17 Cellular Architecture for IoT
Cellular IoT traffic flows from the device (UE) through a base station (eNodeB/gNB) into the core network (EPC or 5G Core), where dedicated components handle mobility, data routing, and authentication. For IoT, the key technology choice is between NB-IoT (stationary, deep coverage, 10+ year battery) and LTE-M (mobile, higher data rate, voice support), with 5G reserved for high-bandwidth or ultra-low-latency use cases.
17.1 Learning Objectives
By the end of this chapter, you will be able to:
- Trace IoT Traffic Flow: Diagram the path of IoT data from UE through eNodeB/gNB to the EPC core network and cloud services
- Evaluate Cellular IoT Technologies: Justify the selection of NB-IoT, LTE-M, or 5G for a given deployment based on mobility, coverage, data rate, and latency constraints
- Assess Mobility Requirements: Determine when seamless handover support is critical and calculate the impact of PSM vs eDRX on battery life and downlink reachability
- Differentiate Core Network Functions: Distinguish the roles of MME, S-GW, P-GW, and HSS and predict how each affects IoT device connectivity
17.2 Prerequisites
Required Chapters:
- Mobile Wireless Technologies Basics - Core concepts
- Cellular IoT Fundamentals - Cellular technologies
- Networking Fundamentals - Basic networking
Technical Background:
- Cellular generations (2G, 3G, 4G, 5G)
- Frequency spectrum concepts
- Handoff and roaming basics
Estimated Time: 30 minutes
What is cellular architecture? Cellular networks divide geographic areas into “cells” served by base stations. When your phone moves between cells, the network hands off the connection seamlessly.
Why does it matter for IoT? IoT devices using cellular connectivity (NB-IoT, LTE-M, 5G) rely on this architecture for coverage, but many IoT devices are stationary and don’t need full mobility support.
Key Terms:
- UE (User Equipment): Your IoT device
- eNodeB/gNB: The cell tower/base station
- EPC (Evolved Packet Core): The “brain” of the cellular network
- MME: Manages device connections and mobility
17.3 Cellular Network Architecture Overview
Understanding how mobile cellular networks route IoT traffic is essential for deployment planning.
17.3.1 LTE/4G Architecture for IoT
The LTE architecture consists of three main domains: the User Equipment (UE), the Radio Access Network (RAN), and the Evolved Packet Core (EPC). IoT devices connect through the radio interface to base stations (eNodeBs), which then connect to the core network for routing to the internet and cloud services.
17.3.2 Core Network Components
MME (Mobility Management Entity): The MME is the control plane component that handles device attachment, authentication, and mobility. For IoT devices, the MME manages:
- Device registration and deregistration
- Security procedures (authentication, encryption)
- Paging for incoming data when device is in sleep mode
- Handover control between cells (for mobile devices)
S-GW (Serving Gateway): The S-GW is the user plane anchor that routes data packets between the device and the internet. It:
- Buffers data during handover
- Collects charging information
- Routes packets to the correct P-GW
P-GW (PDN Gateway): The P-GW connects the cellular network to external IP networks (the internet). It:
- Assigns IP addresses to devices
- Performs policy enforcement
- Handles QoS for different traffic types
HSS (Home Subscriber Server): The HSS stores subscriber information including:
- Device identity (IMSI)
- Service subscriptions
- Authentication credentials (for SIM-based authentication)
17.3.3 IoT-Specific Optimizations
Cellular IoT technologies (NB-IoT and LTE-M) include optimizations for low-power, infrequent transmissions:
Power Saving Mode (PSM): Devices can enter deep sleep for extended periods (hours to days) while maintaining network registration. The network doesn’t page the device during PSM, dramatically reducing power consumption.
Extended Discontinuous Reception (eDRX): Devices negotiate longer sleep cycles between paging opportunities. Instead of waking every few seconds, devices can sleep for minutes, saving battery while remaining reachable.
NB-IoT sensor battery life with PSM vs eDRX. Device: 100-byte transmission every 6 hours, 2200 mAh battery.
PSM (deep sleep): TX 220 mA × 5s = 0.31 mAh, sleep 0.005 mA × 21,595s = 0.03 mAh. Daily: \(4 \times 0.34 = 1.36\) mAh. Battery life: \(2200/1.36 = 1618\) days = 4.4 years.
eDRX (10.24s cycle): TX 0.31 mAh, paging window 50 mA × 0.64s every 10.24s = \((50 \times 0.64/3600) \times (21,595/10.24) = 18.8\) mAh. Daily: \(4 \times 19.1 = 76.4\) mAh. Battery life: \(2200/76.4 = 28.8\) days. PSM provides 56× longer life but delays downlink delivery until device wakes.
