The big picture
A LoRaWAN metering system moves small packets of meter data over long-range radio to gateways. The gateways pass them over the internet to servers that check, decode and deliver the readings to your billing and customer systems.
Five parts, one path
| Part | What it does | Where it lives |
|---|---|---|
| Meter endpoint | Measures usage, stores interval data and alarms, and transmits short radio packets. Electric meters are powered by the line they measure; water and gas endpoints run on a sealed battery. | Inside the meter, or attached to its register |
| Gateway | Listens on many uplink channels at once (all 72 on a Tektelic Kona Mega) and forwards every packet it hears, still encrypted, to the network server. It cannot read the meter data. | Water tower, tower, rooftop or pole |
| Backhaul | Carries packets between the gateway and the servers. | Ethernet or fiber at the site, or cellular |
| Network server | Discards duplicate copies, verifies each packet is genuine and in order, tunes each meter’s radio settings, and schedules commands back to meters. | Hosted data center |
| Application server and head-end | Decrypts and decodes the payload into readings and alarms, and passes them to meter data management (MDM), billing (CIS) and outage systems. | Hosted, connected to your systems |
What makes LoRaWAN different
No pairing to one gateway
Every gateway in range hears a meter. Adding a gateway adds another chance to catch each packet. There is no handover and no “home” gateway.
No mesh
Meters never relay for their neighbors. One meter’s reading does not depend on the house next door, and a failed meter cannot break anyone else’s path.
Long range, low power
A gateway on a water tower typically reaches meters a few miles away. Battery endpoints are designed to last 15 to 20 years.
Mostly one way
Meters talk far more than they listen. Commands to meters are possible, but they are a limited resource used on purpose.
Key numbers
| Frequency band (US) | 902–928 MHz, unlicensed (US915) |
| Typical gateway reach | 1–3 miles in town to meters in pits; 5 miles or more to outdoor meters in open country |
| Meter message size | Up to 11–242 bytes of meter data, depending on the data rate |
| Time on air per message | About 0.02 to 0.4 seconds |
| Battery endpoint design life | Typically 15–20 years |
| Encryption | AES-128, unique keys per meter |
LoRa radio and spreading factor
LoRa is the radio signal. LoRaWAN is the set of rules that meters, gateways and servers follow. LoRa’s trick is the chirp: a tone that sweeps across the channel.
Each LoRa symbol is a chirp that sweeps from the bottom of a 125 kHz channel to the top. The data is carried by where in the sweep each chirp starts. A packet opens with a run of plain chirps (the preamble) so the gateway can lock on, then the data chirps follow. Because the gateway knows exactly what shape to look for, it can pull a chirp out of the air even when it is weaker than the background noise.
See the chirps
Spreading factor: speed versus reach
The spreading factor (SF) sets how long each chirp lasts. Each step up doubles the chirp length. That buys about 2.5 dB of extra sensitivity, roughly 15–25% more distance in typical terrain, but it also roughly doubles the time on air and the battery energy for the same message. Meters close to a gateway use SF7 and finish quickly; meters at the edge use SF10.
Time on air calculator
| Data rate | Setting | Max data | Gateway can hear down to | Time on air |
|---|
Time on air uses Semtech’s LoRa formula with an 8-symbol preamble, 4/5 coding, CRC on and 13 bytes of LoRaWAN header and security code. Sensitivity is approximate, assuming a 6 dB gateway noise figure. The black line marks the FCC 400 ms limit.
Frequencies and channels
In the US, LoRaWAN uses the unlicensed 902–928 MHz band. The band is shared with other users, so LoRaWAN spreads its traffic across many channels.
The US915 channel plan
Tap or hover a channel to see its frequency.
- 64 uplink channels, 125 kHz wide, from 902.3 to 914.9 MHz every 200 kHz. These carry data rates DR0–DR3 (SF10–SF7).
- 8 uplink channels, 500 kHz wide, from 903.0 to 914.2 MHz. These carry DR4 (SF8 at 500 kHz), the fastest uplink rate.
- 8 downlink channels, 500 kHz wide, from 923.3 to 927.5 MHz, used for commands and replies to meters. Keeping them away from the uplink channels means a gateway’s transmissions never land on top of meter traffic on the same frequency.
- The channels are grouped into 8 sub-bands, each holding eight 125 kHz channels and one 500 kHz channel.
