Watchman: Frequency Hopping for LoRa Mesh

The Third Option

There is a third option in the LoRa mesh compliance crisis, and it has been available the whole time. 47 CFR 15.247(a)(1) permits frequency-hopping systems in the 902–928 MHz band to keep narrow channels and transmit at up to one full watt, provided they hop across at least 50 channels. The community debate assumes the only choices are a painful 500 kHz migration or ongoing non-compliance. Hopping keeps the 62.5 kHz bandwidth that makes dense-urban meshes work, keeps the 1 W repeaters legal, and averages transmissions over the noise instead of parking in it.

What This Proposes

Watchman is a frequency-hopping overlay for MeshCore-style LoRa meshes: a 192-channel plan, a pseudorandom hop sequence derived from the mesh key, and a four-stratum synchronization hierarchy, in the NTP sense of stratum, that degrades gracefully from GPS-grade time down to purely relative timing. The routing, encryption, and application layers above the radio are untouched. Flood routing is preserved by design. Every mechanism in it is borrowed from a system that already survived decades of field abuse.

The Problem

US LoRa mesh defaults do not fit any Part 15 provision at the power levels people actually run. Section 15.247(a)(2) allows digital modulation in 902–928 MHz only with a minimum 6 dB bandwidth of 500 kHz; MeshCore's USA preset is 62.5 kHz and Meshtastic's LongFast is 250 kHz. Below 500 kHz the only blanket authorization is 15.249, which caps radiated power near one milliwatt. A one-watt narrowband repeater on a fixed frequency therefore has no rule to stand under. An FCC test lab's LoRa certification guide and Semtech's own compliance guidance both read the rule this way.

The problem was raised in MeshCore issue #945 in October 2025 and has run to roughly 377 comments without resolution. No FCC enforcement, advisory, or acknowledgment has occurred as of October 2026 (Hackaday covered the standoff); enforcement in this band is historically complaint-driven.

The obvious fix is failing, socially and technically. Meshtastic shipped alpha 500 kHz presets that cannot interoperate with deployed nodes and fractured communities; Philadelphia's mesh tested 500 kHz, found it worse in dense urban noise, and switched protocols instead. Seattle operators report utility smart-meter channels every 300 kHz across the band, with noise floors 30 dB higher at wide bandwidths. Narrowband is not an aesthetic preference. It is why these meshes work in cities.

The minimum 6 dB bandwidth shall be at least 500 kHz.
— 47 CFR 15.247(a)(2), the sentence that started 377 comments

The hopping provision, which legalizes narrowband at full power, has been mentioned in passing (one commenter sketched LoRaWAN-style concentrators) but never developed into a concrete design. This is that design.

Why Narrow Wins

Channel bandwidth and channel spacing are different things, and conflating them is how the band got misread. Watchman keeps 62.5 kHz LoRa modulation throughout; only the distance between channel centers changes. A receiver's noise is proportional to its bandwidth, so 62.5 kHz captures one eighth the noise of 500 kHz, roughly 9 dB of sensitivity at equal spreading factor, and a narrow signal is far less likely to overlap a smart-meter channel. The costs are real but bounded: twice the airtime per byte compared with 125 kHz, and a carrier-accuracy requirement of about 16 ppm at 915 MHz, which means TCXO-equipped radios only. The SX1262 offers narrower modes still, but below 62.5 kHz the crystal budget turns vicious. The community found the floor empirically; 62.5 kHz is the narrowest channel stock hardware can hold.

Design Lineage

Watchman is an assembly, not an invention. Each mechanism below was lifted from something that already works.

1927–1970s

Autocall-Howe Plant Protection System — James R. Harrington multiplexed fire, watchman rounds, tank levels, and pressure telemetry over one shared three-conductor circuit (conductors P, N and S: a box operating circuit and a signaling loop, per US 1,950,108 and US 2,202,853), arbitrated by the signaling loop's own state, with zero clocks anywhere. Supervision was the conductors themselves: "under normal conditions a testing current is being passed continuously through this conductor" (US 1,950,108), held by test relays at the panel, so a break de-energizes a relay and reports trouble. A heartbeat, in 1927, with a relay as the watchdog. Early SCADA, filed by history under fire alarms because it protected factories instead of cities. Watchman borrows its reference-broadcast slot anchoring, its deterministic backoff instead of random backoff, its repetition coding by priority, and its supervision principle: a supervised circuit in which silence is itself an alarm, which the 1927 patent's continuous testing current makes a citation rather than a slogan.

