LoRaWANTM

Advanced Presentation

• LoRaWAN Specification v1.0 & v1.1 – LoRa Alliance

• LoRaWAN Regional Parameters – LoRa Alliance
• Back-end interfaces v1.0 – LoRa Alliance

1
LoRaWAN back-end MAC Commands

Message format Adaptative Data Rate : ADR

Regional Parameters CFLIST : Channel Frequency list

Duty Cycle CRC and MIC

Listen Before Talk (LBT)

2
LoRaWAN back-end
Modifiez le style du titre

• Network Server (NS): forwarding application payloads to the

AS, forwarding Join-request and Join-accept messages
between the End-Devices and the Join Servers.

• Join Server (JS): manages the Over-the-Air (OTA) End-Device

activation process

• Application Server (AS): handles all the application layer

payloads and provides the application-level service to the
end-user

Let’s now focus on the LoRaWAN backend.

The Network Server (NS) terminates the LoRaWAN MAC layer for the End-Devices
connected to the network. It is the center of the star topology.

The Network Server (NS) :

• Checks the End-Device address
• Does the frame authentication and checks the frame counter
• It acknowledges messages,
• It does the Data rate adaptation,
• The Network Server answers to all MAC layer requests coming from the End-
Device,
• It forwards uplink payloads to the appropriate Application Servers,
• It manage a queue of downlink payloads coming from any Application Server to
any End-Device connected to the network,
• And finally, it forwards Join-request and Join-accept messages between the End-
Devices and the Join Servers.

The Join Server (JS) manages the Over-the-Air (OTA) End-Device activation process.
There may be several Join Servers connected to a Network Server, and a Join Server

3
may also connect to several Network Servers. The End-Device indicates which Join
Server should be interrogated thanks to the JoinEUI field in the Join-request message.
Each Join Server is identified by a unique JoinEUI value.
Note that AppEUI field of the Join-request in LoRaWAN 1.0/1.0.2 [LW10, LW102] is
renamed to JoinEUI field.

The Join Server knows the End-Device’s Home Network Server identifier and provides
this information to the other Network Servers when required by the roaming
procedures.
The Join Server contains the required information to process uplink Join-request
frames and generate the downlink Join-accept frames. It also performs the network
and application session key derivations. It communicates the Network Session Key of
the End-Device to the Network Server, and the Application Session Key to the
corresponding Application Server.

The Application Server (AS) handles all the application layer payloads of the
associated End-Devices and provides the application-level service to the end-user. It
also generates all the application layer downlink payloads towards the connected
End-Devices.

3
Message format
Modifiez le style du titre

Preamble PHDR CRC PHYPayload CRC

PHY header PHY header checksum See below Payload checksum
Only for uplink
MHDR MACPayload MIC
MAC header See below Integrity check
- Message type
- LoRaWAN version
FHDR FPort FRMPayload
Frame header Applicative port: Encrypted payload using:
- Device address - 0: MAC command - NwkSKey if port is 0
- ADR/Ack/FPending - 1-223: application - AppSKey otherwise
- Frame counter - 224-255: reserved
- FOpts: additional MAC commands

Let’s talk about the message format.

The MAC frame header contains an MType field that can be one of:
• Join request / join accept
• (Un)confirmed data Up/down
The data frames contain user data. Confirmed data messages must be acknowledged
by the receiver.

The frame port is optional and used only when there is a payload; it indicates what is
the frame contents:
• A value of 0 indicates MAC commands only
• Values 1-223 are application specific
• Values 224-255 are reserved for future use

The MAC commands are control commands used to setup the physical layer
parameters:
• Link Check commands
• Link ADR commands
• End-Device Transmit Duty Cycle
• Receive Windows Parameters

4
• End-Device Status
• Creation/Modification of a channel
• Setting delay between TX and RX
These commands control the LoRa features. ADR stands for Adaptive Data Rate,
which means that the LoRa communication is automatically controlled depending on
the radio conditions, to maximize speed while keeping a sufficient SNR.