Each uplink goes out on a channel chosen pseudo-randomly from the sub-bands the network has enabled, so no single channel carries a meter’s traffic. Meters and the network must agree on which sub-bands are in use; that is part of the network setup. A 64-channel gateway such as the Tektelic Kona Mega listens on all 64 of the 125 kHz uplink channels and all 8 of the 500 kHz channels at once, so it hears meters configured for any sub-band. Smaller 8-channel gateways hear only one sub-band.
Gateways and coverage
Coverage comes down to a link budget: the meter’s transmit power, minus every loss along the way, has to stay above the weakest signal the gateway can still decode.
| Factor | Effect on coverage |
|---|---|
| Gateway antenna height | The biggest lever. Getting the antenna above trees and rooftops extends reach far more than extra transmit power does. |
| Distance | Near the ground and among buildings, signal fades much faster with distance than it would in open space. |
| Where the meter sits | A meter in a pit or basement can lose 10–20 dB or more before its signal ever leaves the ground. |
| Terrain, buildings, trees | Hills block 915 MHz; dense buildings and wet foliage absorb it. |
| Spreading factor | Each step from SF7 to SF10 adds about 2.5 dB to the link budget. |
| A second or third gateway | Adds redundancy as well as range: if one gateway is down or blocked, others still hear the meter. |
Typical installation losses
| Meter location | Typical extra loss |
|---|---|
| Electric meter on an outside wall | 0–5 dB |
| Gas meter outdoors | 0–5 dB |
| Water meter in a basement | 10–15 dB |
| Water pit with a through-the-lid antenna | 5–10 dB |
| Water pit, antenna under a plastic or composite lid | 10–20 dB |
| Water pit under a steel or cast-iron lid | 20 dB or more |
Planning values only; actual losses vary with the lid, the pit depth, standing water and snow cover. Every 6 dB of extra loss shortens a meter’s reach: by half in free space, and by roughly 30–40% near the ground, where signal already fades faster with distance.
Coverage sandbox
Drag the gateways around the town. Tap a meter to see its signal. Add a gateway or knock one out to see how redundancy works.
Tap a meter or a gateway.
Teaching model: Okumura–Hata path loss at 915 MHz, −3 dBi meter antenna, +4 dB net gateway antenna gain, 10 dB fade margin, and the installation losses above. The map is about 5 miles across. Real planning uses terrain and clutter data for your service area.
Joining and security
Before a meter can send readings, it has to join the network and agree on encryption keys with the servers. After that, every packet is signed and encrypted.
What the network server does with each packet
- Removes duplicates. If three gateways heard the same packet, it keeps one copy and notes the signal strength at each gateway.
- Checks it is genuine. It verifies the packet’s security code (the MIC) and that its frame counter is newer than the last one, which stops replayed or forged packets.
- Tunes the radio. Adaptive data rate (lesson 11) moves meters with strong signals to faster settings.
- Schedules commands. It queues downlinks and picks the gateway best placed to deliver each one.
Step through a join
Keys and identities
| Name | What it is | Secret? |
|---|---|---|
| DevEUI | A 64-bit worldwide-unique ID for the meter radio, like a serial number. Often printed on the label. | No |
| JoinEUI | Identifies the join server that holds the meter’s root key. Older documents call it the AppEUI. | No |
| AppKey | A 128-bit root key, unique to each meter, known only to the meter and the join server. | Yes |
| DevAddr | A short network address the meter receives when it joins. | No |
| Network session key | Signs every packet so the network server can prove it came from this meter, unaltered. | Yes |
| Application session key | Encrypts the meter data from the meter all the way to the application server. | Yes |
LoRaWAN 1.1 splits the network session key into three keys; the idea is the same.
Security in plain terms
- Meter data is encrypted with AES-128 from the meter to the application server. Gateways pass it along without being able to read it, and the key that decrypts it belongs to the application server, not the network server.
- Every meter has its own keys. Learning one meter’s keys reveals nothing about any other meter.
- Fresh session keys are made every time a meter joins.
- Frame counters mean a recorded packet cannot be played back later as a fake reading.
Listening: device classes and commands
Any LoRaWAN meter can transmit whenever it needs to, but it can only receive while its radio is listening. The device class decides when that is.
