Powering IoT devices: batteries, sleep modes and energy harvesting

Where the energy comes from

Mains power is easy where a socket exists. Power over Ethernet (PoE) sends power and data down one cable, which suits IP cameras and access points (you can size a budget with the PoE calculator). Many sensors, however, sit where there is no cable at all: in a field, on a pallet or on a wrist. These run on batteries, sometimes topped up by energy harvesting from a small solar panel, vibration or temperature differences.

Estimating battery life

Battery capacity is measured in milliamp-hours (mAh). To estimate life, work out the device's average current. Suppose a sensor draws 10 microamps asleep, and once every 10 minutes wakes for 2 seconds drawing 80 milliamps to read and transmit:

• Awake share: 2 seconds in 600, about 0.33 percent. Average awake contribution: 80 mA x 0.0033, roughly 0.27 mA.
• Sleep contribution: 0.01 mA.
• Average: about 0.28 mA. A 2000 mAh battery gives roughly 2000 / 0.28, around 7100 hours, or about 10 months.

Halve the wake time or double the interval and life nearly doubles. Real batteries lose capacity in the cold and with age, so allow a safety margin.

Low-power design techniques

• Deep sleep. Turn off the CPU and radio, keeping only a timer running.
• Short radio bursts. The radio is usually the biggest drain, so send small messages and batch readings.
• Low-power radios. Bluetooth Low Energy, Zigbee and LoRaWAN are designed for this; Wi-Fi connects quickly but costs more energy per message.
• Event-driven wake-up. A door sensor can sleep until the reed switch changes, rather than polling.
• Switch off peripherals. Power sensors through a pin so they draw nothing while the MCU sleeps.

Power and security

Security costs energy. A full TLS handshake with certificate checks uses CPU time and radio air time; downloading a firmware update can use more energy than a week of readings. Designers respond by resuming sessions instead of renegotiating, using efficient elliptic-curve cryptography, and scheduling updates when the battery is healthy. Never "save power" by removing encryption or authentication; instead reduce how often the expensive steps happen.

Power is also an attack target. A battery-drain attack keeps a device awake with constant connection requests until it dies. Rate limiting, ignoring unauthenticated traffic quickly and monitoring battery level in the platform all help you spot it.

Tip: a sudden fall in reported battery level across many devices at once is worth investigating; it may be a fault, a firmware bug or deliberate interference.