Matthew A. Brenner, President, Singular IoT, VA, USA. Matt manufactures electronic equipment for vehicle tracking, a line of cellular modems, and specialized forensic equipment for RF surveying. He has developed specialized software and hardware tools, and custom communication protocols for investigating cellular connectivity anomalies, and has vast experience teaching computer science and software engineering at many levels. Matt is a member of the Scientific Working Group on Digital Evidence. He offers consulting services to help companies customize and maximize the performance of their cellular IoT devices.

Preface xix

Acknowledgement xxi

1 Introduction 1

1.1 Wireless Connectivity Alternatives 1

1.2 Goals 2

1.3 The Fundamental Problem 3

1.4 Audience 4

1.5 Recommended Reading 5

1.6 Can One Size Fit All? 6

1.7 Hardware History 6

1.8 On-the-move Connectivity Problems 7

1.9 Reference Implementations 8

1.10 Reference Microcontroller/OS Platform 9

1.11 Reference Cellular Communication Modules (CCMs) Family 11

1.12 A Few Words on Advice, Practices, and Efficiency 13

1.12.1 Best Practice or Good Practice 14

1.12.2 Efficiency Is a Large Umbrella 14

1.12.2.1 Spatial and Temporal Efficiency 14

1.12.2.2 Data Efficiency 15

1.12.2.3 Developmental Efficiency 17

1.13 3G, 4G, 5G, and 6G 17

2 Platforms, Tools, and Debugging 19

2.1 Importance of Toolchain Selection 19

2.2 An Expanded View of the Tool Chain 21

2.3 Computing/OS Platforms 21

2.4 Programming Language Choices 23

2.5 Running the Same Code on Development Computer and IoT Device 23

2.6 Running IoT Connectivity Code in a Debugger 24

3 Cellular Network Basics 27

3.1 Standards 27

3.2 What Do Cellular Networks Do? 28

3.3 Are Cellular Networks Wireless? 29

3.4 What Is a Cell? What Is a Sector? 30

3.5 Omnidirectional Cellular Coverage 33

3.6 Cell Towers 34

3.7 How Are Cellular Networks Identified? 37

3.8 How Are IoT Devices Identified? 39

3.9 eNodeB IDs and Cell # 40

3.10 Tracking Areas and Paging 40

3.11 Frequency and Modulation 42

3.11.1 Modulation 43

3.11.1.1 Radio Telegraphy 43

3.11.1.2 Amplitude Modulation (AM Radio) 44

3.11.1.3 Frequency Modulation (FM Radio) 45

3.11.1.4 Phase Modulation 47

3.12 Spectral Efficiency 48

3.13 Error Detection 49

3.13.1 Luhn Algorithm 50

3.14 Error Correction 52

3.15 LTE Modulation Techniques 54

3.15.1 Binary Phase Shift Keying (BPSK) 56

3.15.2 Quadrature Phase Shift Keying (QPSK) 57

3.15.3 Quadrature Amplitude Modulation (QAM) 57

3.16 Bandwidth and Latency 57

3.17 Range 58

3.18 Frequency Bands 59

3.18.1 Frequency Affects Range 60

3.19 Radio Access Technologies (RAT) and Categories 61

3.20 SIM Cards 63

3.21 What Happens When a Cellular Modem Switches On? 64

3.21.1 Network Selection, Cell Selection, Camping, and Cell Reselection 64

3.21.2 Network Registration 65

3.22 Handoff (Also Called Handover) 67

3.22.1 Maintaining Connectivity 67
3.22.2 Load Balancing 69

3.23 Multiple Access 70

3.24 Timing Advance 70

3.24.1 Why Is Timing Advance Useful? 73

3.24.2 How Accurate Are Distance Estimates Using Timing Advance? 73

