IoT and Cyber-Physical Communication Networks

Introduction and Context

The Internet of Things (IoT) connects physical objects—sensors, actuators, machines, vehicles, medical devices, meters and appliances—to communication networks and computational services. A cyber-physical system (CPS) goes further: it integrates computation, communication and physical processes through feedback. In a CPS, network delay, packet loss, clock error or cyberattack can alter physical behaviour. Consequently, IoT networking is not merely a matter of connecting more devices; it requires scalable addressing, energy-efficient protocols, dependable control, secure device lifecycle management and awareness of physical consequences.

Traditional Internet applications generally tolerate variable delay and occasional service interruption. Industrial control, protection of electrical grids and closed-loop medical systems may not. These applications require predictable latency, bounded jitter, high availability, accurate time, functional safety and carefully controlled updates. The central design problem is therefore a cross-layer one: selecting devices, radio technologies, protocols, gateways, edge services, cloud platforms and governance mechanisms that jointly satisfy application requirements.

This chapter examines constrained communication protocols, gateway and edge architectures, time-sensitive networking (TSN), device management, security, interoperability and representative industrial, healthcare, smart-grid and smart-city applications.

Learning Objectives

After studying this chapter, the reader should be able to:

1. Explain the architecture and distinguishing properties of IoT and CPS networks.

2. Select constrained protocols and access technologies for application requirements.

3. Design gateway, edge and cloud functions for scalable deployments.

4. Explain how TSN provides deterministic Ethernet services.

5. Apply device identity, provisioning, monitoring, updating and retirement practices.

6. Evaluate industrial, healthcare, smart-grid and smart-city deployments for safety, interoperability and security.

7. Critically assess reliability, latency, energy, privacy and governance trade-offs.

1. IoT and CPS as Networked Systems

An IoT system normally contains four interacting layers:

• Physical layer: sensors, actuators, machines, instruments and the environment.
• Connectivity layer: short-range, cellular, low-power wide-area, wired or industrial networks.
• Platform layer: gateways, brokers, databases, digital twins, analytics and device-management services.
• Application and governance layer: operational applications, user interfaces, policies, safety rules, privacy controls and regulatory compliance.

This layered view is useful, but real deployments are not strictly layered. A control application may impose timing constraints on the radio, while a battery limitation may determine the sampling strategy. A gateway may translate protocols, enforce security policy and execute control logic simultaneously.

A CPS contains a physical process, a computational model and a feedback loop. A simplified discrete-time control relationship is

\[

x_{k+1}=f(x_k,u_k,w_k), \qquad y_k=h(x_k,v_k)

\]

where \(x_k\) is the physical state at sampling instant \(k\), \(u_k\) is the control input, \(y_k\) is the measured output, \(w_k\) represents process disturbances and \(v_k\) represents measurement noise. The functions \(f\) and \(h\) describe process evolution and observation. This model is applicable when the process can be represented in discrete sampling steps; it does not by itself capture network delay, packet reordering or malicious input. A practical CPS model must therefore include communication and computation timing.

Important distinctions include:

• IoT: broad connectivity and data exchange among physical objects.
• Industrial IoT (IIoT): IoT applied to manufacturing, process control, logistics and infrastructure.
• CPS: tightly coupled computation, communication and physical dynamics, usually with feedback.
• Operational technology (OT): systems that monitor or control physical equipment.
• Information technology (IT): systems primarily concerned with data processing and business services.
• Digital twin: a software representation linked to a physical asset through data, models and lifecycle information.

The IT/OT boundary is increasingly porous. This creates operational benefits but also expands the attack surface and makes security failures potentially safety-critical.

2. Requirements and Design Dimensions

IoT network design begins with requirements rather than a preferred protocol. A useful requirements profile includes:

• Traffic pattern: periodic telemetry, event-driven alarms, command-response, video or firmware transfer.
• Latency: time between an event and useful delivery or actuation.
• Jitter: variation in latency, important for synchronized control and media.
• Reliability: probability that a message is delivered correctly within its deadline.
• Availability: proportion of time that the service is usable.
• Energy budget: available battery energy, harvesting capability and maintenance interval.
• Scale: number of devices, message rate, address space and mobility.
• Coverage and environment: indoor attenuation, underground operation, interference, temperature and electromagnetic conditions.
• Safety and criticality: consequences of incorrect, late or absent actions.
• Security and privacy: identity, confidentiality, integrity, availability, accountability and data minimization.

