How machines talk to machines
A water meter reports its reading. A lorry tells the depot where it is. A car negotiates a price with a charger and pays it. No person takes part in any of these exchanges. That is machine-to-machine communication — M2M — and everything else in the connected world is built on top of it.
Metering, authorisation and payment without a person approving each transaction: a car that pays for its own charge, an API client that pays per call.
ISO 15118 Plug & Charge · HTTP 402 · L402 · x402 4Device managementHow is a fleet configured, observed and updated?Bootstrapping, configuration, monitoring and firmware update for devices nobody will ever visit.
LwM2M · TR-069 / USP · FOTA 3MessagingWhat do the messages look like?Application protocols built for small payloads, unreliable links and devices that sleep most of the time.
MQTT · CoAP · AMQP · OPC UA · DDS 2ConnectivityHow do the bits travel?Cellular for reach, unlicensed low-power networks for battery life, short-range radio inside buildings, satellite where nothing else reaches.
LTE-M · NB-IoT · RedCap · LoRaWAN · Thread · NTN 1Identity & trustWhich machine is this, and can it be believed?A machine cannot type a password. It proves who it is with a key it was given at manufacture — in a SIM, a secure element or the chip itself.
X.509 certificates · SIM / eSIM / iSIM · secure elements · attestationRead from the bottom up: each layer depends on the one below it. Nothing can be billed that cannot be managed, nothing managed that cannot be reached, and nothing trusted that cannot be identified.
1 · Identity and trust
People log in with something they know. A machine has nothing to remember and nobody to ask, so it proves its identity with a private key placed in it before it left the factory. Everything above this layer assumes that key is genuine and has not been copied.
Certificates
An X.509 certificate binds the device’s public key to a name and chains back to the maker’s certificate authority. Mutual TLS then authenticates both ends. The hard part is lifecycle — issuing millions and revoking the right ones — which x509.systems covers in depth.
SIM, eSIM, iSIM
On cellular networks identity lives in the SIM. An eUICC can swap its operator profile over the air; the GSMA’s SGP.32 specification (2023) does this for devices with no screen and no user. iSIM moves the function inside the main chip.
Secure elements and attestation
A key in ordinary flash can be read out. A secure element, a TPM or a trusted execution environment keeps it where software cannot reach it, and can sign a statement about what firmware is running. Where those keys are generated and kept is the subject of kms.network.
2 · Connectivity
There is no best radio. Each one trades range, battery life, bandwidth and cost differently, and most real deployments use two.
| Family | Examples | Good for |
|---|---|---|
| Cellular IoT | LTE-M, NB-IoT, RedCap | Anything that moves, anything that must work on day one without building a network |
| Unlicensed LPWAN | LoRaWAN, Sigfox | Sensors that send a few bytes a day for ten years on one battery |
| Short-range mesh | Thread, Zigbee, Bluetooth LE | Dense indoor devices behind a gateway or border router |
| Wi-Fi | 802.11, Wi-Fi HaLow (802.11ah) | Mains-powered equipment and video |
| Satellite | 3GPP NTN, proprietary constellations | Ships, pipelines, agriculture and anything beyond the last mast |
| Wired fieldbus | Modbus, CAN, Industrial Ethernet | Control loops where latency and determinism matter more than convenience |
Cellular IoT only became practical when 3GPP stopped treating machines as small phones. Release 13, frozen in 2016, defined LTE-M and NB-IoT together with the power-saving features — PSM and eDRX — that let a module sleep for hours while staying registered. Release 17 in 2022 added RedCap for mid-range devices and carried the same signals over satellite.
3 · Messaging
HTTP assumes a client that is awake, a link that is fast and a payload worth a few hundred bytes of headers. Machines often have none of the three. MQTT and CoAP were designed for that world; AMQP, OPC UA and DDS serve the back end, the factory and the robot. Each protocol, with its standard and its trade-offs →
4 · Device management
A fleet that cannot be updated is a liability with a deployment date. Lightweight M2M gives every device the same management interface — bootstrap, read, write, execute, observe — and a standard object for firmware update. Broadband equipment uses TR-069 and its successor USP for the same job. Getting the update process itself right — signing, staging, rollback — is what fota.systems is about.
5 · Settlement
The newest layer, and the least settled. Machines have exchanged data for forty years; exchanging value without a person approving each step is only now being standardised. Electric vehicles do it in production today. How machine payments work →
M2M or IoT?
The two words describe the same systems from different ends. “M2M” came from telemetry and the cellular industry and means the link: one machine reporting to another. “Internet of Things”, coined in 1999, means what is built with those links — platforms, data, applications. A tracker sending coordinates is M2M. The logistics service that reroutes a delivery because of them is IoT. This site is about the first.
Nearly half a century in thirteen steps
- 1979Modicon publishes Modbus for its programmable logic controllers. Machines begin talking to each other over a shared serial line.
- 1986Bosch presents the CAN bus; within a decade it is the nervous system of most cars.
- 1995Siemens introduces the M1, an early GSM module made to be embedded in machines rather than phones.
- 1999MQTT is written for pipeline telemetry over satellite. The same year Kevin Ashton coins the phrase “Internet of Things”.
- 2012Seven regional standards bodies found oneM2M to stop each industry inventing its own service layer.
- 2014CoAP is published as RFC 7252, and MQTT 3.1.1 becomes an OASIS standard. ISO 15118-2 defines Plug & Charge.
- 20163GPP freezes Release 13 with LTE-M and NB-IoT — cellular radio designed for a ten-year battery, not a phone.
- 2017OMA publishes Lightweight M2M 1.0.
- 2019MQTT 5.0 becomes an OASIS standard.
- 2021The ITU approves LoRaWAN as Recommendation Y.4480.
- 20223GPP Release 17 brings RedCap and satellite (NTN) support for NB-IoT and LTE-M. Matter 1.0 ships.
- 2023GSMA publishes SGP.32, remote SIM provisioning for devices with no screen and no user.
- 2025x402 proposes using the long-dormant HTTP 402 status code for payments made by software.