3.24.3 Timing Advance Band Depth and Maximum Range 77

3.25 Expressing Power 77

4 SIM/USIM Card Basics 81

4.1 Mobile Virtual Network Operators (MVNOs) 81

4.2 Size 82

4.3 Native Versus Multi-SIMs or MNO Versus MVNO 84

4.4 Home Versus Roaming Access 85

4.5 SIM Factors Affecting Price and Coverage 86

4.5.1 How Much Do SIM Cards Cost? 88

4.5.2 Is There a Monthly Activation Fee? 88

4.5.3 Are There Fees for Activating and/or Deactivating SIM Cards? 88

4.5.4 How Much Does Data Cost? 88

4.5.5 Is the Monthly Data "Pooled"? 89

4.5.6 Are There Fees for Deactivated (but Not Terminated) SIMs Cards? 90

4.5.7 Is There a Not-yet-activated Fee? 90

4.6 Text Messages (SMS) 91

4.7 Usage Limits 91

4.8 Firewalls 92

4.9 Replacing SIMs and/or Network Providers 94

4.10 Access Point Name (APN) 96

5 Verify Cellular Connectivity 97

5.1 Preparation 98

5.1.1 Adequate Power 98

5.1.2 Activated SIM Card 100

5.1.3 Base Station in Range 100

5.1.4 SIM Card Authorization 100

5.1.5 Band Configuration 100

5.1.6 RAT Configuration 101

5.1.7 Automatic Registration 101

5.2 Try to Auto-register 101

5.3 What Can Go Wrong? 102

5.3.1 Operating System Interference 102

5.3.2 Communicating with Modem 103

5.3.3 Malformed AT Commands 103

5.3.4 Parsing Responses to AT Commands 103

5.3.5 Timing Problems 104

5.3.6 Unset or Incorrect Access Point Name (APN) 107

5.3.6.1 Pitfall: Failing to Explicitly Set the APN 107

5.4 Modem Configuration for Auto-registration 108

6 Let's Move Some Data 111

6.1 Low-level Sockets or High-level Protocols 112

6.2 Verify ServerServer Is Running 116

6.3 Verify EchoServer Is Running 117

6.4 USB or UART? 117

6.4.1 Pitfall: USB Device Names Are Not Fixed and Should Not Be Hard Coded 118

6.5 AT Commands-A Troubled Past 119

6.6 Unsolicited Response Codes (URCs) 120

6.7 A Handy Modem Program 123

6.8 AT Commands Manuals 130

6.9 Communicating with the Cellular Modem 131

6.10 Getting EchoServer Information from ServerServer 134

6.10.1 Before Step 1: Enable Unsolicited Response Codes (URCs) 135

6.10.2 Step 1: Configure PDP Context for HTTP GET 136

6.10.3 Step 2: Configure a PDP Context 136

6.10.3.1 Test Commands 137

6.10.3.2 Read Commands 137

6.10.3.3 Write Commands 137

6.10.4 Step 3: Activate the PDP Context 139

6.10.5 Step 4: Allow/Disallow Response Header for HTTP GET 140

6.10.6 Step 5: Set HTTP(S) URL 141

6.10.7 Step 6: Send HTTP(S) GET Request 141

6.10.8 Step 7: Read HTTP(S) Response 142

6.10.9 After Step 7: Deactivate the PDP Context 143

6.10.10 Using Modem to Interact with ServerServer 143

6.11 Bouncing Data Off EchoServer 145

6.11.1 Before Step 1: Enable Unsolicited Response Codes (URCs) 145

6.11.2 Step 4: Open a TCP Client Socket Connection 146

6.11.3 Step 5: Send Mixed-case Text to EchoServer 146

6.11.4 Step 6: Read (Uppercase) Response from EchoServer 148

6.11.5 Step 7: Close TCP Client Socket Connection 151

6.11.6 Step 8: Deactivate PDP Context 151

6.12 No Problems Is Bad Luck 151

7 Cellular Connectivity Regions 153

