Command Protocol

SmartPot uses a bidirectional LoRa command protocol between the base station and individual smart buoys. All packets are AES-128 encrypted. Every critical command requires an acknowledgment handshake confirming receipt and execution.

Packet Structure

┌──────────┬──────────┬─────────┬──────────┬──────────┬──────────┐
│ Preamble │ Pot ID   │ Cmd     │ Payload  │ Seq      │ CMAC     │
│ (2 bytes)│ (2 bytes)│ (1 byte)│ (0-16 B) │ (2 bytes)│ (4 bytes)│
└──────────┴──────────┴─────────┴──────────┴──────────┴──────────┘

Field	Size	Description
Preamble	2 bytes	0x5350 (“SP” for SmartPot)
Pot ID	2 bytes	Unique trap identifier (0x0001–0xFFFE)
Command	1 byte	Command opcode
Payload	0–16 bytes	Command-specific data
Sequence	2 bytes	Monotonic counter for replay protection
CMAC	4 bytes	AES-CMAC truncated authentication tag

Command Set

Downstream (Base → Buoy → Trap)

Opcode	Name	Payload	Description
0x01	LOCK_DOOR	—	Lock the servo-driven door latch to retain catch
0x02	UNLOCK_DOOR	—	Unlock door to release contents
0x03	SURFACE	—	Trigger ballast release for ropeless recovery
0x04	CAPTURE	—	Request on-demand image from trap camera
0x05	STATUS	—	Force immediate telemetry report
0x06	SLEEP	duration_hours (2B)	Enter deep hibernation
0x07	SET_MODE	mode (1B)	Set classification mode (0=auto, 1=manual, 2=log-only)
0x08	REBOOT	—	Soft restart both submerged unit and buoy

Upstream (Trap → Buoy → Base)

Opcode	Name	Payload	Description
0x80	ACK	cmd_acked (1B) + status (1B)	Command acknowledgment
0x81	TELEMETRY	See Telemetry Format	Periodic status report
0x82	CATCH_EVENT	species (1B) + size_mm (2B) + action (1B)	Classification result
0x83	ALERT	alert_type (1B) + data (4B)	Drift, low battery, or fault alert
0x84	IMAGE_READY	chunk_count (1B) + total_bytes (2B)	Image available for download

Acknowledgment Protocol

Critical commands (LOCK_DOOR, UNLOCK_DOOR, SURFACE) use a three-phase handshake:

1. Base sends command with sequence number
2. Buoy ACKs receipt (status=0x01 — received, forwarding)
3. Buoy ACKs execution (status=0x02 — confirmed executed)

If no ACK is received within 10 seconds, the base retransmits up to 3 times. After 3 failures, the command is marked as failed and the operator is alerted.

Security

• AES-128-CMAC authentication on every packet
• Sequence counter prevents replay attacks
• Per-pot keys — compromise of one pot doesn’t affect the fleet
• Key provisioning happens during initial flash (see Encryption)

Caution

The SURFACE command triggers an irreversible mechanical action (ballast release). It requires a double-confirmation: the base station prompts the operator before sending, and the buoy waits 5 seconds before executing, sending a SURFACE_PENDING alert that can be cancelled with a CANCEL (opcode 0x0F).