LoRaWAN

What is LoRaWAN?

LoRaWAN (Long Range Wide Area Network) is an open network protocol from the LoRa Alliance that lets battery-powered IoT and OT sensors send small messages wirelessly over distances from a few to more than ten kilometres to a central network, with battery life of up to around ten years. The protocol is the network layer on top of LoRa radio technology and covers architecture, authentication, encryption and network management. Within Industrial Internet of Things and IT OT Convergence architectures, LoRaWAN is a common choice for telemetry from distributed assets: tank levels, pumping stations, vibration, energy meters and HVAC plant. It is explicitly not intended for real-time control.

🧠 What is the difference between LoRa and LoRaWAN?

LoRa and LoRaWAN are often used interchangeably, but they are two layers:

The LoRa Alliance was founded in 2015 and published LoRaWAN 1.0 the same year. Key versions are 1.0.x (1.0.4 from October 2020 is the latest; many devices in the field still run 1.0.2 or 1.0.3), 1.1 (October 2017, with an improved key hierarchy) and the accompanying Regional Parameters for each frequency plan. In November 2021 the ITU approved the specification as Recommendation ITU-T Y.4480, technically equivalent to LoRaWAN 1.0.4. That makes LoRaWAN an official international standard rather than a vendor protocol.

🔧 How does the LoRaWAN architecture work?

LoRaWAN uses a star-of-stars topology. An end device broadcasts its message without being associated with a specific gateway; every gateway within range receives it and forwards it over IP. Gateways therefore do not route: they are transparent radio bridges. The network server removes the duplicate copies and picks the best gateway for any reply.

In practice the application server is connected to the OT environment through an edge platform or edge device: a decoder turns the compact binary payload into tags, after which a broker or gateway publishes the values. Well-known network servers are the open-source ChirpStack and The Things Stack; both deliver data over MQTT or webhooks and can integrate with cloud platforms such as AWS IoT Core and Azure IoT Hub.

📦 What are device classes A, B and C?

Every LoRaWAN device must support Class A. For remote control you choose Class C, but be aware that duty cycle and data rate still limit the response time.

📶 Which frequencies, data rates and airtime apply in Europe?

LoRaWAN uses licence-exempt ISM/SRD bands: EU863-870 in Europe, US902-928 in North America and, among others, AS923, IN865, KR920 and CN470 in Asia. In Europe three default channels are mandatory (868.1, 868.3 and 868.5 MHz); the second receive window uses 869.525 MHz. Maximum transmit power is +16 dBm EIRP.

A higher spreading factor gives a more sensitive receiver (from -123 dBm at SF7 to -137 dBm at SF12) and therefore more range, but costs up to twenty-five times as much airtime. Adaptive Data Rate (ADR) lets the network server set the lowest workable spreading factor and transmit power per device; this works well for fixed sensors and poorly for moving assets.

The European standard ETSI EN 300 220 limits transmit time per sub-band through a duty cycle: 1% in the main band 868.0-868.6 MHz, 0.1% in parts of 863-865 and 868.7-869.2 MHz, and 10% in 869.4-869.65 MHz. At SF12, 1% means that after a 1.5-second message a device must wait more than two minutes. In the Netherlands, the Dutch Authority for Digital Infrastructure (RDI) supervises this spectrum use.

Typical real-world values:

• Range - 1-5 km in urban areas and on industrial sites, 10-15 km or more in open countryside with line of sight; steel, concrete and underground chambers shorten this considerably
• Message interval - once every 5 to 60 minutes, payload 10-20 bytes
• Battery life - 5 to 10 years at a low spreading factor and an interval of fifteen minutes or longer; at SF12 with frequent messages, more like 1 to 3 years
• Fair use on The Things Network - 30 seconds of uplink airtime and 10 downlinks per device per day; on a private network only the legal limits apply

🔐 How is LoRaWAN secured?

For security, LoRaWAN has two layers based on AES-128 out of the box: the network layer checks with a Message Integrity Code (AES-CMAC) that a message is genuine and unaltered, and the application layer encrypts the payload end to end between device and application server. Frame counters that increase with every message protect against a replay attack.

There are two activation methods. With OTAA (Over-The-Air Activation) the device derives fresh session keys on every join; this is the recommended method. With ABP (Activation By Personalization) fixed session keys are stored in the firmware. If the frame counters reset to zero after a restart, the network rejects the messages, and disabling the counter check to work around this opens the door to replay.

Because the payload is encrypted and every frame carries an integrity code, a malicious gateway cannot alter the data unnoticed. The weak point is more often key management, physically accessible sensors and the link between the network server and the OT network.

🏭 Where is LoRaWAN used in industry and infrastructure?

