25 Small devices, small messages

25.1 Why forty bytes a day breaks everything so far

Everything until now was built for something like a phone: register, open a PDU session, set up a radio bearer, get QoS Flows, run a tunnel to the core, and wake up often to listen for paging.

Now put a water meter in a basement. One lithium cell has to last ten years, it sits behind two concrete walls, and it has forty bytes to say once a day. Building a user-plane connection for those bytes costs more energy than they are worth, and listening for paging all day costs more than either.

Clause §5.31 is the collected answer: carry data inside signalling instead of beside it, let the device sleep for hours, hold the packet while it sleeps, cap how often it may speak, and let the radio repeat itself until it gets through the concrete.

3GPP calls this Cellular IoT; earlier releases called it Machine Type Communication. Both CIoT optimisations work only over E-UTRA — the 4G radio attached to the 5G core. And a naming trap: in clause §5.31 the term AF means the server the sensor talks to §5.31.1.

25.2 First both sides say what they can do

At registration the UE (the device) sends its 5G Preferred Network Behaviour: whether it supports the Control Plane CIoT optimisation, the User Plane one, plain N3 data transfer — N3 is the tunnel between the radio network and the core — and header compression, plus which of the two it would rather use.

The AMF (the function that tracks where a device is and whether it is reachable) answers with 5G Supported Network Behaviour, per registered area rather than per network.

Three rules bind the lists together. Claiming the User Plane optimisation obliges both sides to claim N3 data transfer too.

And a device supporting NB-IoT — the narrowband radio for cheap, low-rate devices — always claims the Control Plane optimisation, while one supporting WB-E-UTRA, the ordinary wideband 4G radio, always claims N3 data transfer §5.31.2.

What the device asks for can change which AMF serves it §5.31.2, and steers it between the 4G and 5G cores: the network rejects its request with a cause telling it to use the other one §5.31.3 — see Living next to 4G.

25.3 Data inside a signalling message

NAS is the signalling that runs end to end between device and core, and protection comes from there: the UE and the AMF integrity-protect and cipher the payload as they would any NAS message.

For IP and Ethernet sessions the UE and the SMF (the function that runs sessions) may negotiate header compression §5.31.4.1.

The switch that makes this permanent for one session is the Control Plane Only Indicator, set by the AMF at session establishment and passed on to the device.

It is compulsory when N3 data transfer was never negotiated and for any session anchored in the NEF, the door through which outside software reaches the core.

For sessions anchored in a UPF (the box that forwards the packets) that can fall back to 4G, policy decides once and then binds all of them, and for the rest the AMF decides one session at a time §5.31.4.1.

Sessions without the indicator may change their minds later: either the SMF or the device can start N3 data transfer, typically once the volume has outgrown the trade §5.31.4.2. In CM-CONNECTED the two paths coexist, session by session §5.31.4.1.

For NB-IoT, the CP Relocation Indication procedure asks the AMF to authenticate a radio re-establishment at a new base station and rebuild the core connection, identifying the device by a Truncated 5G-S-TMSI §5.31.4.3.

25.4 Keeping the radio context instead of rebuilding it

The other optimisation goes the opposite way: keep the user plane, stop rebuilding it. User Plane CIoT 5GS Optimisation lets a device send user data from CM-IDLE without a Service Request.

It needs the feature negotiated over NAS, advertised in the device's radio capabilities, passed to the base station, and one session already active. The radio connection is then suspended, not released §5.31.18.

On suspend the device stores its radio context, the base station stores that plus the core association and the session context, and the AMF stores what it needs to resume.

The UPF keeps the uplink tunnel information and drops only the downlink half, so an uplink packet sent on resume goes straight through — unless the device woke under a base station that cannot reach that UPF, which forces a Path Switch first §5.31.18.

25.5 Sleeping for hours

Ordinary discontinuous reception (DRX), negotiated between device and AMF §5.4.5, already lets a device sleep between paging occasions, though it still wakes often.

Extended DRX stretches the cycle to minutes or hours — the ranges are negotiated over NAS and differ by radio §5.31.7.2.2:

Radio	Shortest	Longest
NR	2.56 s	10485.76 s (almost 3 hours)
WB-E-UTRA and LTE-M	5.12 s	2621.44 s (almost 44 minutes)
NB-IoT	20.48 s	10485.76 s (almost 3 hours)

The device asks in its Registration Request; the AMF may accept, refuse or grant a different length, and assigns a Paging Time Window — the stretch in which the device really listens §5.31.7.2.1.

