Cellular IoT: NB-IoT & LTE-M

Quick Cap

NB-IoT (Narrowband IoT) and LTE-M (LTE Cat-M1) are cellular LPWAN technologies designed specifically for IoT — they strip down the LTE standard to reduce power, cost, and complexity while leveraging existing carrier infrastructure for nationwide coverage. Unlike LoRaWAN or Sigfox, cellular IoT uses licensed spectrum (no duty cycle limits, guaranteed QoS) and requires no private gateway infrastructure — the carrier provides the network. The trade-off is recurring subscription costs and dependency on carrier coverage.

Interviewers test whether you understand the NB-IoT vs LTE-M trade-off, can explain PSM and eDRX for battery optimization, know how AT commands control a cellular modem, and can make the right technology choice (cellular vs LoRaWAN vs WiFi) for a given deployment scenario.

Key Facts:

• NB-IoT: 200 kHz bandwidth, deep indoor penetration (164 dB MCL), no mobility handover, ultra-low power — best for stationary sensors and meters
• LTE-M: 1.4 MHz bandwidth, supports mobility handover and VoLTE, higher data rate (~1 Mbps) — best for mobile assets and voice-capable devices
• PSM: Device is unreachable but stays registered on the network — current drops to microamps, battery life exceeds 10 years
• eDRX: Device wakes periodically (seconds to minutes) to check for paging — balances reachability with power savings
• AT commands: The standard interface between your MCU and the cellular modem (UART-based) — AT+COPS, AT+CGATT, AT+CGDCONT, etc.
• No private infrastructure: Carrier manages the network — you deploy devices, not gateways

Deep Dive

At a Glance

NB-IoT vs LTE-M: The Core Comparison

This is the most fundamental question in cellular IoT. Both are 3GPP LPWAN standards but target different use cases.

When to choose NB-IoT: The device is stationary (water meter, parking sensor, soil probe), rarely sends data (hourly or daily), needs exceptional indoor/underground penetration, and does not need low latency or mobility support. NB-IoT excels in "deploy and forget" scenarios where the device sits in one location for 10+ years.

When to choose LTE-M: The device moves (fleet tracker, wearable, pet tracker), needs moderate data rates (firmware OTA, richer telemetry), requires low latency (alarm systems), or must support voice (personal emergency response). LTE-M is also the better choice when roaming is needed — it has broader global carrier support than NB-IoT.

PSM and eDRX: Battery Life Mechanisms

Cellular IoT achieves multi-year battery life through two complementary power-saving features specified in 3GPP Release 12/13.

Power Saving Mode (PSM)

PSM allows the device to enter a deep sleep state while remaining registered on the network. The device does not monitor paging channels and is completely unreachable — but it retains its network registration, so when it wakes up, it can send data immediately without a full re-attach.

┌──────┐    ┌───┐                           ┌──────┐    ┌───┐
  │Active│    │PSM│                           │Active│    │PSM│
  │ T3324│───▶│   │  (device unreachable)  ──▶│ T3324│───▶│   │ ...
  │      │    │   │                           │      │    │   │
  └──────┘    └───┘                           └──────┘    └───┘
  |← T3324 →|←──────── T3412 extended ───────▶|
    Active     PSM (hours to days)              Active
    Timer                                       Timer

• T3412 (Extended): The Tracking Area Update (TAU) timer — how long the device stays in PSM before it must wake up and re-register. Can be set from minutes to days (max ~413 days).
• T3324: The Active Timer — how long the device stays reachable after sending data before entering PSM. Typically a few seconds to a minute.

During PSM, the modem draws only 3-5 uA (similar to the MCU in deep sleep). A device with a 2,400 mAh battery sending one 200-byte packet per day with 5 seconds of active time and the rest in PSM can last over 10 years.

Extended Discontinuous Reception (eDRX)

eDRX extends the standard LTE DRX cycle (1.28 seconds) to much longer intervals — up to 2,621 seconds (43.7 minutes) for NB-IoT or 2,621 seconds for LTE-M. The device wakes periodically to check if the network has paging messages (downlink data) and sleeps between checks.