The frame header contains:

• DevAddr which is the short device address
• FCtrl which controls ADR and Acknowledgements
• FCnt which is the frame counter (see below)
• Fopts which may contain additional, unencrypted MAC commands (up to 15 bytes)

Each end-device has two frame counters to keep track of the number of data frames
sent uplink to the network server (FCntUp) and the number of frame received by the
end-device downlink from the network server (FCntDown).
Fcountup is incremented by the end-device and FCountDown is incremented by the
network server.
The network server tracks the uplink frame counter and generates the downlink
counter for each end-device. After a join accept, the frame counters on the end-
device and the frame counters on the network server for that end-device are reset to
0.

Subsequently, FCntUp and FCntDown are incremented at the sender side by 1 for
each data frame sent in the respective direction. At the receiver side, the
corresponding counter is kept in sync with the received value. The received value is
compared to the current counter value and is less than the value specified by
MAX_FCNT_GAP 1 after considering counter rollovers. If this difference is greater
than the value of MAX_FCNT_GAP then too many data frames have been lost then
subsequent will be discarded.

4
Regional Parameters
Modifiez le style du titre

• Official regional specifications, called Regional Parameters for LoRaWAN

• Can be downloaded from the LoRa Alliance website
• Specify :
• ISM Band channel frequencies: authorized frequencies, mandatory frequencies, upstream and
downstream channel plans
• Data Rate and End-device Output Power encoding
• JoinAccept CFList
• LinkAdrReq command
• Maximum payload size
• Receive windows (which channel and data rate should be used)
• Class B beacon and default downlink channel (frequencies, data rate, modulation)
• Default Settings

LoRaWAN operates in unlicensed radio spectrum. This means that anyone can
use the radio frequencies.
LoRaWAN has official regional specifications, called Regional Parameters, that
you can download from the LoRa Alliance website.

The Regional Parameters specify:

• The authorized frequencies, the mandatory frequencies, and the upstream and
downstream channel plans
• The Data Rate and the End-device Output Power encoding
• The JoinAccept CFList
• The LinkAdrReq command which is a mac command that depends on the
frequency plan
• The Maximum payload size
• The Receive windows (which channel and data rate should be used)
• The Class B beacon and the default downlink channel (frequencies, data rate,
modulation)
• And the default Settings which are:
• RECEIVE_DELAY1
• RECEIVE_DELAY2

5
• JOIN_ACCEPT_DELAY1
• JOIN_ACCEPT_DELAY2
• MAX_FCNT_GAP
• ADR_ACK_LIMIT
• ADR_ACK_DELAY
• ACK_TIMEOUT

5
DUTY
Modifiez le CYCLE
style du titre

• The European regulations require that a LoRa Device does not transmit more than 1% of the
time in a defined sub-band

• A duty cycle of 1% means :

• If I transmit during 1% of unity of time,
• I can’t transmit anymore during 99% of unities of time
• Unity of time for duty cycle calculation is one hour

• Example
• The transmission time of a frame is called Time On Air
• Sending a 20 bytes message in LoRaWAN in SF7 gives a Time On Air of 72ms
• For a Time On Air of 72ms and a duty cycle of 1%, the LoRa end-device:
• Can transmit during 3600s x1%=36s i.e. 36/0.072 = 500 messages per hour
• Can’t transmit during 3600x99%= 3564s per hour

The Duty Cycle indicates the fraction of time a resource is busy. Indeed, the
European regulations require that a LoRa end-device does not transmit more than
1% of the time in a defined sub-band.

What does a duty cycle of 1% mean ?

It means that if I transmit during 1% of unity of time, I can’t transmit anymore during
99% of unities of time. The unity of time for duty cycle calculation is one hour.

Let’s take an example. The transmission time of a frame is called the Time On Air.
Sending a 20 bytes message in LoRaWAN in SF7 gives a Time On Air of 72ms.
For a Time On Air of 72ms and a duty cycle of 1%, the LoRa end-device can transmit
during 36s i.e. 500 messages per hour. It can’t so transmit during 3564s per hour

6
Listen Before
Modifiez le style du titre Talk (LBT)

Overview
• Several techniques are used worldwide to share the spectrum of unlicensed bands between users:
➢ Frequency hopping
➢ Duty Cycle
➢ LBT
• LBT consists in checking a channel is not used by another user before transmitting on this channel to avoid a sent packet whereas
another transmission is in progress in the air:
➢ This mechanism uses a sx1272 chip to monitor in continuous the RF link through an FPGA.
➢ When the HAL wants to send a RF packet, the FPGA knows if the LBT requirement is satisfied or not.
• LBT is optional in many EMEA countries (ETSI regulation) but mandatory in Korea and Japan:
➢ LBT is also known as “carrier sense” in Korea and Japan
➢ In Japan, LBT is used simultaneously with Duty Cycle and Maximum Transmission Time constraints
Parameters
• Frequencies: the monitored channels that would be used for the transmission
• Scan time: the duration of the scan
• Threshold (RSSI): level from which the channel is considered busy
• Maximum transmit time (depending on the applicable regulation)
• Duty cycle (depending on the applicable regulation)