A useful traffic estimate is the average offered bit rate

\[

R_{avg}=N r L b

\]

where \(N\) is the number of devices, \(r\) is the message rate per device in messages per second, \(L\) is the payload length in bytes and \(b=8\) converts bytes to bits. This estimate excludes headers, retransmissions, acknowledgements and protocol overhead, so it is a lower-bound planning value. For example, 10,000 devices transmitting one 40-byte payload every 60 seconds produce

\[

R_{avg}=10{,}000\times\frac{1}{60}\times40\times8\approx53.3\text{ kbit/s}.

\]

Although the average is modest, simultaneous alarms can create a much larger burst. Capacity planning must therefore consider peak concurrency, duty-cycle restrictions, collision probability and queueing delay.

Reliability requirements must be stated with a time constraint. “99.9% reliable” is incomplete unless the observation period and delivery deadline are defined. A more useful statement is: “At least 99.99% of alarm messages shall arrive within 100 ms during normal operation.” Safety functions may require independent channels, local fallback and formal hazard analysis rather than reliance on a single network statistic.

3. Constrained Devices and Protocols

Constrained devices have limited processing power, memory, energy, bandwidth or intermittently available connectivity. Their protocols must reduce message overhead and support sleep cycles without sacrificing security.

3.1 IPv6 and 6LoWPAN

IPv6 provides a very large address space and supports end-to-end addressing. Low-power wireless personal area networks often use 6LoWPAN adaptation to compress IPv6 headers, fragment packets when necessary and support mesh forwarding over IEEE 802.15.4-type links. Fragmentation introduces loss sensitivity: losing one fragment can invalidate the reassembled packet. Designers should therefore keep application messages small and avoid unnecessary fragmentation.

3.2 CoAP

The Constrained Application Protocol (CoAP) provides a REST-like model for constrained nodes. It supports resources, methods such as GET, POST, PUT and DELETE, and compact messages over UDP. Confirmable messages request acknowledgement; non-confirmable messages reduce acknowledgement traffic where the application can tolerate loss. Observe allows a client to receive updates when a resource changes.

CoAP is not automatically secure. Datagram Transport Layer Security (DTLS) can protect UDP-based communication, while Object Security for Constrained RESTful Environments (OSCORE) protects selected messages at the application layer and can preserve end-to-end protection across proxies. Choice depends on whether intermediaries must inspect or transform messages.

3.3 MQTT and MQTT-SN

MQTT uses a publish/subscribe model with a broker. Publishers send messages to topics and subscribers receive messages matching subscriptions. This decouples producers from consumers and is convenient for cloud and enterprise integration. MQTT quality-of-service levels express delivery semantics, but “exactly once” is a protocol interaction property, not a guarantee that a physical action occurs exactly once. Actuator commands require transaction identifiers, idempotence, state verification and safe recovery.

MQTT-SN adapts publish/subscribe concepts for sensor networks where TCP/IP connections and long-lived broker sessions are costly. Gateways commonly translate MQTT-SN to MQTT.

3.4 Industrial and Application Protocols

OPC Unified Architecture (OPC UA) provides information modelling, discovery, security and interoperability across industrial systems. Its information model is richer than a simple topic hierarchy and supports semantic representation of devices and processes. Modbus remains common because of its simplicity and installed base, but it has limited native security and should be protected by segmentation, secure gateways or industrial security mechanisms.

AMQP is designed for reliable message-oriented middleware and is often used in enterprise integration, whereas HTTP is broadly interoperable but may impose greater overhead. No protocol is universally best; selection depends on message semantics, timing, device constraints, security architecture and existing systems.

4. Access Technologies and Network Architecture

Common connectivity choices include:

• IEEE 802.15.4 and mesh protocols: low power and moderate range, useful in building and industrial sensing; mesh routing can increase coverage but also adds maintenance and latency.
• Wi-Fi: high throughput and mature infrastructure, but comparatively higher energy consumption and variable contention.
• Bluetooth Low Energy: short-range, low-power personal and medical applications.
• LPWAN technologies: long range and low energy for small, infrequent messages; generally unsuitable for high-rate closed-loop control.
• Cellular IoT: broad coverage, managed mobility and strong operator infrastructure; subscription cost and coverage dependence remain considerations.
• Industrial Ethernet and fieldbuses: predictable performance and rugged deployment, but legacy systems may have limited interoperability or security.
• TSN Ethernet: deterministic services over converged Ethernet, discussed below.