PSM + eDRX combined: Many deployments use both. The device wakes up, sends data, stays in eDRX mode for a short window (allowing server responses), then enters PSM for hours. This provides a brief window of reachability after each uplink while maximizing sleep time.

AT Commands for Modem Control

The cellular modem is a separate processor that your MCU controls over a UART (or USB) interface using AT commands. The modem handles the entire cellular protocol stack — your MCU just sends text commands and parses text responses.

Essential AT command sequence for network attach and data:

AT                          → OK              (modem alive?)
AT+CPIN?                    → +CPIN: READY    (SIM inserted and unlocked?)
AT+CFUN=1                   → OK              (full functionality mode)
AT+COPS=0                   → OK              (automatic operator selection)
AT+CEREG?                   → +CEREG: 0,1     (registered, home network)
AT+CGDCONT=1,"IP","iot.apn" → OK              (define PDP context with APN)
AT+CGATT=1                  → OK              (attach to packet service)
AT+CGACT=1,1                → OK              (activate PDP context)
AT+CGPADDR=1                → +CGPADDR: 1,"10.20.30.40"  (IP assigned)

After this sequence, the modem has an IP address and can send/receive data. Most modern modules provide a socket-like AT interface:

AT+QIOPEN=1,0,"TCP","cloud.example.com",8883,0,1   → connect
AT+QISEND=0,5,"hello"                                → send 5 bytes
AT+QIRD=0,1024                                       → read up to 1024 bytes
AT+QICLOSE=0                                         → close socket

Key AT commands by category:

SIM and eSIM Provisioning

Every cellular IoT device needs a subscriber identity — traditionally a physical SIM card, increasingly an eSIM.

eSIM for IoT is a game-changer for scale deployments. With eUICC (embedded Universal Integrated Circuit Card), you can manufacture devices with a single SIM form factor and remotely provision the carrier profile after deployment. This enables:

• Multi-carrier: Switch between carriers for best coverage or pricing without touching the device
• Global deployment: Ship one SKU worldwide, provision local carrier OTA
• Lifecycle management: Deactivate, reactivate, or transfer devices between carriers remotely

Cellular Module Integration

Integrating a cellular module into an embedded design involves hardware, firmware, and connectivity considerations.

Major module vendors and popular models:

Hardware integration checklist:

• UART: Main control interface — typically 115200 baud, RX/TX/RTS/CTS for flow control
• Power supply: Peak current during transmission can reach 1-2 A — your regulator must handle this; add bulk capacitance (100-470 uF)
• Antenna: External or PCB trace antenna; matching network critical for RF performance; test with a network analyzer
• SIM holder or MFF2 pad: Consider vibration, moisture, and ESD protection
• GNSS: Many modules include an integrated GNSS receiver — requires a separate antenna
• Reset and power-on pins: Hardware reset line is essential for modem recovery

Data Plans and Cost Considerations

Cellular IoT has recurring costs that LoRaWAN (private network) and WiFi do not.

Cost optimization strategies:

• Minimize data volume: compress payloads, batch readings, send deltas instead of absolute values
• Use MQTT or CoAP over TCP/UDP instead of HTTP — HTTP headers alone can exceed the payload
• Negotiate volume pricing with MVNOs (Mobile Virtual Network Operators) like 1NCE, Hologram, or Soracom
• Use PSM aggressively to minimize network signaling overhead (which carriers sometimes charge for)

5G NR for IoT: RedCap

3GPP Release 17 introduced 5G NR RedCap (Reduced Capability) — a new category designed to bridge the gap between LTE-M and full 5G NR.

RedCap is not a replacement for NB-IoT or LTE-M — it targets devices that need more throughput than LTE-M (video, rich telemetry) but less than a smartphone. Expected mass deployment is 2026-2028 as carriers build out 5G SA (standalone) networks. For current embedded designs, NB-IoT and LTE-M remain the primary choices.