7.1 How Geography, Topology, and Population Density Affect Connectivity 154

7.1.1 Geography and Topology 154

7.1.2 Population Density 154

7.2 Region Categories 156

7.2.1 Rural 156

7.2.2 Rural Town 156

7.2.3 Flat Farmland/Flat Arid 156

7.2.4 Mountainous 157

7.2.5 Suburban 157

7.2.6 Dense City 157

7.2.7 Interstate Highway 157

7.2.8 Uninhabited 158

8 Cellular Communication Modules (CCMs) 159

8.1 CCM Worldwide Market Share 162

8.2 Frequency Band Usage 162

8.3 Protocol Implementation 164

8.4 Similarities and Differences Across CCMs 165

8.4.1 Single or Dual AT Command Channels 165

8.4.2 Different AT Command Sets 166

8.4.3 Different Response Times for Similar or Identical Commands 167

8.4.4 Differing Response Formats 167

8.4.5 Differing Responses for Compound Statements 167

8.4.6 Different Timing Requirements 168

8.4.7 AT Commands Are Not Thread-safe 168

8.4.8 Support for Different Protocols 168

8.5 Consider the Whole CCM Family 169

8.6 CCM Firmware Bugs 169

8.7 CCMs Are a Lot Like Sensors: Imprecise and Not Entirely Reliable 170

9 AT Commands (A New Approach) 171

9.1 Purpose of AT Commands 171

9.2 Problems of AT Commands 173

9.2.1 Maximum Response Time for an AT Command 174

9.3 Traditional Solution to Executing AT Commands and Extracting Responses 175

9.4 Command Independent Processing (CIP) 179

9.4.1 The Central Observation Underlying CIP 180

9.4.2 Fundamental Elements of CIP 181

9.4.2.1 AtParams 181

9.4.2.2 AtCommand 181

9.4.3 AT Commands in CIP 182

9.4.3.1 Step 1: Define a Name for a Command 183

9.4.3.2 Step 2: Create a Set of Parameters for Each Command 183

9.4.3.3 Step 3: Store the Command Name and AtParams Object in a Map 184

9.4.3.4 Step 4: Create a Command Object 185

9.4.3.5 Step 5: Pass Arguments to the Command Object (if Necessary) 185

9.4.3.6 Step 6: Perform the Command 185

9.4.3.7 Step 7: Verify Success or Failure 186

9.4.3.8 Step 8: Extract Response Information 187

9.4.3.9 AT Commands with Parameters 192

9.4.3.10 Timing Out 194

9.4.4 Using CIP Across CCM Families and Across Manufacturers 196

10 CIP Design and Details 197

10.1 Pseudocode Conventions 198

10.1.1 Identifier Names 198

10.1.2 Angle Brackets 198

10.1.3 Constructors 199

10.1.4 Dot Operator 199

10.1.5 Unified Modeling Language (UML) 199

10.2 A Note on Objected-orientation and Threads 199

10.3 AT Command Basics 200

10.3.1 Echoing 200

10.3.2 Enable/Disable Response Codes 201

10.3.3 Short or Long Response Codes 201

10.3.4 Line Terminators 201

10.3.5 Housekeeping 201

10.4 Categories of Responses to AT Commands 202

10.4.1 Ok_only 203

10.4.2 Text_ok 203

10.4.3 After_colon 203

10.4.4 Ok_plus_after_colon 204

10.4.5 MULTI_RECEIVE, MULTI_SEND, and Multi_after_colon 205

10.5 Details of Command Independent Processing (CIP) 205

10.5.1 AtStep Purpose 205

10.5.2 AtStep Attributes 207

10.6 A "Factory Method" for Creating AtCommand Objects 208

10.7 Performing AT Commands 210

10.7.1 Why AT Commands Fail 212

10.7.2 Timing Out 212

10.7.3 Details of the Execute Method 217

10.7.4 Response Length 219

10.7.5 Hardware...