At a cycle of 5.12 s or less for WB-E-UTRA, LTE-M and NB-IoT, or 10.24 s or less for NR, the network still pages the ordinary way §5.31.7.2.2.

Past ten seconds a second clock is needed, because the ordinary radio frame counter wraps every 10.24 s. A Hyper-SFN counter sits on top of it, and the device's paging moments follow from the cycle length and an identifier of the device, by a formula both ends know — so nothing is signalled.

It works only because base stations and AMFs synchronise that counter to a preconfigured epoch, with GPS time as the baseline §5.31.7.2.2.

Outside the window the AMF treats the device as unreachable, and sends a page triggered at the wrong moment just before the next occasion instead §5.31.7.2.2.

Where a registration area mixes radio types that do not all support extended DRX, at least one attempt must fall inside a window §5.31.7.2.3.

Sleep reaches into RRC_INACTIVE too: the base station buffers downlink packets for cycles up to 10.24 s, and for longer cycles may hand the job to the core §5.31.7.2.4.

Two exceptions are easy to miss: a device with an emergency session uses ordinary DRX, and extended DRX parameters are never carried between core nodes, so the device re-requests them every time §5.31.7.2.1.

MICO mode §5.4.1.3 — the sleep for devices that only start conversations themselves — gets three adjustments here:

• Active Time: the device stays pageable for a negotiated period after dropping to CM-IDLE, and only then disappears §5.31.7.4.

• Extended Connected Time: when the device wakes and the AMF knows something is waiting, the AMF holds the core connection and gives the radio a minimum time to keep the device connected regardless of inactivity §5.31.7.3.

• Periodic registration timer control: a long timer where no downlink traffic is expected, one aligned to the delivery where some is. With the Strictly Periodic Registration Timer Indication it keeps running through CM-CONNECTED, so re-registrations land at predictable moments §5.31.7.5.

25.6 Somebody has to hold the packet

If a device sleeps for three hours, a downlink packet waits somewhere. That is what high latency communication means here — not slow transfer, but the wait before the device wakes and answers the first packet.

Buffering happens in the UPF, the SMF or the NEF. For UPF-anchored sessions the SMF installs rules saying which of the two holds the data; NEF-anchored sessions can only buffer in the NEF.

The AMF hands the SMF an Estimated Maximum Wait Time, from which the SMF works out how long to buffer §5.31.8.

The server can also be told when to bother, through three notifications. UE Reachability comes once, so it can hold its data until the device wakes.

Availability after DDN failure repeats, each one triggered by a downlink packet the network deliberately discards as a probe, and Downlink Data Delivery Status says when data was buffered and when delivered.

Where MICO mode or extended DRX is on, an Idle Status Indication adds the moment the device went idle and the timers it runs §5.31.8. All of it reaches the server through the NEF — Computing close by, and opening the door and §5.20.

25.7 Non-IP data, and getting it to the application

A sensor reading is often not an IP packet and gains nothing from being wrapped in one. 5GS carries it in an Unstructured PDU session, with two ways out: the NIDD API on the NEF, or a point-to-point tunnel through the UPF on N6, the link from the core out to the data network §5.31.5.

The subscription decides, not the device: a "NEF Identity for NIDD" held against that DNN (the name of the data network) and slice makes the SMF pick that NEF and use the API.

The NEF can also fan a message out to a group, resolving an External Group Identifier through the UDM (the store of what a subscriber is allowed) into a list of subscriber identities §5.31.5.

Unstructured data carries no acknowledgements of its own, so the Reliable Data Service supplies them. A small header marks a packet as needing no acknowledgement, needing one, or being one, and lets the receiver drop duplicates; what is not acknowledged is retransmitted.

Port numbers identify the application at each end and may be reserved, released and queried §5.31.6.

25.8 Rationing the conversation

Three brakes, three owners.

Serving PLMN Rate Control protects the visited network — its AMF and its signalling radio bearers — from a crowd pushing data through signalling.

It is configured in the (V-)SMF as X NAS Data PDUs per deci hour, a deci hour being six minutes, with X never below 10. Uplink and downlink have separate limits, and the SMF may discard or delay what exceeds them §5.31.14.2.

Small Data Rate Control belongs to the home network and exists so an operator can sell a plan. It gives a number of packets per time unit, plus extra packets per time unit reserved for exception reports, and covers data on radio bearers and in NAS alike §5.31.14.3.

A bit-rate cap could not do this job: the clause notes that a rate high enough to be radio-efficient still adds up to a large daily volume §5.31.14.1.