Control Plane CIoT EPS Optimization: Small data payloads (up to ~1500 bytes) can be sent through the control plane (signaling channel) without establishing a full data bearer. This reduces latency and power for small, infrequent transmissions.
17.4 Cellular IoT Technology Selection
Choosing the right cellular IoT technology depends on mobility, coverage, data rate, and latency requirements.
17.4.1 NB-IoT (Narrowband IoT)
Best For: Stationary sensors with small, infrequent payloads requiring deep indoor penetration.
| Characteristic | Value |
|---|---|
| Data Rate | Up to 250 kbps (typical: 20-60 kbps) |
| Latency | 1.5-10 seconds (depending on PSM/eDRX) |
| Coverage | +20 dB link budget gain (basement, underground) |
| Battery Life | 10+ years on AA batteries (with PSM) |
| Mobility | Stationary or very low mobility |
| Voice | Not supported |
Use Cases:
- Smart meters (electricity, gas, water)
- Underground parking sensors
- Basement environmental monitors
- Agricultural soil sensors
17.4.2 LTE-M (Cat-M1)
Best For: Mobile devices requiring higher data rates, voice support, and full handover.
| Characteristic | Value |
|---|---|
| Data Rate | Up to 1 Mbps |
| Latency | 10-15 ms (connected mode) |
| Coverage | +15 dB link budget gain |
| Battery Life | 5-10 years (with PSM/eDRX) |
| Mobility | Full handover support |
| Voice | VoLTE supported |
Use Cases:
- Asset tracking (vehicles, containers)
- Wearables with emergency calling
- Point-of-sale terminals
- Connected health devices
17.4.3 5G IoT Profiles
5G introduces multiple service categories with different IoT applicability:
eMBB (Enhanced Mobile Broadband): High bandwidth for video streaming, AR/VR. Typically not battery-constrained.
URLLC (Ultra-Reliable Low-Latency Communication): Sub-10ms latency for industrial control, V2X, robotics. Requires power for continuous connectivity.
mMTC (Massive Machine-Type Communication): Evolved from NB-IoT/LTE-M concepts. High device density, low power.
17.5 Mobile Technology Evolution
Understanding the evolution of cellular technology helps contextualize IoT options.
| Generation | Technology | Data Rate | IoT Relevance |
|---|---|---|---|
| 2G | GSM, GPRS | tens of kbps (GPRS) | Legacy M2M (sunsetting) |
| 3G | UMTS, HSPA | Mbps peak (HSPA) | Early IoT (sunsetting) |
| 4G | LTE, LTE-A | 10s-100s Mbps peak | Current IoT (LTE-M/NB-IoT) |
| 5G | NR | 100s Mbps-Gbps peak | Emerging IoT (profile-dependent) |
2G and 3G networks are being decommissioned globally. New IoT deployments should use:
- NB-IoT for stationary, low-data applications
- LTE-M for mobile applications or higher data rates
- 5G only if specific features (URLLC, slicing) are required
Check carrier timelines in your deployment region before selecting technology.
17.6 Cellular vs. LPWAN Comparison
When planning IoT deployments, compare cellular options with unlicensed LPWAN alternatives.
| Factor | Cellular (NB-IoT/LTE-M) | LoRaWAN/Sigfox |
|---|---|---|
| Spectrum | Licensed (operator-managed) | Unlicensed ISM bands |
| Coverage | Carrier-dependent | Self-deployed gateways |
| QoS | Managed, with SLAs possible | Best-effort, shared spectrum |
| Recurring Cost | Per-device subscription | Gateway infrastructure |
| Battery Life | 5-10+ years | 5-10+ years |
| Mobility | Full handover (LTE-M) | Limited |
| Data Rate | Higher (250 kbps - 1 Mbps) | Lower (0.3-50 kbps) |
Sammy Sensor: “Think of cellular networks like a pizza delivery system!”
Lila the Light Sensor: “The cell tower is like the pizza shop - it covers a neighborhood. When you order (send data), they deliver to your house (the cloud)!”
Max the Motion Detector: “And if you’re driving while ordering, the system transfers your order to the next pizza shop along your route - that’s handover!”
Bella the Button: “NB-IoT devices are like ordering just garlic bread - small order, but they’ll deliver to your basement! LTE-M is like ordering a whole feast - bigger delivery, and they’ll follow your car!”
17.7 Knowledge Check: Cellular Architecture for IoT
Scenario: A logistics company needs to track 5,000 cargo containers across Europe. Each container reports GPS location, temperature, and shock events. You must choose between NB-IoT and LTE-M for the cellular connectivity.
