Key Takeaway
HiCellTek extracts full UE capability information. CA combinations, EN-DC combos, 256QAM support, VoLTE readiness, with a single tap, directly from a connected Android device. IMEI/TAC lookup verifies device identity against the GSMA database. Per-band RF monitoring validates actual over-the-air performance for each supported band. Key modules: UE Capabilities, IMEI/TAC Lookup, RF Monitor, L3 Decoder.
Device Certification & Testing with HiCellTek
Device labs and OEMs need to verify that a device correctly advertises its RF capabilities, supports the required CA and EN-DC combinations, and performs within spec on each band before submitting for carrier certification. This use case shows how HiCellTek accelerates that process from a standard Android device.
The device certification challenge
Before a mobile device can be approved for use on an operator network, labs must verify that the device correctly reports its UE capabilities (3GPP TS 36.306 for LTE, TS 38.306 for NR), including supported CA band combinations, EN-DC combos, MIMO layers, 256QAM DL support, and VoLTE/IMS capability. The IMEI Type Allocation Code (TAC) must match the GSMA device registry. Finally, actual RF performance must be validated band by band to confirm real-world behavior matches the declared capability. Each of these steps traditionally requires separate tools and manual data collation.
UE capability parsing complexity
UE capability information elements are encoded in ASN.1 (per 3GPP TS 36.331 / TS 38.331) and transmitted in UECapabilityInformation RRC messages. Parsing hundreds of CA combination entries manually is error-prone and time-consuming.
IMEI / TAC verification
Confirming that the device IMEI matches the declared model and TAC, and that the TAC is registered in the GSMA IMEI database, requires an API lookup. Without this step, counterfeit or mis-branded devices may pass lab tests.
Per-band RF validation
A device may declare support for a band in its UE capabilities while underperforming in actual RF tests on that band. Verifying RSRP, SINR, CQI, and throughput band by band requires band lock capability and real-time RF KPI display.
VoLTE readiness verification
Carrier certification for VoLTE requires confirming that the device correctly registers on IMS, negotiates AMR-WB codec via SDP (3GPP TS 26.103), and establishes QCI 1 bearers, checks that require L3 protocol decoding.
The HiCellTek solution for device certification
HiCellTek consolidates UE capability extraction, IMEI/TAC verification, per-band RF testing, and L3 protocol decoding in a single Android app, removing the need for multiple disconnected tools across the certification workflow.
One-tap extraction and display of full UE capability information: LTE CA band combinations (3GPP TS 36.101 Annex A), EN-DC combos (TS 38.101-3), NR band support, MIMO layers, 256QAM DL/UL, VoLTE/IMS capability flags. Raw ASN.1 hex and decoded tree available for export.
Reads device IMEI from the modem. TAC (first 8 digits) queried against the GSMA IMEI database to return declared model name, brand, and device type. Confirms device identity matches the unit under test before proceeding with RF validation.
Band lock to any LTE EARFCN or NR-ARFCN to force the UE onto the target band. Real-time RSRP, RSRQ, SINR, CQI, MIMO rank, and modulation scheme display. Identifies bands where declared capability does not match actual RF performance.
Live decoding of UECapabilityInformation, RRCReconfiguration, NAS EPS bearer setup, IMS REGISTER, and SIP INVITE. Verifies that QCI 1 bearer is correctly configured for VoLTE and that AMR-WB codec is negotiated in SDP at call setup.
Device certification workflow
Extract UE capabilities
Trigger UECapabilityEnquiry via HiCellTek. Review decoded CA combinations, EN-DC combos, 256QAM support, and VoLTE capability flags. Export ASN.1 decoded report.
Verify IMEI / TAC
Read device IMEI from the modem. Run TAC lookup against the GSMA database to confirm declared model, brand, and device category match the unit under test.
Test RF per band
Lock to each supported LTE and NR band in sequence. Record RSRP, SINR, CQI, and DL throughput per band. Flag any band where measured performance falls outside expected range.
Generate certification report
Export UE capability summary, IMEI/TAC verification result, and per-band RF KPI table to PDF and Excel. Report provides a structured record for the carrier certification submission.
Key capabilities
Full LTE (TS 36.306) and NR (TS 38.306) UE capability decoding: CA combos, EN-DC combos, MIMO, 256QAM, IMS
IMEI read from modem + TAC lookup against GSMA database for model and brand confirmation
Band lock to any EARFCN / NR-ARFCN; real-time RSRP, SINR, CQI, and throughput per band
Verify declared CA band combinations (TS 36.101 Annex A) and EN-DC combos (TS 38.101-3) against operator requirements
L3 decoding confirms IMS registration, QCI 1 bearer setup, and AMR-WB SDP negotiation (TS 26.103)
UECapabilityInformation decoded tree and raw hex exportable for documentation and offline review
Who is this for?
Device labs
Independent test labs performing pre-certification UE capability verification, RF validation, and VoLTE readiness testing before carrier submission.
OEMs
Device manufacturers verifying that firmware correctly reports UE capabilities and that RF performance meets operator requirements across all supported bands.
Carrier certification teams
Operator teams running device approval programs who need to verify CA combo support, IMEI/TAC identity, and VoLTE compliance for each device model.
Related use cases
Start device testing
Extract UE capabilities, verify IMEI/TAC, and validate per-band RF performance โ all from a standard Android device. No dedicated test hardware required.