Several techniques are used worldwide to share the spectrum of unlicensed bands
between users. We’ve just seen Duty Cycle in Europe. Now let’s have a look on LBT.
LBT means Listen Before Talk. It is optional in many EMEA countries (ETSI regulation)
but mandatory in Korea and Japan.

LBT consists in checking a channel is not used by another user before transmitting on
this channel to avoid a sent packet whereas another transmission is in progress in the
air. This mechanism uses a sx1272 chip to monitor in continuous the RF link through
an FPGA. When the HAL wants to send a RF packet, the FPGA knows if the LBT
requirement is satisfied or not.

The used parameters for LBT are:

• Frequencies: the monitored channels that would be used for the transmission
• Scan time: the duration of the scan
• Threshold (RSSI): the level from which the channel is considered busy
• The Maximum transmit time (depending on the applicable regulation)
• And the Duty cycle (depending on the applicable regulation)

7
MAC
Modifiez leCommands
style du titre

• Used for network administration (Link Check, ADR, Transmit Duty Cycle, Receive Windows Parameters, …)

• Exchanged between Network Server and end-device

• MAC layer commands are never visible to the application server or application on end-device

• Can be sent:
• In the FOpts of a frame header (Must not exceed 15 octets, not cyphered)
• In the FRMPayload field with the FPort field being set to 0 (cyphered)

FHDR FPort FRMPayload

Frame header Applicative port: CID Mac payload
- Device address 0: MAC command
- ADR/Ack/FPending
- Frame counter
- FOpts: additional MAC commands

The MAC commands are used for network administration. They are exchanged
between the Network Server and the end-device.
They can be sent in the FOpts of a frame header (Must not exceed 15 octets, not
cyphered) or in the FRMPayload field with the FPort field being set to 0 (cyphered)

8
Example:
Modifiez le style dunew
titre channel request

FHDR FPort FRMPayload

Frame header Applicative port: CID: Mac payload:
- Device address 0: MAC command 0x07 0x0184724050
- ADR/Ack/FPending
- Frame counter
- FOpts: additional MAC commands

Here is an example with a new channel request.

The NewChannelReq command can be used to either modify the parameters
of an existing bidirectional channel or to create a new one. The command sets
the center frequency of the new channel and the range of uplink data rates
usable on this channel.

The channel index (ChIndex) is the index of the channel being created or modified.
Depending on the region and frequency band used, in certain regions ([PHY]) the
LoRaWAN specification imposes default channels which must be common to all
devices and cannot be modified by the NewChannelReq command. If the number of
default channels is N, the default channels go from 0 to N-1, and the acceptable
range for ChIndex is N to 15. A device must be able to handle at least 16 different
channel definitions. In certain regions the device may have to store more than 16
channel definitions.

The frequency (Freq) field is a 24 bits unsigned integer. The actual channel frequency
in Hz is 100 x Freq whereby values representing frequencies below 100 MHz are
reserved for future use. It allows to set the frequency of a channel anywhere
between 100 MHz to 1.67 GHz in 100 Hz steps. A Freq value of 0 disables the

9
channel. The end-device MUST check that the frequency is allowed by its radio
hardware and return an error otherwise.

The data-rate range (DrRange) field specifies the uplink data-rate range
allowed for this channel. The field is split in two 4-bit indexes.
The minimum data rate (MinDR) subfield designates the lowest uplink data
rate allowed on this channel.
The maximum data rate (MaxDR) subfield designates the highest uplink data
rate allowed on this channel.