The allowance is hard to escape by design: on release, the remaining count and the end of the period may be parked in the AMF and handed back at the next session, and a trip to the 4G core preserves it too.

For NB-IoT the AMF also counts each claim of the establishment cause "MO exception data", so it lands in the charging record §5.31.14.3.

Service Gap Control limits how often, not how much. A Service Gap Time in the subscription is enforced in both the device and the AMF, one timer per device across all its sessions.

It is started each time the device drops from CM-CONNECTED to CM-IDLE — but not when that connection answered a page for something arriving, and not after a mobility or periodic registration that carried neither a follow-on request nor uplink data status §5.31.16.

While it runs, the device may not ask for a connection to send user data, control-plane data or SMS, and may not establish a session except for emergency services.

The AMF rejects such requests, optionally with a back-off timer for the remainder, and keeps its own copy of the timer slightly shorter than the device's so it never rejects one that had just become legal.

The remaining gap survives a move to another PLMN; only a SIM swap clears it §5.31.16. Control-plane data has a NAS congestion back-off timer of its own §5.31.15 §5.19.7.6.

Clause §5.31 has no "attach without a session" step and needs none: a device registers to be authorised for services §5.3.2.1 and opens sessions later on its own request §5.6.1, so one that only raises alarms sits registered with none.

25.9 Coverage bought with repetition

A meter in a basement is reached by the radio repeating itself, which costs air time and battery for everybody, so Enhanced Coverage is rationed per subscriber.

The UDM holds Enhanced Coverage Restricted information per PLMN: for eMTC — the 4G radio mode for cheap machine devices, also sold as LTE-M — whether CE mode B is restricted, or both CE mode A and B, or neither; for NB-IoT a plain yes or no.

CE mode A and CE mode B are the two depths of repetition, B repeating far more than A. The AMF combines that setting with local configuration and the device's usage setting, and sends the result to the device in the Registration Accept and to the radio whenever a context is built §5.31.12.

One rule is absolute: a "voice centric" usage setting forces CE mode B restricted — the deepest coverage mode's delay is not compatible with a call. When CE mode B is allowed, the AMF and the SMF switch to extended NAS timers, since a repeated transmission takes far longer.

A roaming device with no usable subscription value falls back to the roaming agreement's default, and an application may query or flip the restriction through the NEF §5.31.12.

On release the base station also hands the AMF Paging Assistance Data, repeated in every later page for that device §5.31.13.

25.10 What NB-IoT gives up

NB-IoT keeps the QoS model of What the network promises but strips it to almost nothing: one QoS Flow per session carrying the default rule and no other, no reflective QoS, one radio bearer per flow, and at most two radio bearers — so at most two sessions can have an active user plane at once §5.31.19.

With no QoS profile to show, prioritising between devices needs another handle: the base station may fetch a subscribed NB-IoT UE Priority from the AMF using the device's 5G-S-TMSI, typically only once its load crosses a threshold §5.31.17.

Moving in and out of NB-IoT is planned, not accidental. Tracking areas never mix NB-IoT cells with other radio types, so a change of radio always triggers a registration update.

The subscription setting "PDU Session continuity at inter RAT mobility" then decides the sessions' fate — keep, drop and ask for it back, drop silently, or leave it to the visited network. On arrival any non-default QoS rule is removed §5.31.11.

LTE-M devices are flagged so charging can tell them apart §5.31.20.

25.11 What an operator has to configure

None of this happens by default: the functionality exists only where the networks are configured for it, and some of it needs a roaming agreement §5.31.1. The pieces:

• In the subscription: the NEF Identity for NIDD, the Invoke NEF indication, Enhanced Coverage Restricted information per PLMN, the Service Gap Time, the NB-IoT UE Priority, the extended DRX cycle length, and PDU Session continuity at inter RAT mobility.

• In the network functions: the Serving PLMN Rate Control value in the (V-)SMF, the Reliable Data Service per DNN and slice, AMF policy for the Control Plane Only Indicator, and the buffering rules the SMF installs.

• In the radio and the planning: tracking areas that never mix NB-IoT with other radio types, broadcast indicators for extended DRX, and a Hyper-SFN epoch agreed across base stations and AMFs.

• Towards the outside: the monitoring events an application may subscribe to through the NEF §5.31.9, and the high-latency parameters it provisions there §5.31.8.

Where this meets the rest: sessions are The connection to a data network, the tunnels it suspends are Where the packets actually go, and sleep and paging are Registration, reachability and paging.