Cellular IoT vs LoRaWAN vs WiFi: Decision Matrix

Debugging Story: The Modem That Would Not Sleep

A battery-powered air quality sensor used a Quectel BG96 module with NB-IoT and PSM configured for a 6-hour cycle. Expected battery life was 5 years on a 6,000 mAh lithium-thionyl-chloride cell. Field testing showed batteries draining in 4 months.

Current measurement revealed that the modem never actually entered PSM. The AT command AT+CPSMS=1,... returned OK, but the network was not granting the requested T3412 timer value. The carrier's MME (Mobility Management Entity) was overriding the device's requested 6-hour TAU timer with a 10-minute timer — meaning the modem woke up 36 times more frequently than expected.

The root cause: the carrier's NB-IoT deployment was using a default MME configuration that did not support extended T3412 timers. The device firmware accepted whatever timer the network granted without checking or logging it.

The fix involved three steps: (1) query the granted PSM timer with AT+CPSMS? after attach and log the actual values; (2) work with the carrier to configure extended timers on their MME (this took weeks of escalation); (3) add firmware logic to detect when the granted timer is shorter than requested and alert the cloud platform. After the carrier updated their configuration, battery life projections returned to 5+ years.

Lesson: PSM timer values are negotiated, not guaranteed. The network can grant shorter timers than requested, and many carrier deployments have conservative defaults. Always verify the granted timer values after network registration and design your firmware to detect and report discrepancies.

What interviewers want to hear: You can articulate the NB-IoT vs LTE-M trade-off with specific criteria (bandwidth, mobility, penetration, latency). You understand PSM and eDRX at the timer level (T3412, T3324) and know that PSM timers are negotiated with the network. You have hands-on experience with AT commands and know the attach sequence. You understand SIM/eSIM provisioning considerations for scale deployments. You can compare cellular IoT with LoRaWAN and WiFi and recommend the right technology based on coverage, cost, data rate, and power requirements.

Interview Focus

Classic Interview Questions

Q1: "What are the key differences between NB-IoT and LTE-M, and when would you choose each?"

Model Answer Starter: "NB-IoT uses only 200 kHz bandwidth and has no mobility handover, but it achieves 164 dB maximum coupling loss — 8 dB better than LTE-M — making it ideal for deep indoor or underground installations like water meters and parking sensors. LTE-M uses 1.4 MHz bandwidth, supports handover between cells, and provides ~1 Mbps data rate — much better for mobile devices like asset trackers, wearables, and anything needing firmware OTA updates. LTE-M also supports VoLTE, which NB-IoT does not. I choose NB-IoT for static, low-data, deep-coverage scenarios and LTE-M for mobile or moderate-data scenarios."

Q2: "How does PSM achieve multi-year battery life in cellular IoT?"

Model Answer Starter: "PSM (Power Saving Mode) allows the device to enter deep sleep — drawing only 3-5 microamps — while maintaining its network registration. The device negotiates two timers with the network: T3412 (how long to stay in PSM before a periodic TAU update) and T3324 (how long to stay reachable after sending data before entering PSM). During PSM, the network cannot page the device, but when it wakes up, it can transmit immediately without a full re-attach. For a device sending one packet per day with 5 seconds of active time, PSM enables 10+ years on a 2,400 mAh battery."

Q3: "Walk me through the AT command sequence to attach a cellular IoT modem to the network."

Model Answer Starter: "First, AT to verify the modem is responsive, then AT+CPIN? to confirm the SIM is ready. AT+CFUN=1 sets full functionality mode. AT+COPS=0 triggers automatic operator selection. I poll AT+CEREG? until the response shows registered (0,1 for home or 0,5 for roaming). Then I define a PDP context with AT+CGDCONT=1,\"IP\",\"my.apn\", attach to the packet service with AT+CGATT=1, and activate the context with AT+CGACT=1,1. At this point, AT+CGPADDR=1 returns the assigned IP address, and the device can open TCP/UDP sockets."