1940s–present

Military FHSS and Bluetooth — a shared seed plus shared time yields coordinated hopping with no on-air negotiation. Watchman's hop channel is a pseudorandom function of the mesh key and the slot index.

1980s–present

RSA SecurID and TOTP — time-stepped shared-secret sequences tolerate sloppy clocks through acceptance windows. The hop sequence is TOTP with a 350 ms step.

1980s–present

Rolling-code remotes (KeeLoq, HOTP) — one-way, clockless transmitters stay synchronized for decades through look-ahead windows and a cheap resync ritual. Watchman's look-ahead window for rejoining after sleep treats recovery as a designed procedure, not a prayer.

1990s–present

GPS and LoRaWAN Class B — satellite time is a free stratum-0 anchor; LoRaWAN gateways already beacon GPS-timed slots in production. Optional GPS nodes pin Watchman's absolute slot numbering for instant join and partition merge.

2000s–present

TSCH (802.15.4e, WirelessHART) — industrial meshes carry their own time; every packet disciplines its hearers. Watchman transfers time in-band with a slot index in every frame header.

Watchman is, in part, the alternate timeline where Harrington's relay logic became a networking protocol instead of a footnote.

The Protocol

Channel Plan

192 channels of 62.5 kHz LoRa, centered every 125 kHz from 903.0 to 927.0 MHz. A 1 MHz guard at each band edge keeps spectral skirts clear of restricted bands; 125 kHz spacing comfortably exceeds the roughly 80 kHz 20 dB bandwidth of the signal. The channel table is configuration data, not code.

Hop Sequence

350 ms slots numbered by a 32-bit counter, 10 ms guards at each edge. Channel for slot N is PRF(key, N) mod |channel map|. No short cycle, so periodic traffic cannot lock onto one channel. One global sequence: every node on the same channel in the same slot, so flood routing survives unchanged.

Collision Handling

Listen-before-talk through the SX126x channel-activity detector, then deterministic backoff ordered by node key when two senders collide repeatedly, after the Howe interleaving pattern, rather than randomized backoff.

Repetition Coding

Join beacons and alarms repeat across 3–5 consecutive slots, and therefore across different channels; chat gets 1–2 slots; telemetry gets one. Criticality buys airtime diversity: the Howe five-rounds rule reborn.

Adaptive Frequency Hopping

Every node classifies each channel: idle noise floor, CAD-busy rate, and traffic expected but not heard. Scores ride in check-ins to the repeater, which accumulates trouble per channel. Channels bad for many nodes are removed from the channel map by an epoch-numbered update; the map never shrinks below 60 channels. This is Bluetooth's adaptive frequency hopping and TSCH's channel blacklisting, and it is the conduct 15.247(h) expressly permits.

Watchman Supervision

Repeaters and other infrastructure nodes own scheduled check-in slots, which ride on the periodic adverts they already send, so supervision costs a solar repeater almost nothing. A node that misses its round is flagged by its neighbors: silence is itself a supervisory signal, in the NFPA 72 sense of a supervised circuit, exactly as a lost testing current was in 1927. A solar repeater that browns out at 4 a.m. and returns at 9 generates a trouble and a restoration, which is information the mesh has never had. Companions are not supervised; a phone in a drawer is not an incident. Today's meshes lack this; a dead repeater is merely quiet.

Synchronization Strata

Nodes take time from the best stratum available and degrade gracefully.

Stratum	Source	Accuracy	Role
0	GPS (PPS or NMEA)	ns to ms	Absolute slot numbering from satellite time; instant cold join; partitions containing any GPS node merge pre-synchronized
1	In-band mesh time	sub-ms	Every frame carries its slot index; receive-interrupt timestamps discipline every hearer, TSCH-style
2	Reference-broadcast synchronization	ms	Any heard transmission's end re-anchors the next slot boundary; pure relative timing, Howe-style
3	Look-ahead window	—	A waking node bounds its drift, scans the few candidate channels its window allows, and snaps back in

Nothing here depends on mains power or on any single node. Any node that transmits is a time source for its hearers; when the mesh is silent, the node with the best stratum beacons and the others back off, and a sync beacon costs about 50 ms of transmit every 30 s, roughly 2 percent of the receive current a node already spends. A mesh of solar repeaters and battery companions keeps time collectively. GPS and mains power are preferences, not dependencies; a design that needed one anchor node would be the single point of failure off-grid meshes already reject. Harrington knew this too: his panel ran the whole system at 120 V DC from a bank of sixteen batteries kept floated by chargers, so a power outage did not silence the plant. The off-grid mesh's solar-and-battery norm is the same engineering judgment, ninety years on.