A scalable architecture often uses hierarchical networking. End devices connect to local access networks; gateways aggregate and translate traffic; edge nodes perform time-sensitive processing; regional services coordinate sites; and cloud systems provide fleet analytics and long-term storage. Hierarchy reduces the need for every constrained device to communicate directly with the cloud.

5. Gateways and Edge Intelligence

A gateway can perform protocol translation, address aggregation, buffering, authentication, policy enforcement, local visualization and device management. It may translate CoAP to MQTT, Modbus to OPC UA, or industrial fieldbus data to an enterprise API. Translation must preserve semantics: units, timestamps, quality indicators, alarm states and command results must not be lost.

Edge computing places computation near data sources. Its principal benefits are:

1. Lower response time and reduced dependence on wide-area links.

2. Local operation during cloud disconnection.

3. Reduced bandwidth through filtering and aggregation.

4. Improved privacy by keeping sensitive data local.

5. Contextual decisions using plant or site information.

Edge intelligence may include threshold detection, anomaly detection, sensor fusion, predictive maintenance and local optimization. AI models should not be treated as infallible controllers. A safe design defines confidence thresholds, validates sensor quality, provides a deterministic fallback and prevents an unverified model from issuing unsafe commands.

A practical deployment uses a local-first policy for safety and immediate control, while the cloud supports fleet-level learning, reporting and noncritical optimization. Store-and-forward queues are useful during disconnection, but queued actuator commands need expiry times and state validation; replaying an obsolete command can be dangerous.

6. Time-Sensitive Networking

Conventional Ethernet is highly capable but does not inherently guarantee bounded latency or jitter under congestion. TSN is a family of IEEE 802.1 mechanisms that adds synchronization, scheduled transmission, traffic shaping, redundancy and resource configuration.

Important mechanisms include:

• 802.1AS: time synchronization based on the generalized Precision Time Protocol.
• 802.1Qbv: time-aware shaping, in which transmission gates open according to a schedule.
• 802.1Qav: credit-based shaping for selected streams.
• 802.1Qbu and 802.3br: frame preemption, allowing express traffic to interrupt a lower-priority frame.
• 802.1CB: frame replication and elimination for reliability.
• 802.1Qcc: centralized or distributed configuration of streams and resources.

TSN does not automatically make an application deterministic. End stations, switches, scheduling, time synchronization, traffic characterization and failure handling must all be engineered. A simplified end-to-end latency budget is

\[

D_{e2e}=D_{sensor}+D_{queue}+D_{transmit}+D_{prop}+D_{processing}+D_{actuator}.

\]

The terms represent sensing, queueing, transmission, propagation, processing and actuation delays. This is a budget identity for analysis, not a universal performance formula. Each term must be bounded under specified traffic and failure assumptions. Propagation delay is often small on a plant floor, whereas queueing and processing may dominate.

For synchronized control, clock error must be bounded relative to the application’s tolerance. Time synchronization should be monitored; a node with an invalid clock must not silently participate in a scheduled safety stream. TSN can coexist with ordinary traffic, but admission control and configuration governance are essential to prevent best-effort flows from disrupting critical streams.

7. Device and Data Lifecycle Management

A secure IoT deployment manages devices from manufacture to retirement:

1. Manufacturing identity: each device receives a unique identity and protected key material.

2. Onboarding: the device is authenticated, authorized and associated with a policy domain.

3. Configuration: parameters, certificates, network credentials and application settings are provisioned securely.

4. Operation: health, firmware version, clock status, connectivity, energy and security events are monitored.

5. Maintenance: patches and firmware updates are authenticated, integrity-checked and recoverable.

6. Decommissioning: credentials are revoked, data is erased where required and asset records are updated.

Boot integrity mechanisms such as secure boot verify that only authorized firmware executes. Hardware-backed secure elements can protect private keys. A robust update process uses signed images, version or rollback protection, staged deployment, compatibility checks, dual-bank recovery where feasible and an emergency rollback plan. Updating a safety controller without validating timing and control behaviour can be more hazardous than leaving it unchanged.

