IMEI update issue

[Evluma]

Hello and thank you for your help

I am working with the 9151 Rev3 and I attempted to update the IMEI with a valid one provided to us by Nordic

But the following error occurred

*** Booting nRF Connect SDK v2.9.0-7787b2649840 ***
*** Using Zephyr OS v3.7.99-1f8f3dc29142 ***
The AT host sample started
Ready
> at+cgsn
359404230716624
OK
> at+cgsn=1
+CGSN: "359404230716624"
OK
> AT%IMEIWRITE=0,"358757450008449"
%IMEIWRITE: 000000000000000
OK
> at+cgsn=1
+CGSN: "359404230716624"
OK

The command documentation states that if the IMEI is locked and cannot be updated, AT%IMEIWRITE, that the returned result will be the locked IMEI but in this case

it is returning "000000000000000" instead of "359404230716624"(factory default) or "358757450008449"(desired IMEI)

this same result was generated while using PTI 2.3.3 and PTI.2.3.6

thanks

[Vahram]

Hey there!

I'm not sure if you're still experiencing this issue, but on my nRF9151 board, I had the same behavior. It appears that the first time we wrote 0x0 as an IMEI address. Note that the 0x0 can come up because of doing something like 'atoi("non-imei-string")'.

With 'nrfutil 91 imei-read' command it returned following:

```
slot 0: <factory default>
slot 1: 000000000000000
```


The chip doesn't seem to have any safety mechanism to prevent this from happening, so I think that's what we have.
I hope there is a method to force the board to use its default IMEI so that it can still connect to LTE. Still, I haven't found anything like that yet.

Hope this helps somebody :)

Best,
Vahram

[dejans]

Hi,

Evluma Did you manage to resolve the issue? Can you provide an update?

Evluma said:

I am not sure why it is returning "000000000000000", while the documentation states it will return the stored IMEI regardless of success or failure of an IMEI update via %IMEIWRITE.

Did you get all zeros as output from imei-read? Can you show the result?

Vahram said:

The chip doesn't seem to have any safety mechanism to prevent this from happening, so I think that's what we have.
I hope there is a method to force the board to use its default IMEI so that it can still connect to LTE. Still, I haven't found anything like that yet.

Vahram Has your issue been resolved? Has your device been able to connect to LTE network? Can you provide an update on current status?

Best regards,
Dejan

[dejans]

Hi,

Here is an update on writing IMEI once and then trying to change it.

It is not possible to recover/change IMEI.

Once an IMEI is written to the device, it cannot be changed or recovered. This is a permanent, one-time operation mandated by GSMA regulatory standards to ensure device identity cannot be altered after deployment.

This is highlighted in the AT Command Reference Guide with the following caution:

AT%IMEIWRITE

"CAUTION: The command is a one-time operation. When the modem has been activated or the %IMEIWRITE command has been given once, the command cannot be used anymore. The device can become unusable if the wrong IMEI is written."

AT+CFUN

"The set command disables features that are used in the nRF91x1 SiP and device production, such as RF calibrations. It also prevents updates to the IMEI using the PTI firmware and the %IMEIWRITE command."

Due to this industry-wide requirement, there is no recovery mechanism available.

Best regards,
Dejan

[Vahram]

Hi Dejan,

I understand that the IMEI cannot be rewritten, but will it try to use the <factory default IMEI> if the other one doesn't work? Or can we configure it to do so?

It does somehow store the default IMEI in it, so I believe there is a way to use it even though there is another IMEI programmed

Thanks

[dejans]

Hi,

Programming IMEI documentation specifies that "nRF9151 comes with a preprogrammed IMEI and allows for a one-time replacement of the factory IMEI."

Programming IMEI mentions "Each device must be programmed with a unique IMEI code. IMEI writing is one-time programmable and cannot be reversed after programming. The device can become unusable if the wrong IMEI is written."

Best regards,
Dejan