Class A: listens after it talks
After each uplink the meter opens two short receive windows, 1 and 2 seconds later, then sleeps. Lowest power, so this is how water and gas endpoints work. A command waits until the meter next transmits.
Class B: listens on a schedule
Adds receive windows at fixed times, kept in step by beacons from the gateways. Commands arrive within the ping period at a modest battery cost. Less common in metering.
Class C: always listening
The receiver stays on except while transmitting. It needs steady power, which an electric meter has, so remote disconnect and reconnect commands arrive within seconds.
The windows open 1 and 2 seconds after the uplink ends. RX1 uses the downlink channel paired with the uplink channel; RX2 is fixed at 923.3 MHz, SF12 at 500 kHz. For a join, the windows open after 5 and 6 seconds instead.
How long until a command arrives?
Electric meters
Electric meters have line power, so they can afford to talk more often and to keep their receiver on all the time.
Power
Runs from the service it measures, with enough stored energy to send a final outage message when the power fails.
Device class
Often Class C, so remote disconnect and reconnect commands arrive within seconds.
Reporting
Records interval energy (commonly every 15 minutes) and sends it in batches, often every 1–4 hours. Alarms go out right away.
| What it reports | What you use it for |
|---|---|
| Interval energy (kWh) | Billing, load profiles, time-of-use rates |
| Register reads: total kWh, peak demand | Billing and demand charges |
| Voltage | Power quality, low-voltage complaints, end-of-line checks |
| Outage (“last gasp”) and power restored | Outage map and restoration confirmation |
| Tamper: cover removed, tilt, reverse energy | Revenue protection |
| Disconnect switch status | Move-in and move-out, collections |
A day in the life of an electric meter
Water meters
Water endpoints run on a battery for 15–20 years and often sit underground, so they talk sparingly and are built to be heard from a pit.
Power
Sealed lithium battery. Class A: the endpoint only listens briefly after each transmission.
Installation
The endpoint connects to the meter’s encoder register by a cable, or is built into the meter. In a pit, the antenna goes through the lid or just under it.
Reporting
Stores hourly reads and sends them a few times a day, each message repeating recent hours. Leak, burst and tamper alarms go out promptly.
| What it reports | What you use it for |
|---|---|
| Cumulative register read | Billing |
| Hourly consumption | Customer portal, usage questions, high-bill calls |
| Leak (water never stops flowing) | Customer notification |
| Burst or high flow | Crew dispatch |
| Reverse flow | Backflow and cross-connection control |
| Tamper or cut register cable | Revenue protection, field check |
| Low battery | Planned endpoint replacement |
A day in the life of a water meter
Gas meters
Gas modules run on batteries by design: they must be safe to use where gas may be present, and a gas meter set has no electrical service.
Power
Sealed battery, designed for 15–20 years. Class A, like water.
Installation
The module mounts on the meter index and reads it by pulses or an encoder. It is certified intrinsically safe for hazardous locations.
Reporting
Hourly or daily consumption, a few messages a day. Tamper and other alarms go out promptly.
| What it reports | What you use it for |
|---|---|
| Cumulative index read (ccf or ft³) | Billing |
| Hourly or daily consumption | Load analysis, theft detection, high-bill calls |
| Tamper: magnet, module removed, tilt | Revenue protection, safety check |
| Low battery | Planned module replacement |
| Pressure or temperature (some commercial meters) | Volume correction, safety |
| Shutoff valve status (meters so equipped) | Safety, move-out, collections |
A day in the life of a gas meter
From radio packet to bill
Follow one water meter message from the pit to the customer’s bill.
- The endpoint wakes up, packs its latest hourly reads into 11 bytes, encrypts them with its application session key, signs the packet with its network session key and transmits on a randomly chosen channel.
- Two gateways hear it. Each stamps it with the time, signal strength (RSSI) and signal-to-noise ratio (SNR), and forwards it over its backhaul.
- The network server keeps one copy, checks the signature and frame counter, and records both gateways’ signal readings.
- The application server decrypts the payload and decodes the bytes into readings and status flags.
- The head-end stores the readings. Meter data management runs validation, estimation and editing (VEE) to catch gaps, spikes and stuck registers.
- The billing system (CIS) pulls validated reads at the end of the billing cycle.
Inside the packet
What the application server has after decrypting (shortened):
Tap a byte or a field to see how the 11 bytes decode. Every meter maker defines its own format; this one is illustrative.
