Frost Protection with Intermittent 4G: Choosing Messaging Protocols at the Edge

Segment the problem rather than choosing one protocol for everything. The sensor-to-gateway link is LoRaWAN, so the real choices are local controller-to-gateway and gateway-to-cloud. For the frost loop, run a small MQTT broker on the always-on Linux controller and have the gateway publish sensor state and subscribe to valve commands over the LAN. Retained messages let a restarted controller recover the last desired valve state immediately, and QoS 1 is adequate if commands are idempotent. For gateway-to-cloud, keep MQTT but use MQTT 5 with clean_start=false, a persistent session, message expiry, and a bounded local spool. This preserves the topic model and survives intermittent 4G. CoAP is attractive for very constrained IP hosts, but these sensors are not IP endpoints and the gateway has ample resources; adding CoAP would create a second stack without solving duplicate commands. AMQP belongs at the enterprise boundary (billing/ERP), bridged from MQTT, not on gateways. DDS targets low-latency peer discovery and would add multicast, memory, and operational complexity for 60 valves. The 48 KB valve controllers should speak a simple local command format to the gateway, which terminates TLS upstream.

QoS 1 is at-least-once, so duplicates are expected; QoS 2 does not fix duplicate side effects across reconnects because session state can be lost. Make commands idempotent at the actuator. Each command carries command_id (UUID), valve_id, desired_state, issued_at, and a monotonically increasing sequence per valve. The actuator persists the last applied command_id and sequence in non-volatile memory; it ignores a command whose sequence is not greater than the stored one and returns an ACK containing command_id. The cloud keeps a command ledger and marks success only on a matching ACK. During a 4G outage, the local controller owns valve state and records operator overrides with priority and timestamp. On reconnect it publishes a state snapshot, and reconciliation uses priority first, then timestamp, so a stale cloud command cannot reopen a valve. Add a TTL to frost commands, for example 10 minutes, so a delayed duplicate is rejected. Audit every accepted and rejected command. This addresses the incident without relying on exactly-once delivery.

Evaluate each against a concrete requirement. AMQP is justified only if finance or ERP needs transactional queues, routing across business units, or a protocol boundary that MQTT cannot provide. If adopted, bridge from MQTT at the cloud edge; do not connect gateways directly, because that adds a second credential domain, another broker hop, and more failure modes. Keep the audit ledger in one place. DDS for the local loop gives deterministic discovery and rich QoS for peer controllers, but it brings multicast on vineyard LAN/4G, higher memory footprint, and new operational skills. With 60 valves and a 10-second deadline, MQTT retained state plus a watchdog and hardware interlock is simpler and safer. Recommend a single stack: MQTT 5 locally and to the cloud, with AMQP only as an enterprise bridge if a named requirement appears. Record the decision in an architecture decision record. Validate with a four-hour 4G outage and a duplicate-injection test before the frost season.