LoRaWAN Protocol Guide: Architecture, Security & Diagnostics

Core Technical Specifications

center Freq EU: 868 MHz / US: 915 MHz / AS: 923 MHz

modulation LoRa CSS (Chirp Spread Spectrum)

data Encoding SF7–SF12, coding rate 4/5–4/8

operating Range 2–15 km (rural), 1–5 km (urban)

antenna Region-dependent

tx Power EU: 14 dBm, US: 30 dBm

bandwidth 125 / 250 / 500 kHz

channel Spacing Region-specific channel plans

Real-World Devices & Applications

IoT & LPWAN

Agricultural sensors (soil moisture, weather stations)
Smart city infrastructure (parking, waste bins, street lights)
Asset trackers and logistics (fleet management)
Building management and HVAC monitoring
Utility meters (water, gas, electricity) via Wireless M-Bus bridge

Reference Circuits & Schematics

LoRaWAN Network Architecture

LoRaWAN is a MAC-layer protocol on top of LoRa PHY. End devices communicate with gateways, which forward packets to a network server via IP backhaul.

Pin	Description
`End Device`	Sensor node with LoRa transceiver (SX1276/SX1262)
`Gateway`	Multi-channel receiver (8+ channels), forwards to NS via IP
`Network Server`	Handles MAC, dedup, ADR, routing (ChirpStack, TTN)
`Application Server`	Decodes payload, stores data, triggers actions

Circuit Walk-Through

End devices transmit uplinks using LoRa modulation. Any gateway in range receives and forwards the packet (with RSSI, SNR, timestamp) to the network server. The NS deduplicates, processes MAC commands (ADR, link check), and routes the payload to the application server. Downlinks follow the reverse path through a single gateway.

Signal Structure & Waveform Analysis

LoRaWAN MAC Frame Structure

LoRaWAN wraps the application payload with MAC header, device address, frame counter, and Message Integrity Code (MIC).

MHDR

1 byte

Message type (join, confirmed/unconfirmed data)

DevAddr

4 bytes

Device address (assigned during OTAA or pre-set for ABP)

FCtrl + FCnt

1 + 2 bytes

Frame control flags and 16-bit counter

FPort + Payload

1 + N bytes

Application port and AES-128 encrypted data

MIC

4 bytes

AES-CMAC message integrity code

Timing Notes: OTAA uses AppKey for mutual authentication. ABP skips join but requires pre-provisioned keys. Frame counters prevent replay attacks — counter resets (device reboot with ABP) cause NS to reject frames.

Analysis & Capture Tips

Check Join Accept/Reject on the network server console
Monitor frame counters for gaps or resets
Use gateway RSSI/SNR logs to assess coverage
Verify ADR convergence: SF should decrease as link improves

Bench Troubleshooting & Repair Guide

1. Join Failure (OTAA)

Network Server console / Gateway logs

Check: AppEUI/JoinEUI and AppKey match between device and NS. Verify correct regional frequencies. Check gateway is receiving join requests in traffic logs.

2. Frame Counter Mismatch

NS device detail page

ABP devices that reboot reset counter to 0. NS rejects frames with counter ≤ last seen (anti-replay). Enable ‘Frame Counter Reset’ on server or use OTAA.

3. ADR Issues

NS ADR logs

If ADR selects too high SF, link margin is poor. If too low SF, packets may be lost. Disable ADR and manually set SF for testing.

4. Duty Cycle Violations

Device serial debug output

EU868 enforces 1% duty cycle. If sending too frequently, the stack will queue or drop messages. Monitor TX duty cycle counter in firmware.

LoRaWAN