A node asleep for an hour accumulates roughly 72 ms of drift at 20 ppm, well inside one slot: it wakes and resumes. A node asleep for a day drifts about 1.7 s and scans a handful of slots to reacquire. Recovery is a designed ritual with a bounded cost.

Compliance Mapping

Each requirement of 15.247 for frequency-hopping systems in 902–928 MHz, against the design.

Requirement (paraphrased)	Watchman answer
Channel 20 dB bandwidth under 250 kHz requires at least 50 hopping channels	192 channels, with a 60-channel floor after adaptive blacklisting; the signal's 20 dB bandwidth is roughly 80 kHz
Channel separation at least the 20 dB bandwidth, or 25 kHz	125 kHz spacing against roughly 80 kHz
Average occupancy of any channel at most 0.4 s within 20 s	350 ms per visit, each channel visited about once per 67 s on average, several times below the limit
Pseudorandom sequence; each frequency used equally on average by each transmitter	Keyed-hash PRF over a 32-bit slot counter is uniform with no short cycle; periodic transmissions are jittered so no transmitter favors a channel
Receiver hops in synchrony with the transmitter, with matching input bandwidth	The entire mesh shares one sequence and one timebase; every receiver runs the same 62.5 kHz bandwidth
Maximum 1 W conducted output for 50 or more channels; antenna gain above 6 dBi reduces it dB for dB	1 W only on fixed repeaters feeding modest antennas; power budgeted as EIRP

Honest caveats, so this section cannot be accused of lawyering by enthusiasm: this is an engineering reading, not legal advice. The certification-versus-operation distinction for home-assembled nodes, argued at length in #945, is unresolved and matters mostly to vendors who sell preconfigured hardware. The hop sequence must be enforced by firmware, not left as a user-defeatable setting, for any vendor who wants to certify a product on this basis.

Finally, 15.247(h) cuts two ways. It permits a system to independently sense and avoid occupied channels, Bluetooth-style. It prohibits separate systems from coordinating their sequences with one another to avoid collisions. One mesh sharing one key is one system and may synchronize internally without limit; the rules in fact require its receivers to hop in synchrony. Two distinct meshes agreeing to interleave their schedules would cross the line. Harrington's three-conductor circuit was fully coordinated within one plant; the band is many plants sharing the air, and the rule only asks that no plant wire its signaling loop to the neighbors'.

Feasibility

Airtime versus the 330 ms usable slot

350 ms slot less guards; 62.5 kHz, CR 4/5, explicit header, 8-symbol preamble. Figures approximate.

Spreading factor	50-byte frame	Verdict
SF7	~195 ms	Comfortable; frames up to about 80 bytes fit
SF8	~350 ms	Over the slot at 50 bytes; cap payloads near 40 bytes (~310 ms)
SF9	~660 ms	Only ~15-byte frames fit; otherwise fragment
SF10+	over 1 s	Excluded; hopping trades away the slowest long-range modes

The current USA preset is SF7, so the mainstream configuration fits with room to spare, and fragmentation across slots comes nearly free since the radio was changing channels anyway. The slot is deliberately shorter than the 400 ms regulatory maximum: 50 ms of margin absorbs clock error and whatever occupancy-measurement method a test lab applies.

Timing budget

A 20 ppm crystal drifts about 200 microseconds across a 10 s gap between heard packets, roughly 0.06 percent of a slot. Receive-interrupt timestamping on the SX1262 is deterministic to well under a millisecond. A 10 ms guard interval at each slot edge absorbs all of it. The synthesizer retunes in well under 1 ms, and channel-activity detection costs one to two symbol times, 2–4 ms at SF7.

Hardware

Every deployed SX1262 node is hop-capable; this is firmware, not new radios. GPS anchors already exist across the ecosystem (T-Beam, T-Deck Plus, T-Echo, T1000-E, assorted trackers; WisBlock repeaters accept a $15 GNSS module), and MeshCore's firmware already maps GPS pins, including PPS, and ships gps sync in its CLI. A later refinement puts an SX1302 concentrator, which listens to eight channels at once, in wall-powered repeaters, LoRaWAN-gateway style, relaxing sync requirements for the whole neighborhood.

Firmware scope

The change is confined to the radio scheduler: a slot clock, a retune between slots, a slot index in the frame header, and a time-discipline module feeding it. Routing, contact books, encryption, and the companion protocol sit above and do not change.