Why one lost packet rarely means a lost read
Most endpoints send their readings unconfirmed, with no acknowledgment, because acknowledgments would need a downlink for every uplink. Instead, each message repeats the readings from the previous message or two. If one packet is lost, the next one fills the gap. An hour of data is only missing when every message carrying it is lost.
Gap simulator: one month of hourly reads
Reading signal health
Every received packet comes with two numbers: RSSI, how strong it was, and SNR, how far it stood above the noise. For LoRa, SNR tells you more.
RSSI
Received power in dBm. −70 is very strong; −120 is weak. Because RSSI includes noise, it stops falling once a signal sinks below the noise floor.
SNR
Signal-to-noise ratio in dB. LoRa can decode below zero. How far below depends on the spreading factor, so SNR shows how much margin is really left.
Margin
SNR minus the lowest SNR the spreading factor can decode. 10 dB or more is comfortable; under 5 dB means rain, foliage or a parked truck can cost you packets.
| Spreading factor | Lowest decodable SNR |
|---|---|
| SF7 | −7.5 dB |
| SF8 | −10 dB |
| SF9 | −12.5 dB |
| SF10 | −15 dB |
Check a meter’s signal
Adaptive data rate (ADR)
The network server watches the SNR of each meter’s recent uplinks. When there is margin to spare, it tells the meter to use a faster spreading factor and then a lower transmit power. Faster packets save battery, free the channel for other meters and cut collisions. If the meter later stops hearing from the network, it steps itself back down to slower, longer-range settings. Meters do not move, so ADR settles each one at the right setting and leaves it there.
Troubleshooting and common questions
Most problems come down to one of four things: the meter is not joined, its signal is too weak, a gateway is down, or the data is fine but the configuration behind it is not.
| What you see | Likely causes | What to check |
|---|---|---|
| A new meter never appears | Not registered, wrong keys, sub-band mismatch, or no coverage at that spot | Is the DevEUI registered? Is the network server seeing join requests from it? Test signal at the site. |
| A meter stopped reporting | Battery, cut cable, flooded pit, new metal lid, nearby gateway offline, meter removed | RSSI and SNR trend of its last packets, status of the gateways that used to hear it, then a site visit |
| Reads arrive with gaps | SNR near the limit, interference, or a gateway with unreliable backhaul | Signal margin and how many gateways hear it; a through-lid antenna or another gateway may fix it |
| Many meters in one area drop at once | A gateway is offline: site power, backhaul, lightning, antenna or cable damage | Gateway status, then call Vision Metering |
| Commands take a long time | Class A meter waiting for its next uplink, or commands queued behind others | The meter’s device class and reporting interval |
| Data arrives but looks wrong | Register or encoder wiring, multiplier or units setting, meter change not recorded | VEE exceptions in MDM; compare against a field read |
Common questions
- Is the meter data secure?
- Yes. Readings are encrypted with AES-128 keys unique to each meter, from the meter to the application server. Gateways cannot read them, and replayed or altered packets are rejected.
- Will meters interfere with Wi-Fi or customers’ electronics?
- No. Home Wi-Fi uses 2.4, 5 and 6 GHz; LoRaWAN uses 902–928 MHz, and each transmission is a brief, low-power burst.
- How much does a meter transmit?
- A few short bursts a day, each well under half a second, adding up to seconds per day. Endpoints are FCC-certified unlicensed radios limited to 1 watt of transmitter output.
- Do meters need line of sight to a gateway?
- No. 915 MHz bends around and passes through obstacles, and LoRa decodes very weak signals. Height and distance still matter, as the coverage sandbox shows.
- What happens if a gateway loses its internet connection?
- Meters also heard by another gateway carry on as normal. Meters heard only by that gateway lose packets until it reconnects; repeated readings fill short gaps, and many endpoints can resend stored history on request.
- What about power outages at gateway sites?
- Without backup power the gateway goes quiet, and so do the outage alarms from the meters it serves. Battery backup at gateway sites is strongly recommended.
- Why does a meter close to a gateway report weakly?
- Distance is only one factor. A pit under a metal lid, a basement, or a wall of other buildings can cost more signal than a mile of open air.
Knowledge check
Twelve questions on what you have covered. Pick an answer to see whether it is right and why.
Certificate of completion
How a LoRaWAN metering network works
Vision Metering, York, South Carolina