARFCN, PCI, and EN-DC/SA detection. The L3 decoder exposes RRCReconfiguration, MeasurementReport, and SCG configuration messages live in the field, giving deployment engineers full visibility into NR handover behavior without a dedicated test rig. Key modules: RF Monitor (5G NR), L3 Decoder, Drive Test, QMDL Export.
5G NR Rollout Validation with HiCellTek
Operators deploying 5G NR in Non-Standalone (NSA/EN-DC) or Standalone (SA) mode need to validate coverage, handover behavior, SSB beam quality, and EN-DC configuration in the field. This use case shows how HiCellTek delivers that visibility on a standard Android device.
The 5G rollout validation challenge
5G NR deployments introduce new validation requirements beyond LTE. In NSA mode, the UE maintains an LTE anchor (Master Cell Group, MCG) while adding an NR Secondary Cell Group (SCG) for data throughput, a process controlled by EN-DC RRCReconfiguration messages (3GPP TS 38.331). In SA mode, the UE registers directly on the 5G core (5GC) via NR. Validating a rollout means verifying SSB beam levels, confirming SCG addition/release thresholds, checking MeasurementReport contents, and ensuring correct band lock and NR-ARFCN assignment, all of which require real-time L3 visibility that legacy scanners or basic TEMS-style tools do not expose on Android.
SSB beam quality assessment
Each gNB transmits SSB (Synchronization Signal / PBCH Block) in up to 8 beams per half-frame (FR1). Validating coverage requires per-beam SSB-RSRP and SSB-SINR, not just a composite RSRP figure. Legacy tools rarely distinguish beam-level measurements.
EN-DC configuration visibility
EN-DC SCG addition is triggered by LTE MeasurementReport and confirmed via RRCReconfiguration (3GPP TS 38.331 §5.3.5). Without L3 decoding, engineers cannot see whether SCG addition is failing, which A3/A5 event fired, or what NR band was configured in the SCG.
Band lock and NR-ARFCN verification
Operators deploy NR on specific NR operating bands (3GPP TS 38.101-1/-2). During rollout, verifying that a UE camps on the correct NR-ARFCN and PCI, and is not inadvertently locking to a neighbor site, requires real-time NR cell information.
Fallback and handover tracking
NR-to-LTE fallback events (SCG release, RRC re-establishment) indicate coverage holes in the NR layer. Tracking these events with GPS context is essential for identifying gaps that need additional sites or parameter tuning.
The HiCellTek solution for 5G NR validation
HiCellTek combines 5G NR RF monitoring with live L3 decoding on a standard Android smartphone, giving deployment engineers the full picture, from SSB beam levels to RRCReconfiguration contents, without a dedicated test vehicle or laptop.
Real-time display of SSB-RSRP and SSB-SINR per beam index, NR-ARFCN, NR PCI, serving NR band, EN-DC status (SCG active/inactive), and SA registration state. Band lock and PCI lock configurable for targeted testing.
Live decoding of 5G NR RRC messages per 3GPP TS 38.331: RRCReconfiguration (SCG add/release, measConfig), MeasurementReport (A3/A5 events, SSB index), RRCSetup, RRCResume, and SCGFailureInformation. Timestamps and raw hex available for each message.
GPS-geolocated coverage campaign with NR layer heatmaps (SSB-RSRP, SSB-SINR) overlaid on a map. Handover events (EN-DC SCG add/release, NR-to-LTE fallback) marked on the GPS track for spatial analysis.
Raw diagnostic logs exported in QMDL format for post-processing in QXDM or third-party tools. Supports deep offline analysis of NR radio frames and L3 message sequences.
5G rollout validation workflow
Configure band / PCI lock
Set NR-ARFCN, NR band, and optionally PCI lock in HiCellTek to target the specific NR cell under test. Prevents the UE from camping on adjacent cells during validation.
Drive test with GPS
Perform a drive test around the site perimeter. HiCellTek records SSB-RSRP, SSB-SINR, EN-DC status, and SCG add/release events with GPS coordinates at each sample point.
Analyze handovers in L3
Review decoded RRCReconfiguration and MeasurementReport messages to verify SCG addition thresholds (A5 event offsets), NR band configuration, and absence of unexpected SCGFailureInformation.
Generate coverage report
Export NR coverage heatmaps (SSB-RSRP, SSB-SINR), handover event maps, and L3 message logs to Excel and PDF. QMDL files available for deeper offline analysis.
Key capabilities
Restrict UE to a specific NR operating band (3GPP TS 38.101-1/-2) for targeted site testing
Per-beam SSB-RSRP and SSB-SINR per 3GPP TS 38.215, with SSB index identification
Real-time EN-DC SCG state (add/release) and SA NR registration detection
LTE↔NR SCG events, intra-NR handovers, and NR RRC re-establishment with GPS context
Full 3GPP TS 38.331 RRC message decoding: SCG config, measConfig, reportConfig
Raw Qualcomm diagnostic log export for QXDM and third-party post-processing
Who is this for?
RF optimization teams
Engineers fine-tuning 5G NR coverage, SCG addition thresholds, and handover parameters during and after initial rollout.
Deployment engineers
Field teams verifying that newly commissioned 5G NR sites meet coverage and EN-DC performance specifications before acceptance.
Network planning
Planning engineers collecting field measurements to validate propagation model predictions and identify sites requiring parameter adjustments.
Related use cases
Validate your 5G rollout
Get real-time 5G NR RF monitoring and live L3 decoding. SSB beams, EN-DC events, RRCReconfiguration, directly from an Android smartphone.