Q4: "What is the difference between PSM and eDRX, and can you use both together?"

Model Answer Starter: "PSM makes the device completely unreachable to save maximum power — the modem current drops to single-digit microamps. eDRX extends the paging cycle so the device wakes periodically (seconds to minutes) to check for downlink messages — it saves less power than PSM but keeps the device partially reachable. You can use both together: after sending data, the device stays in eDRX mode for a configurable window (allowing server responses), then enters PSM for hours. This gives you a brief reachability window after each uplink while maximizing sleep time for the rest of the cycle."

Q5: "How would you choose between cellular IoT and LoRaWAN for a new IoT deployment?"

Model Answer Starter: "The key factors are infrastructure, coverage, cost, and data requirements. If I need nationwide coverage without deploying any infrastructure, cellular is the clear choice — the carrier manages the network. If I am deploying on private property (factory, farm, campus) and want to avoid recurring subscription costs, LoRaWAN is better — I deploy my own gateways and network server. For data rate, LoRaWAN maxes out at 11 kbps with 222-byte payloads, while LTE-M provides 1 Mbps — so anything needing OTA updates or richer telemetry points to cellular. For deep indoor penetration, NB-IoT is excellent. For cost at scale, the $0.50-3/month per device for cellular adds up — 10,000 devices at $1/month is $120,000/year versus zero for a private LoRaWAN network."

Trap Alerts

• Don't say: "NB-IoT and LTE-M are the same" — they target fundamentally different use cases. NB-IoT has no mobility; LTE-M supports full handover. Confusing them signals lack of domain knowledge.
• Don't forget: PSM timers are negotiated with the network, not guaranteed. The carrier's MME can grant shorter timers than requested, which directly impacts battery life projections. Always verify granted values.
• Don't ignore: The cost dimension — cellular IoT has recurring per-device monthly costs that LoRaWAN and WiFi do not, and this can dominate the total cost of ownership for large deployments.

Follow-up Questions

• "How would you handle firmware OTA updates over NB-IoT given its low data rate?"
• "What is the difference between in-band, guard-band, and standalone NB-IoT deployment modes?"
• "How does eSIM remote provisioning work, and what are the security implications?"
• "What current measurement techniques would you use to verify PSM sleep current on a cellular module?"

Practice

Real-World Tie-In

Smart Water Metering -- A utility deployed 50,000 NB-IoT water meters across a city using Quectel BG77 modules with MFF2 soldered SIMs. Each meter transmitted a 40-byte reading once per day using PSM with a 24-hour T3412 timer. Battery life exceeded 12 years on a lithium-thionyl-chloride cell. The critical design decision was choosing NB-IoT over LTE-M — the meters were installed underground in concrete pits, requiring NB-IoT's superior 164 dB coupling loss. LTE-M's 156 dB MCL would have left 15% of meters without coverage.

Fleet Asset Tracking -- A logistics company tracked 3,000 shipping containers using LTE-M with u-blox SARA-R5 modules and eSIM for multi-country roaming. Containers reported GPS position every 15 minutes during transport and entered PSM during storage. eSIM enabled seamless carrier switching across 12 countries without physical SIM swaps. The key trade-off was LTE-M over NB-IoT — containers move between cells during transport, requiring LTE-M's handover support. Monthly per-device cost was $1.20, negotiated as a volume deal with an MVNO.

Agricultural Soil Monitoring -- A farm deployed 200 soil sensors with cellular and LoRaWAN options evaluated side by side. The 800-acre farm had no cellular coverage in the western fields (carrier dead zone). LoRaWAN with 3 gateways covered the entire property at zero recurring cost. The eastern fields near a highway had LTE coverage, and a cellular pilot was tested — but at $1/device/month, 200 devices would cost $2,400/year versus $800 one-time for LoRaWAN gateways. The farm chose LoRaWAN for full coverage and lower TCO, using a single LTE-M gateway as the IP backhaul to the cloud.