Requirements Analysis:
| Requirement | Value | Priority |
|---|---|---|
| Location updates | Every 30 minutes during transit | High |
| Event alerts | Immediate (shock/temperature alarm) | Critical |
| Typical speed | 0-80 km/h (truck/train/ship) | Medium |
| Coverage | Indoor warehouses, basements, metal containers | High |
| Battery life | 7 years on 19,000 mAh lithium battery | High |
| Latency | < 10 seconds for alerts | High |
| Roaming | 28 EU countries | Critical |
Technology Comparison:
Option 1: NB-IoT
Advantages:
Deep indoor penetration: +20 dB link budget gain
- Can report from inside metal containers
- Works in basement warehouses
- Better for stationary or slow-moving assets
Power consumption (example cycle):
Registration: 5 seconds at 200 mA = 1000 mA-ms = 0.28 mAh
TX (every 30 min): 2 seconds at 220 mA = 0.12 mAh
PSM sleep (between TX): 30 min at 5 uA = 0.0025 mAh
Per day: 48 TX + sleep = 48 × 0.12 + 0.06 = 6.36 mAh/day
Battery life: 19,000 / 6.36 = 2,987 days = 8.2 years ✓
Deployment cost:
Module: $8 per unit × 5,000 = $40,000
SIM + activation: $5 per unit × 5,000 = $25,000
Monthly subscription: $1/month × 5,000 × 12 × 7 years = $420,000
Total 7-year TCO: $485,000Disadvantages:
Mobility support: Poor
- Stationary/low-mobility only
- Cell reselection during movement takes 20-30 seconds
- Connection drops at >50 km/h speed
- No seamless handover
Latency: High
- Registration: 5-10 seconds
- Data transmission: 2-5 seconds
- Total alert latency: 10-15 seconds
Roaming: Limited
- Not all carriers support NB-IoT roaming
- Must verify coverage in each countryOption 2: LTE-M
Advantages:
Mobility support: Full handover
- Seamless connection at speeds up to 120 km/h
- Proper handover between cells (like phones)
- No connection drops during movement
- Critical for truck/train transport
Latency: Low
- Connected mode: 50-100 ms
- RRC idle → connected: 100-200 ms
- Total alert latency: 1-2 seconds ✓
Roaming: Excellent
- Full LTE roaming agreements in place
- Works across all 28 EU countries
- Automatic carrier selection
Voice: VoLTE supported (not needed here, but available)Power consumption (example cycle):
Registration: 3 seconds at 250 mA = 0.21 mAh
TX (every 30 min): 1 second at 280 mA = 0.078 mAh
RX window: 200 ms at 50 mA = 0.003 mAh
eDRX sleep: 30 min at 15 uA = 0.0075 mAh
Per day: 48 cycles = 48 × 0.088 + sleep = 4.58 mAh/day
Battery life: 19,000 / 4.58 = 4,148 days = 11.4 years ✓Disadvantages:
Coverage: +15 dB link budget (vs +20 dB for NB-IoT)
- Slightly worse deep-indoor penetration
- May struggle in metal containers in basement warehouses
Cost:
Module: $12 per unit × 5,000 = $60,000
SIM + activation: $5 per unit × 5,000 = $25,000
Monthly subscription: $1.50/month × 5,000 × 12 × 7 years = $630,000
Total 7-year TCO: $715,000 (47% more expensive)Step 1: Eliminate Based on Hard Requirements
Critical requirement: Mobility at 80 km/h
- NB-IoT fails: Connection drops > 50 km/h
- LTE-M passes: Supports up to 120 km/h
Critical requirement: Roaming across 28 EU countries
- NB-IoT: Risky (limited roaming agreements, must verify per country)
- LTE-M: Reliable (full LTE roaming infrastructure)
Initial conclusion: LTE-M is required
Step 2: Validate Against Trade-offs
Trade-off 1: Coverage (+20 dB vs +15 dB)
Test scenario: Container in basement warehouse
Signal strength at basement: -125 dBm (measured)
NB-IoT threshold: -130 dBm (MCL)
Margin: -125 - (-130) = +5 dB ✓ Works
LTE-M threshold: -125 dBm (MCL)
Margin: -125 - (-125) = 0 dB (borderline)
Concern: LTE-M may struggle in deepest basementsSolution: Use LTE-M with external antenna - Patch antenna on container exterior: +3 dBi gain - Effective RSRP: -125 + 3 = -122 dBm - New margin: -122 - (-125) = +3 dB ✓ Acceptable
Trade-off 2: Cost (+47% for LTE-M)
Cost difference: $715k (LTE-M) - $485k (NB-IoT) = $230k over 7 years
Cost per unit per year: $230k / 5,000 / 7 = $6.57/unit/year
Value analysis:
Lost container due to tracking failure: ~$50,000 (cargo value + penalties)
Expected failures with NB-IoT: 5-10% due to mobility gaps = 250-500 units
Expected losses: 250 × $50k = $12.5 million
LTE-M prevents these losses: ROI = $12.5M / $230k = 54x return
Decision: LTE-M justifies 47% higher cost through avoided lossesTrade-off 3: Latency (10-15s vs 1-2s)
Shock event scenario:
Container experiences 10G shock (forklift drop)
