Your Device Outlives Its Network

On February 22 AT&T switched off its 3G network. Five weeks later T-Mobile finished retiring the CDMA network it had inherited from Sprint. Sprint's LTE network went on June 30, and T-Mobile's own UMTS network went the following day, three weeks ago. Verizon has set December 31 for its own 3G retirement, which has not happened yet and is the one still ahead of us.

The alarm industry saw it coming and could not move fast enough. Its trade committee asked the FCC to postpone the AT&T date, putting the exposed base at around six million radios and later revising that to roughly two million as replacements went in. The regulator declined. What it extracted instead was temporary roaming for some devices onto T-Mobile's UMTS network, a fine answer until you notice which network that was and what happened to it on July 1. Medical pendants were in the same queue.

I want to be precise about what happened there, because the usual telling is wrong. Nothing broke. There was no defect, no wear-out, no component at the end of its rated life. Every one of those devices was working correctly on the morning it stopped working, and it stopped because a network it was designed against was decommissioned by the company that owned it, on a schedule that had nothing to do with the device. The asset had a ten-year life. The dependency did not.

The alarm panel is installed once and never revisited. Fitted at construction or move-in, wired to a siren and a monitoring center, then left alone for a decade. Nobody logs into it. No update prompt, no app, no user who thinks of it as a computer. The only warning that its radio is obsolete is a letter asking to schedule a visit, and the response rate on that letter is the whole problem.

The medical pendant has a wearer who is not the buyer. Specified by a care provider or an adult child, worn by someone in their eighties living alone. The person carrying it has no relationship with the carrier and no reason to believe the pendant is anything other than a button. This is the class where a silent failure is not an inconvenience, and the class least able to notice one.

A cell is a shared medium. The radio resource in a sector at a given instant is finite, it is divided among everyone attached, and the whole business rests on the assumption that they will not all want it at once. That assumption holds almost always, which is why it is safe to sell far more subscriptions than the sector can carry. Oversubscription is not a flaw in the design. It is the design.

The signal bar tells you nothing about this. Bars render downlink reference signal power as measured by the device: how loudly it can hear the tower. That is a statement about distance, terrain and obstruction, and it is silent on whether the tower has room. A device can sit at full bars and still fail to get a channel, because the contention it loses happens in the random access procedure, before any of its data exists.

So the two words get used interchangeably and they should not be. Coverage is a claim about geography, and it is the one printed on the map. Capacity is a claim about a particular moment in a particular sector, and nobody publishes it. A signal bar is not an admission guarantee.

QCI is the number your device is almost certainly carrying. LTE tags every bearer with a QoS Class Identifier, and the standardized table gives each one a priority level, a packet delay budget and a tolerable loss rate. The ordinary default bearer is QCI 9, non-guaranteed bit rate, priority level 9, the bottom of that list. Operator IMS signaling runs at QCI 5, priority level 1. Mission-critical classes were added later at levels below 1. Your telematics unit is not in that part of the table.

ARP decides who gets dropped rather than who goes first. Allocation and Retention Priority is the one that bites. It carries a level from 1 to 15, where 1 is highest, plus two flags: whether this bearer may seize resources already granted to a lower-priority one, and whether it is itself vulnerable to being seized. Preemption is not an emergency measure bolted on afterward. It is a provisioned attribute of every bearer on the network.

Access barring happens before any of that. Underneath QoS sits a blunter control. Every device holds an access class, ordinary ones drawn from 0 through 9 and reserved classes from 11 through 15 for emergency services, public utilities, security services and operator staff. Extended Access Barring was added so that delay-tolerant machine traffic could be barred as a group, first and separately, before the network starts inconveniencing people.

The device volunteers for the bottom of the list. The part I find elegant and slightly grim. A low-priority device signals a delay-tolerant establishment cause when it asks for a connection, which is honest and correct and is what makes overload control possible. The network may then reject the request and hand back an extended wait timer the specification allows to run as long as 1800 s. The device is not told there is congestion. It is told to come back later.

And there is a statutory layer above all of it. Wireless Priority Service gives authorized subscribers priority call setup during congestion, sorted into five user categories by their role in an incident; GETS does the equivalent on the wireline side; and FirstNet gives responder traffic standing priority on commercial bands plus dedicated spectrum it can clear of commercial users entirely. Read that last one from the other direction. The traffic being cleared includes yours.

Congestion and emergency are the same moment. The hurricane that takes out a substation is the hurricane that puts three counties on the phone at once. The wildfire evacuation, the earthquake, the stadium at full time, the pileup that closes a freeway: in each case the reason the sector is saturated is the reason your device suddenly has something worth saying. Ordinary conditions are when the network has room, and ordinary conditions are when the message did not matter.