Within industrial automation, LoRaWAN is mainly about cheaply making visible what was not measured before:

• Water sector - levels in sewage pumping stations and overflows, pressure in distribution networks, monitoring of remote wells; see also Water Sector OT Security
• Energy and utilities - transformer temperature, a complement to wireless meter reading alongside M-Bus
• Manufacturing - condition monitoring of pumps, motors and fans as a first step towards predictive maintenance
• Building Automation - temperature, CO2, occupancy and leak detection without cabling
• Logistics and ports - locating containers and equipment

The Netherlands was an early leader. On 30 June 2016 KPN announced nationwide LoRa coverage, one of the first operators in the world to do so, and still offers LoRa today, including as an alternative to 2G, which it switches off in December 2027. The Things Network, which started in Amsterdam in 2015, built a free community network with volunteer-operated gateways. Industrial users increasingly opt for a private network with their own gateways and network server, keeping data, keys and availability fully in their own hands and the segmentation of the OT network intact. A single gateway can serve thousands of devices, which gives LoRaWAN high scalability as long as the duty cycle allows it.

🔄 LoRaWAN, NB-IoT, LTE-M or 5G: which should you choose?

LoRaWAN wins when you want to roll out many low-cost sensors across a site or region without SIM costs and with full control. For deep indoor coverage without your own infrastructure NB-IoT is stronger, and for moving assets LTE-M. Inside process plants WirelessHART is often the more logical choice, because it integrates into the control system at instrument level.

🛠️ How do you set up a LoRaWAN network securely in an OT environment?

1. Define the use case and its limits - monitoring and non-critical commands only; never safety functions, motion control or PLC control loops over LoRaWAN.
2. Choose the network model - public (operator or community), private or hybrid. For organisations in scope of NIS2, a private network or a contract with a clear SLA is the obvious route.
3. Run a coverage survey - place test gateways, measure RSSI and SNR at the worst locations, and use the duty cycle to calculate how many messages per hour are feasible.
4. Organise key management - OTAA, unique keys per device, a secured Join Server and a replacement process.
5. Segment the backhaul - put the network server and integration in a separate zone according to IEC 62443, with only outbound, encrypted connections to the application layer.
6. Integrate and monitor - decode to MQTT or OPC UA, send gateway and join events to logging and security monitoring, and track battery voltage and missing messages.
7. Manage the lifecycle - define lifecycle management: register devices in the asset inventory and configuration management, use firmware updates over the air (FUOTA) where the hardware supports it, and include gateways in patch management.

Regulation matters too: since 1 August 2025, new radio equipment that can communicate over the internet, such as LoRaWAN gateways, must meet the cybersecurity requirements of the Radio Equipment Directive through EN 18031. The Cyber Resilience Act adds reporting obligations from 11 September 2026 and full requirements from 11 December 2027. For the wider policy framework, NIST SP 800-82 and ISO 27001 apply.

❓ Frequently asked questions

How far does LoRaWAN reach?

LoRaWAN typically reaches 1 to 5 kilometres in urban areas and on industrial sites, and 10 to 15 kilometres or more in open countryside with line of sight. The actual range of LoRaWAN depends on the spreading factor, the antenna height of the gateway and obstacles such as steel and concrete.

Is LoRaWAN suitable for controlling equipment?

LoRaWAN is suitable for occasional, non-critical commands, such as opening a valve or switching lighting with a Class C device. LoRaWAN is unsuitable for control loops, safety functions and motion control, because the duty cycle, low data rate and lack of guaranteed delivery rule out a deterministic response time.

Is LoRaWAN secure enough for OT?

LoRaWAN encrypts the payload end to end with AES-128 and checks every message with an integrity code, which is a solid basis for telemetry. Most LoRaWAN risks lie in weak key management, ABP with disabled frame counters and a poorly separated link between the network server and the OT network.

How much does a LoRaWAN network cost?

An industrial LoRaWAN gateway typically costs from a few hundred to just over a thousand euros, and sensors start at a few tens of euros each. With a private LoRaWAN network you pay no per-device subscription, only the costs of the network server, backhaul and management.

What is the difference between LoRaWAN and NB-IoT?

LoRaWAN operates in licence-exempt spectrum and lets you build your own network, whereas NB-IoT is a cellular technology that runs through an operator and a SIM subscription. NB-IoT usually offers better indoor coverage and a higher data rate, while LoRaWAN offers lower energy use and full control over infrastructure and keys.

How long does the battery of a LoRaWAN sensor last?

A LoRaWAN sensor that sends a small message every fifteen minutes at a low spreading factor often lasts 5 to 10 years on one battery. With poor coverage that forces SF12, or with a high message rate, the battery life of a LoRaWAN sensor drops to a few years.

📌 In summary

LoRaWAN is the open LPWAN protocol of the LoRa Alliance for low-power, long-range telemetry: ideal for monitoring thousands of battery sensors across kilometres, unsuitable for real-time control. If you deploy LoRaWAN in an OT environment, combine OTAA and sound key management with segmentation according to IEC 62443, so that wireless monitoring does not undermine the cybersecurity of the plant.