Sensor triggers immediate alert
With NB-IoT:
Time to alert: 10-15 seconds
Warehouse management notified, but container already moved to truck
Damaged goods discovered at destination → costly return
With LTE-M:
Time to alert: 1-2 seconds
Warehouse immediately inspects container
Damaged goods caught before shipping → claim prevented
Avoided cost per incident: $5,000 (inspection + return shipping)
Incidents per year: 50 (1% of fleet)
Savings: $5,000 × 50 = $250,000/year (covers LTE-M premium!)Final Decision: LTE-M
Rationale:
- Mobility is non-negotiable - containers move at truck/train speeds (50-80 km/h)
- Roaming is critical - 28 EU countries with varying carrier coverage
- Latency matters - 1-2s alerts prevent costly damage claims vs 10-15s NB-IoT
- Coverage gap is solvable - external antennas add +3 dBi for basement scenarios
- Cost premium (47%) is justified - ROI of 54x through avoided cargo losses
Implementation:
- LTE-M Cat-M1 modules with external patch antennas
- eDRX enabled (10.24s cycle) for battery optimization
- PSM enabled (TAU = 24 hours) for long stationary periods
- EU-wide roaming SIMs with fallback operators in each country
Monitoring plan:
- Track handover success rate (target: > 99.5%)
- Monitor basement coverage (RSRP > -125 dBm in 95% of locations)
- Validate battery life after 6 months (should exceed 7 years projected)
Key Lesson: Technology selection requires analyzing all requirements, not just obvious ones like data rate or cost. In this case, mobility and latency requirements drove the decision despite higher cost, and the business case (avoided losses) justified the premium.
Common Pitfalls
In LTE (4G), there is no separate base station controller — eNodeBs communicate directly via X2 interface and connect to EPC. In 5G, gNodeBs connect to the 5G Core (5GC). The eliminated hierarchy makes LTE/5G flatter but requires eNodeBs to coordinate handovers directly.
IMSI (International Mobile Subscriber Identity) identifies the SIM globally and is used for network signaling. MSISDN is the phone number for voice and SMS. IoT SIMs may have an IMSI but no MSISDN. Cellular IoT platforms use IMSI for device management, not phone numbers.
Cellular IoT devices typically receive private IP addresses via carrier NAT. Direct inbound connections from cloud to device are blocked. Use MQTT or HTTPS (outbound connections) for device-to-cloud communication. If direct inbound connections are needed, use SIM cards with APN static IP or VPN tunnels.
5G NR coverage currently extends primarily in urban areas. Rural IoT deployments may have LTE but no 5G. Cellular IoT modules must support LTE-M or NB-IoT fallback modes. Never design for 5G-only operation without verifying coverage in all deployment locations.
17.8 Summary
This chapter covered the fundamental architecture of cellular networks for IoT:
Key Concepts:
- Cellular architecture includes UE (devices), RAN (base stations), and EPC (core network)
- The MME handles mobility and control, while S-GW and P-GW route data
- IoT-specific optimizations (PSM, eDRX) enable multi-year battery life
Technology Selection:
- NB-IoT: Deep indoor, stationary, low data rate, 10+ year battery
- LTE-M: Mobile, higher data rate, voice support, full handover
- 5G: High bandwidth (eMBB) or ultra-low latency (URLLC)
Design Considerations:
- Licensed spectrum provides managed QoS but requires subscriptions
- Check carrier coverage and network sunset timelines
- Match technology to mobility, data rate, and coverage requirements
17.9 What’s Next
| Topic | Chapter | Why It Matters |
|---|---|---|
| Scenario-Based Understanding | Scenario-Based Understanding | Apply NB-IoT vs LTE-M trade-off reasoning to realistic deployment scenarios with cost and coverage constraints |
| Comprehensive Quiz | Comprehensive Quiz | Test your recall of EPC components, PSM/eDRX trade-offs, and technology selection criteria |
| Cellular IoT Fundamentals | Cellular IoT Fundamentals | Deep dive into NB-IoT and LTE-M radio design, repetition schemes, and carrier deployment modes |
| LPWAN Comparison | LPWAN Comparison | Compare cellular IoT against LoRaWAN and Sigfox on spectrum, cost, QoS, and deployment models |
| Mobile Wireless Labs | Mobile Wireless Labs | Hands-on exercises with cellular module configuration, AT commands, and coverage mapping |