That inverts the usual way of thinking about reliability. The comfortable model is that a link works with some probability, that failures arrive independently, and that exposure is one small number times another. None of it holds here. The failure is correlated with the event, and correlated across the whole fleet at once, because every device in the sector is queued behind the same barring bitmap. You do not lose a unit. You lose the county.

And the priority hierarchy, which is the correct engineering answer to overload, makes this worse for you specifically. It works. Public safety traffic does get through, and it should, and I would not argue that a telematics heartbeat deserves to displace a 911 call. But the mechanism that guarantees the ambulance a channel is the mechanism that guarantees your fleet none, and it is not a bug you can file.

Store and forward, with a clock you can defend. Anything observed is written locally first and transmitted second, with enough non-volatile storage to cover an outage measured in days. The hard part is time. A message that arrives three hours late carrying only its arrival timestamp is worse than no message, because it silently corrupts the history. Stamp at observation, keep a monotonic counter for ordering, and treat clock skew as a data quality problem.

Back off with jitter, or build your own second outage. Every device in a sector loses the network at the same instant and, without deliberate randomization, retries at the same instant. The retry storm is then indistinguishable from the original event and can extend it. Exponential backoff with real randomness in the interval, plus a randomized delay before the first attempt after recovery, is what separates a fleet that returns gradually from one that re-creates the congestion.

Define a behavior for reaching nothing at all. The requirement most often left blank. What does this device do when it has contacted nothing for an hour, a day, a week? An alarm panel should still sound locally. A meter should keep billing-grade records and hold them. A controller should settle into a documented safe state rather than whatever the code happens to do. Offline is a state to be designed, not an exception to be thrown.

LTE-M and NB-IoT were designed for exactly these devices. Both cut the modem's complexity and power draw hard, and both lean on two mechanisms worth knowing by name: Power Saving Mode, where the device stays registered but goes properly dormant and unreachable for a scheduled interval, and extended discontinuous reception, which stretches the gap between paging checks far beyond anything a handset would tolerate. Together they are what makes a decade on a primary cell a plausible claim rather than a marketing one.

Neither of them repeals the priority argument. A narrowband device is still admitted or barred by the same base station under the same rules, and its delay-tolerant profile is precisely the marker that gets it barred first. What the narrowband radios genuinely buy is a longer runway before the next sunset and a device that can afford to wait, which is worth a great deal. It is not the same thing as getting through.

You cannot buy priority, so stop designing around getting it. WPS and FirstNet eligibility runs to national security, emergency preparedness and public safety missions. A commercial telematics operator, a meter vendor or an alarm company does not qualify, and no amount of architecture makes it qualify. Any design whose reliability story depends on being admitted during congestion is depending on something it has no mechanism to obtain, which makes it a wish rather than a control.

Tolerating the outage is usually correct, and it is cheaper. For most of these devices the honest cost of a few hours offline is small, the data is not perishable, and buffering with a sane retry policy covers it. Paying for redundant bearers to close a gap that costs little when it opens is a bad trade dressed as diligence. Say it plainly in the design review: we are choosing to be down, and here is what that costs.

The false binary is online against broken. Almost every requirements document splits the world into connected and failed, and that axis is wrong. The useful axis is how long the device can be usefully wrong. A meter can be days stale and still bill correctly. A tracker can be an hour stale and still earn its keep. A panic button is wrong the instant it is late. Sort the fleet that way and most of the redundancy argument evaporates.

The sunset is the easy half, because it comes with a date. Every shutdown this year was announced years ahead, in public, with a fixed date. That is the most forgiving kind of failure an engineer ever gets. The industry still largely missed it, which tells you something uncomfortable, but the mechanism was never mysterious. Congestion has no announcement and no date, and it is the failure mode nobody writes a migration plan for.

I should narrow the claim before I finish it, because the strong version is not true. Cellular is the right medium for an enormous amount of this work and there is often nothing better available. Networks have to be retired, spectrum is more useful under a newer air interface, and the hierarchy that keeps your fleet off a congested cell is doing something I would defend anywhere else. Nobody here is behaving badly. These are reasonable decisions by parties with different time horizons, and the device sits at the intersection.

What survives is smaller and worth holding onto. A radio is not a wire, it is a tenancy, and the lease is written by somebody whose planning horizon is shorter than your product's and whose priority list you are on but not near the top of. Design for the day the lease ends and for the hour the building is full, because those are the same building. The device that survives both is the one that was never assuming it would be heard.