Regulatory Margin

Watchman is designed to clear the rules by a margin, not to touch them. Three current-rule traps shaped the numbers above: slots run 350 ms against a 400 ms dwell limit; the sequence has no short cycle, because the rule demands equal channel use per transmitter and a periodic beacon on a short cycle would violate it; and channels stay 1 MHz clear of the band edges, where 1 W spectral skirts meet restricted bands. Two more are policy rather than protocol: high power lives only on fixed nodes, so handheld companions never raise RF-exposure questions, and hop plan and power limits are enforced by firmware per region profile rather than exposed as free settings, the posture the FCC's software-defined-radio rules expect of any product that might one day be certified.

The Band Itself May Move

NextNav's 2024 petition asked the FCC to restructure 902–928 MHz around a 15 MHz carve-out for terrestrial positioning, over broad opposition from Part 15 interests; its current status should be checked before any firmware ships. A channel table held as data survives such a change: a remaining 907–918 MHz would still hold 88 channels at 125 kHz spacing.

Regional profiles

Region	Governing rule	What it demands	Watchman profile
United States, Canada	FCC 15.247, ISED RSS-247	50+ channels, 0.4 s dwell, 1 W	192 channels, 350 ms slots, EIRP-budgeted power
European Union, UK	ETSI EN 300 220	Duty cycle of 1–10 percent, or listen-before-talk with airtime caps; about 25 mW ERP	56 channels in 863–870 MHz, mandatory CAD, per-node airtime accounting, reduced power
Japan	ARIB STD-T108	Mandatory carrier sense, 400 ms maximum transmission, about 20 mW	CAD mandatory, frames capped under the slot, low power
Australia, New Zealand	AS/NZS 4268	FCC-like hopping in 915–928 MHz	104 channels
India	865–867 MHz, low power	2 MHz of spectrum	Hopping infeasible; a non-hopping low-power profile

The convergence is the point: every regime outside the US already wants listen-before-talk, airtime accounting, and narrow spacing. Built in as pillars, they make one protocol with region profiles rather than a US design with ports. Figures for non-US regimes are approximate; a profile for any region needs its current rule text checked before use.

Open Problems

Cold join without GPS. A newcomer with no time source must scan until it hears traffic. Expected wait scales inversely with mesh activity; a quiet mesh needs sparse sync beacons, or the newcomer parks on one channel until the sequence lands on it, about 67 s on average with 192 channels. Needs measurement, not speculation.
Partition merge without GPS. Two long-separated islands re-meeting need an epoch arbitration rule. Any island containing one GPS node merges pre-synchronized; the pure-relative case is the fiddly one.
Range ceiling. Excluding SF10+ costs the extreme-range fringe links. Whether real deployments depend on those modes, versus repeater density doing the work, is an empirical question the testbed should answer.
Battery cost of discipline. Listening for time is nearly free when traffic flows; a silent mesh trades some idle listening or beacon airtime for sync. Duty-cycle math needed.
Migration. The genuinely hard part, and it is social, not technical. A dual-stack transition is plausible but ugly; opt-in regional meshes adopting it wholesale, the way Philadelphia switched protocols overnight, is likelier. A proposal with working code and measurements moves this conversation; another forum argument does not.

The Testbed

Three nodes, one owner, every rooftop consented: two Heltec V4 companions (ESP32-S3, SX1262) and one RAK WisMesh 1W repeater (RAK3401 with a SKY66122 amplifier, wall-powered) carrying a RAK12500 GNSS module as the stratum-0 anchor.

Phase 0

Two-node hop. Fork the radio scheduler on the two Heltecs; point-to-point hopping with event-chained slots only. Measure sync hold time across silence, drift versus the model, rejoin latency after forced sleep.

Phase 1

Full stratum hierarchy. Add the repeater as GPS-disciplined anchor broadcasting slot numbering; run the full 192-channel plan. Measure time error at each node versus GPS truth, cold-join time with and without GPS, throughput and loss versus the flat-channel baseline, average current draw per node over 24 hours against stock firmware, and behavior beside a deliberate interferer parked on one channel.

Phase 2

Publish. Waterfall captures, scripts, and raw numbers alongside this document, posted to #945 and the wider community. Spectrum screenshots have moved that thread more than statutes; the plan is to argue in that currency.

Success looks like a week of unattended three-node operation on the hopping schedule with sync maintained, rejoin under ten seconds from cold, and throughput within 20 percent of the flat-channel baseline. Failure on any of those is itself a publishable result, and either way the thread finally gets data.

WATCHMAN