0x847240 = 8 680 000

8 680 000 x 100 = 868 000 000 => 868MHz

9
Example:
Modifiez le style dunew
titre channel answer

FHDR FPort FRMPayload

Frame header Applicative port: CID: Mac payload:
- Device address 0: MAC command 0x07 0x03
- ADR/Ack/FPending
- Frame counter
- FOpts: additional MAC commands

The end-device acknowledges the reception of a NewChannelReq by sending

back a NewChannelAns command.
The payload of this message contains the following information :
• NewChannelAns Payload
• And Status
If either of those 2 bits equals 0, the command failed, and the new channel has
not been created.

10
Adaptative Data Rate - ADR
Modifiez le style du titre

• Each end-device uses different frequencies and data rates

• The selection of the data rate is a trade-off between communication range and message duration
(from 0.3 kbps to 50 kbps)

ADAPTIVE DATA RATE (ADR)

• Why ? To maximize both battery life of the end-devices and overall network capacity
• When ? When the radio channel attenuation is stable (often when the end-device is immobile)
• How ? By managing the data rate and RF output for each end-device
• If the uplink ADR bit is set, the network will control the data rate and Tx power of the end-device through the
appropriate MAC commands.
• If the downlink ADR bit is set, it informs the end-device that the Network Server is in a position to send ADR
commands
• When default data rate and TXPower are changed by the ADR, the end-device periodically checks that the
network receives the uplink frames

• ADR mechanisms are managed by Kerlink and are strictly confidential

Adaptive Data Rate (ADR) is a mechanism for optimizing data rates, airtime and
energy consumption in the network.
The ADR mechanism controls the following transmission parameters of an end
device.
• Spreading factor
• Bandwidth
• Transmission power

ADR can optimize device power consumption while ensuring that messages
are still received at gateways. When ADR is in use, the network server will
indicate to the end device that it should reduce transmission power or increase
data rate. End devices which are close to gateways should use a lower
spreading factor and higher data rate, while devices further away should use a
high spreading factor because they need a higher link budget.

ADR mechanisms are managed by Kerlink and are strictly confidential

11
CFLIST : Channel
Modifiez le style du titre Frequency list
• List of 5 channel frequencies for the channels 3 to 7
• Each frequency is encoded as a 24 bits unsigned integer (three octets)
• LoRaWAN implements this CFList of 16 bytes in the JoinAccept message
• The format of the CFList is region dependent and is defined in [PHY]
• CFList contains either a list of frequencies or a ChMask fields

• The CFList is optional

• If present, the CFList SHALL replace all the previous channels stored in the end-device apart from
the three default channels
• The newly defined channels are immediately enabled and usable by the end-device for
communication

• The MAC layer parameters (except RXdelay1, RX2 data rate, and RX1 DR Offset that are
transported by the join-accept message) SHALL all be reset to their default values

The CFList is a list used to specify to the LoRa end-devices the 5 customizable
channels available for this network in addition to the 3 mandatory channels 0 to 2
(which cannot be changed).
Each frequency is encoded as a 24 bits unsigned integer (three octets)
LoRaWAN implements this CFList of 16 bytes in the JoinAccept message
The format of the CFList is region dependent and is defined in [PHY]
CFList contains either a list of frequencies or a ChMask fields

The CFList is optional.

If present, the CFList SHALL replace all the previous channels stored in the
end-device apart from the three default channels
The newly defined channels are immediately enabled and usable by the end-
device for communication

12
CFLIST : examples
Modifiez le style du titre

• Join accept frame

• AU915-928 JoinAccept CFList

• EU863-870 JoinAccept CFList OR AS923 JoinAccept CFList

Here is the example of the join accept frame allowing to share the CFList with the
end-devices.
We can see that the format of the CFList is region-dependent.

13
CRC
Modifiezand MIC
le style du titre

• Communications between end-devices, gateways and LNS are protected

• By a CRC (Cyclic Redundancy check)
• Checks that RF transmission is correct
• Done by radio transceiver
End-device gateway LNS

• By a MIC (Message Integrity Code)

• Checks that packets are not corrupted
• AES, NwkSIntKey dependent cyclic redundancy check (CRC)
• Protects from Man In the Middle attacks
Message Integrity Code (MIC)

Communications between end-devices, gateways and LNS are protected

By a CRC (Cyclic Redundancy check)
And By a MIC (Message Integrity Code)

The CRC checks that the RF transmission is correct. It is done by the radio transceiver.

The MIC checks that packets are not corrupted. It is AES and NwkSIntKey dependent.
It protects from Man In the Middle attacks.

14
Thank you

15