Device management protocols such as Lightweight M2M support remote provisioning, monitoring and firmware operations. Management traffic must be separated logically or physically from high-priority control traffic where necessary. Inventory accuracy is a security control: unknown devices cannot be patched, authorized or investigated reliably.

8. Security, Safety and Trust

IoT security requires defence in depth:

• unique device identity rather than shared passwords;
• mutual authentication and least-privilege authorization;
• encryption in transit and, where appropriate, at rest;
• network segmentation between enterprise, edge and control zones;
• secure logging and time-correlated monitoring;
• vulnerability management and supply-chain assurance;
• backups, recovery procedures and incident response;
• physical protection and tamper awareness.

Threats include device cloning, credential theft, malicious firmware, denial of service, insecure APIs, data manipulation, ransomware, supply-chain compromise and attacks on time synchronization. A gateway can reduce exposure but also becomes a high-value target and potential single point of failure.

Security and safety are related but not identical. Confidentiality may be important for patient data, while integrity and availability may dominate a protection relay or emergency shutdown system. A security control that increases latency or disables a necessary maintenance function can affect safety. Hazard analysis, threat modelling and safety engineering should therefore be conducted together.

Privacy requires purpose limitation, data minimization, retention control and appropriate consent or legal basis. Location, health and behavioural data can reveal sensitive information even when direct identifiers are removed. Federated learning or local analytics may reduce raw-data transfer, but model updates can still leak information and require security evaluation.

9. Application Domains

9.1 Industrial Automation

An industrial network may combine sensors, programmable logic controllers, robots, drives, safety systems, historians and enterprise applications. Control loops should remain local and deterministic. Cloud analytics is appropriate for maintenance trends, production optimization and cross-site comparison, but not as the sole path for emergency shutdown.

Interoperability requires common information models, engineering tools, time semantics and well-defined command behaviour. Brownfield sites should use monitored gateways and segmented zones rather than exposing legacy controllers directly to corporate networks.

9.2 Healthcare

Wearable monitors, infusion systems, imaging devices, hospital asset trackers and remote-care platforms have different timing and privacy needs. A noncritical wellness monitor may tolerate intermittent connectivity; an infusion pump requires authenticated commands, fail-safe operation and strict lifecycle control. Medical interoperability commonly involves standards such as HL7 FHIR for health information exchange and IEEE 11073 families for personal health device communication, but conformance alone does not guarantee safe integration.

Clinical workflow, human factors and alarm fatigue are central. An alerting system that produces excessive false alarms may be ignored. Patient identity, consent, auditability and availability during network outages must be designed explicitly.

9.3 Smart Grids

Smart meters, phasor measurement units, distributed energy resources and substation automation create a geographically distributed CPS. Protection and control have stringent timing and availability requirements, while meter data raises privacy concerns. Network segmentation, secure time, authenticated commands and redundant communication paths are important. Edge controllers can maintain local operation when wide-area connectivity fails.

9.4 Smart Cities

Traffic signals, parking systems, lighting, waste management, environmental sensors and public safety systems operate across multiple authorities and vendors. Open interfaces and data governance are essential. A city should avoid creating a single central failure point and should define retention, access and sharing rules before collecting large-scale citizen data.

10. Illustrative Case: Edge-Enabled Predictive Maintenance in a Factory

Background

Consider an illustrative medium-sized factory with 120 motor-driven assets. Each asset has vibration, temperature and current sensors. The factory previously uploaded raw data to a remote cloud service, while control remained in local PLCs.

Problem

The raw-data design consumed substantial bandwidth, generated privacy and intellectual-property concerns, and provided slow maintenance alerts during wide-area outages. A maintenance model also produced false alarms because sensor calibration and operating context were not included.

Analysis

The engineering team classified traffic into three classes: local control, maintenance telemetry and emergency alarms. Local control had the strictest latency and availability requirements; telemetry could tolerate seconds of delay; emergency alarms required local annunciation and a bounded delivery path. The team also discovered that device identities were shared within several sensor groups, preventing reliable attribution.

Approach

An industrial gateway was installed in each production zone. It performed protocol translation, certificate-based device authentication, timestamp validation, local feature extraction and buffering. Rather than transmitting complete vibration waveforms continuously, the gateway calculated selected spectral and statistical features and sent raw segments only when a local detector identified an anomaly. The cloud trained fleet-level models, while the gateway executed a validated model for immediate scoring.

Firmware updates were signed and staged on a small pilot group before broader deployment. The maintenance application used MQTT for telemetry, with message identifiers and asset-state checks for commands. Control traffic remained on a segmented deterministic network. A local rule-based fallback continued operation when the AI model was unavailable or its confidence was low.

Outcome

The architecture reduced wide-area traffic, allowed alerts to continue during cloud disconnection and improved attribution through individual identities. It did not eliminate false alarms; instead, it made the decision process auditable by recording model version, sensor quality, operating context and maintenance outcome. The plant retained human approval for invasive maintenance actions.

Learning Points

The case demonstrates that edge intelligence is most valuable when combined with sound data engineering, identity management, deterministic control boundaries and human oversight. AI did not replace networking or safety analysis. It operated within a governed architecture with explicit fallback behaviour.

11. Challenges, Limitations and Contemporary Directions

IoT deployments face several persistent challenges. Heterogeneous devices use incompatible data models and update mechanisms. Wireless links experience interference and changing propagation conditions. Battery replacement may dominate lifecycle cost. Legacy OT systems were often designed for isolation and long service lives, not continuous patching. Cloud dependence can create operational fragility, while excessive edge autonomy can create inconsistent policies across sites.

Scalability is not simply the number of registered devices. It includes certificate issuance, telemetry ingestion, firmware distribution, observability, incident response and human administrative capacity. A design that works in a laboratory may fail during a simultaneous reboot storm or mass reconnection event.

Contemporary directions include 5G and private cellular networks, deterministic wireless research, digital twins, federated and privacy-preserving learning, edge-native orchestration, network digital twins, post-quantum migration planning and greater integration of TSN with industrial wireless systems. These technologies should be evaluated against measurable requirements rather than adopted because of novelty.

Best practice is to begin with asset and data inventories, classify traffic and hazards, define measurable service objectives, select interoperable interfaces, isolate critical functions, test failure modes, automate certificate and update management, monitor configuration drift and conduct regular recovery exercises. Procurement should require security support duration, vulnerability disclosure, update mechanisms, conformance evidence and clear responsibility across vendors.

Chapter Summary

IoT networks connect constrained devices, gateways, edge platforms and cloud services, while CPS networks add feedback between computation and physical processes. Design must balance latency, jitter, reliability, energy, coverage, scale, safety, privacy and security. CoAP, MQTT, MQTT-SN, 6LoWPAN, OPC UA and industrial protocols serve different constraints and semantics. Gateways provide translation, policy enforcement and buffering; edge computing supports low-latency, resilient and privacy-aware operation. TSN improves determinism through synchronization, shaping, scheduling, preemption, redundancy and configuration, but requires end-to-end engineering. Secure lifecycle management includes identity, onboarding, monitoring, authenticated updates and retirement. Industrial, healthcare, smart-grid and smart-city systems demonstrate that interoperability and governance are as important as connectivity. AI can enhance edge analytics when bounded by validation, confidence handling, human oversight and safe fallback. Successful deployments treat networking, cybersecurity, safety, data governance and lifecycle economics as one engineering problem.

Key Terms

IoT: Networked connection of physical objects that sense, communicate or act.

Cyber-physical system: A system coupling computation and communication with physical processes through feedback.

Constrained device: A device limited in energy, memory, processing, bandwidth or connectivity.

CoAP: A compact REST-oriented application protocol for constrained devices.

MQTT: A broker-based publish/subscribe messaging protocol.

6LoWPAN: Adaptation technology supporting IPv6 over low-power wireless networks.

Gateway: A node that aggregates, translates, secures or manages traffic between networks.

Edge computing: Processing performed near data sources or physical processes.

Digital twin: A data-connected software representation of a physical asset or process.

TSN: IEEE Ethernet mechanisms for bounded latency, synchronization and dependable delivery.

Jitter: Variation in packet or transaction delay.

OPC UA: Industrial communication and information-modelling architecture.

Device lifecycle management: Processes governing provisioning, operation, updating and retirement.

Secure boot: Verification that authorized firmware executes during startup.

Digital certificate: A signed credential binding an identity to a public key.

Operational technology: Systems that monitor or control physical equipment.

Functional safety: Reduction of risks arising from malfunctioning systems.

Digital twin: A linked computational representation of a physical entity.

Federated learning: Collaborative model training in which data remains at local sites.

Network segmentation: Separation of systems or traffic into controlled security domains.

Review Questions

Short Answer Questions

1. Distinguish an IoT system from a cyber-physical system.

2. What functions can an IoT gateway perform?

3. Why is jitter important in industrial control?

4. State two advantages of edge computing.

5. What is the purpose of secure boot?

Long Answer Questions

1. Explain the architecture of a scalable IoT network from constrained device to cloud, including the roles of gateways and edge nodes.

2. Compare CoAP, MQTT and OPC UA in terms of communication model, constraints and application suitability.

3. Explain the principal TSN mechanisms and discuss why TSN does not alone guarantee deterministic application behaviour.

4. Develop a secure device lifecycle-management strategy for a large industrial deployment.

5. Compare networking, safety, privacy and interoperability requirements in healthcare and smart-grid applications.

Analytical / Application Questions

1. A deployment contains 10,000 sensors, each sending a 40-byte payload once per minute. Calculate the average payload rate and explain why peak capacity must be higher.

2. Design an edge architecture for a factory in which local control must continue during cloud disconnection. Identify traffic classes, fallback behaviour and security controls.

3. Evaluate whether a cloud-only AI system is appropriate for emergency medical actuation. Justify your answer using latency, availability, safety, privacy and governance criteria.

Multiple Choice Questions with Answers

Question 1

Which property most directly distinguishes a cyber-physical system from a general IoT monitoring system?

A. Use of physical sensors

B. Feedback coupling between computation and physical processes

C. Use of cloud storage

D. Use of IPv6 addressing

Correct Answer: B. Feedback coupling between computation and physical processes

Question 2

What is the main role of a CoAP confirmable message?

A. To request acknowledgement of delivery

B. To encrypt all cloud databases

C. To schedule TSN transmission gates

D. To assign a device certificate

Correct Answer: A. To request acknowledgement of delivery

Question 3

Which communication model is fundamental to MQTT?

A. Circuit switching

B. Publish/subscribe through a broker

C. Token-ring forwarding

D. Direct optical switching

Correct Answer: B. Publish/subscribe through a broker

Question 4

Ten thousand devices each transmit a 40-byte payload once per minute. What is the average payload rate?

A. 5.33 kbit/s

B. 53.3 kbit/s

C. 533 kbit/s

D. 5.33 Mbit/s

Correct Answer: B. 53.3 kbit/s

Question 5

Which TSN function provides a common time reference for scheduled communication?

A. 802.1AS

B. 802.1Qbu

C. 802.1CB

D. 802.1Qav

Correct Answer: A. 802.1AS

Question 6

Why should an actuator command include state validation or idempotence controls?

A. To increase radio frequency

B. To prevent harmful effects from duplication or obsolete commands

C. To eliminate the need for authentication

D. To reduce IPv6 address space

Correct Answer: B. To prevent harmful effects from duplication or obsolete commands

Question 7

Which practice best supports secure device retirement?

A. Leaving credentials active for troubleshooting

B. Revoking credentials and updating asset records

C. Disabling all audit logs

D. Reusing the device identity

Correct Answer: B. Revoking credentials and updating asset records

Question 8

Which application is generally most suitable for local edge processing rather than cloud-only processing?

A. Emergency shutdown control

B. Annual energy reporting

C. Historical dashboard formatting

D. Long-term archival compression

Correct Answer: A. Emergency shutdown control

Question 9

What is a principal limitation of LPWAN technologies?

A. They cannot support any battery-powered devices

B. They are generally unsuitable for high-rate closed-loop control

C. They require TSN switches at every sensor

D. They provide unlimited bandwidth

Correct Answer: B. They are generally unsuitable for high-rate closed-loop control

Question 10

Which statement about AI in safety-relevant edge systems is most appropriate?

A. A high-confidence model removes the need for fallback logic

B. AI should operate with validation, confidence handling and safe fallback

C. AI models cannot be updated after deployment

D. AI automatically guarantees deterministic latency

Correct Answer: B. AI should operate with validation, confidence handling and safe fallback