BACnet通訊分析

1、bacnet通訊1、概述.系統(tǒng)實(shí)現(xiàn)基于bacnet/ip（又稱b/ip）網(wǎng)絡(luò)進(jìn)行通訊。bacnet虛擬鏈路層（bvll）提供了bacnet網(wǎng)絡(luò)層和某指定的通訊子系統(tǒng)的接口，本文指定了bacnet虛擬鏈路控制（bvlc）要求支持的定向和廣播信息。本實(shí)現(xiàn)關(guān)于bacnet協(xié)議定義主要可分為三層：b/ip網(wǎng)絡(luò)虛擬層，bacnet網(wǎng)絡(luò)層和bacnet應(yīng)用層。b/ip提供了tcp/ip一樣的通訊結(jié)構(gòu)，采用udp的通訊方式。本文接下來(lái)將對(duì)此三層結(jié)構(gòu)進(jìn)行詳細(xì)的講解。其文本協(xié)議的大致格式如下：bacnet/ipbacnet網(wǎng)絡(luò)層bacnet 應(yīng)用層bvlc typebvlc functionlengthnpdu

2、apdunpdu：bacnet網(wǎng)絡(luò)層數(shù)據(jù)結(jié)構(gòu)，下文進(jìn)行詳細(xì)的講解apdu：bacnet應(yīng)用層數(shù)據(jù)結(jié)構(gòu)，下文進(jìn)行詳細(xì)的講解2、bacnet/ip.bvlc type：0x81，代表bacnet/ip網(wǎng)絡(luò)bvlc function：指定報(bào)文的類型，何種作用；本應(yīng)用使用的報(bào)文類型分為兩種：0a：點(diǎn)對(duì)點(diǎn)通訊0b：廣播通信length：指定報(bào)文的長(zhǎng)度，包括bvlc type、bvlc function以及本身在內(nèi)npdu：根據(jù)不同情況，報(bào)文長(zhǎng)短不同，見(jiàn)下文的解析。apdu：根據(jù)npdu不同以及不同的請(qǐng)求，報(bào)文不同，見(jiàn)下文的解析。3、bacnet npdu結(jié)構(gòu).版本信息1 byteversion控制字1

3、bytecontrol目標(biāo)網(wǎng)絡(luò)號(hào)2 bytesdnet目標(biāo)網(wǎng)絡(luò)長(zhǎng)度1 bytedlen目標(biāo)地址可變長(zhǎng)度dadr原網(wǎng)絡(luò)號(hào)2 bytessnet原網(wǎng)絡(luò)長(zhǎng)度1 byteslen原地址可變snet路由數(shù)目1 bytehop count消息類型1 bytemessage type賣方id2 bytesvendor id應(yīng)用層信息可變apdu版本信息：默認(rèn)0x01控制字：bit7：1表示message type存在，為0時(shí)message type不存在 bit6：保留，為0 bit5：1表示dnet dlen hop count存在，當(dāng)dlen為0時(shí)表明廣播網(wǎng)絡(luò)dadr不存在；0表示dnet dlen d

4、adr hop count不存在 bit4：保留，為0 bit3：1表示snet slen存在，當(dāng)slen為0時(shí)表明無(wú)效sadr不存在；0表示snet slen sadr hop count不存在 bit2：1表示為一個(gè)需確認(rèn)的請(qǐng)求數(shù)據(jù)單元，一復(fù)雜ack數(shù)據(jù)單元或一網(wǎng)絡(luò)層信息非reply的；0表示除去上述情形的數(shù)據(jù)單元 bit1、0：網(wǎng)絡(luò)優(yōu)先級(jí)11 = life safety message10 = critical equipment message01 = urgent message00 = normal message目標(biāo)網(wǎng)絡(luò)號(hào)：ffff的時(shí)候表示廣播目標(biāo)長(zhǎng)度： 表示dadr的長(zhǎng)度目標(biāo)

5、地址： 目標(biāo)網(wǎng)絡(luò)mac地址原網(wǎng)絡(luò)號(hào)： 同目標(biāo)網(wǎng)絡(luò)號(hào)原網(wǎng)絡(luò)長(zhǎng)度：表示sadr的長(zhǎng)度原地址： 原網(wǎng)絡(luò)的mac地址路由數(shù)目：數(shù)據(jù)需要經(jīng)過(guò)的路由個(gè)數(shù)，當(dāng)不存在dnet的時(shí)候，需設(shè)置為ff消息類型：x'00': who-is-router-to-networkx'01': i-am-router-to-networkx'02': i-could-be-router-to-networkx'03': reject-message-to-networkx'04': router-busy-to-networkx'05&#

6、39;: router-available-to-networkx'06': initialize-routing-tablex'07': initialize-routing-table-ackx'08': establish-connection-to-networkx'09': disconnect-connection-to-networkx'0a' to x'7f': reserved for use by ashraex'80' to x'ff': ava

7、ilable for vendor proprietary messages賣方id：當(dāng)控制字的bit7為1并且消息類型為x'80' to x'ff':的時(shí)候，才會(huì)存在本次開(kāi)發(fā)沒(méi)有用到，不再解釋本次應(yīng)用中控制字只用到0x20和0x04兩種，前者為廣播查詢?cè)O(shè)備，后者微點(diǎn)對(duì)對(duì)取設(shè)備數(shù)據(jù)或?qū)傩浴?、bacnet apdu結(jié)構(gòu)：（應(yīng)用層協(xié)議數(shù)據(jù)單元）bacnet網(wǎng)絡(luò)層數(shù)據(jù)主要分為一下幾種：bacnetpdu := choice confirmed-request-pdu 0 bacnet-confirmed-request-pdu,unconfirmed-request

8、-pdu 1 bacnet-unconfirmed-request-pdu,simpleack-pdu 2 bacnet-simpleack-pdu,complexack-pdu 3 bacnet-complexack-pdu,segmentack-pdu 4 bacnet-segmentack-pdu,error-pdu 5 bacnet-error-pdu,reject-pdu 6 bacnet-reject-pdu,abort-pdu 7 bacnet-abort-pdu對(duì)于本次應(yīng)用，主要用到了bacnet-confirmed-request-pdu（需確認(rèn)的請(qǐng)求協(xié)議數(shù)據(jù)單元）bacne

9、t-unconfirmed-request-pdu（無(wú)需確認(rèn)的請(qǐng)求協(xié)議數(shù)據(jù)單元）bacnet-complexack-pdu（復(fù)雜的ack命令）bacnet-error-pdu（報(bào)錯(cuò)的協(xié)議數(shù)據(jù)單元）對(duì)于上述幾種數(shù)據(jù)的分類主要根據(jù)pdu type（下文進(jìn)行講解）進(jìn)行判定。4.1.bacnet-confirmed-request-pdu的結(jié)構(gòu)：bacnet-confirmed-request-pdu := sequence pdu-type 0 unsigned (0.15), - 0 for this pdu typesegmented-message 1 boolean,more-follows

10、 2 boolean,segmented-response-accepted 3 boolean,reserved 4 unsigned (0.3), - must be set to zeromax-segments-accepted 5 unsigned (0.7), - as per 20.1.2.4max-apdu-length-accepted6 unsigned (0.15), - as per 20.1.2.5invokeid 7 unsigned (0.255),sequence-number 8 unsigned (0.255) optional, - only if seg

11、mented msgproposed-window-size 9 unsigned (1.127) optional, - only if segmented msgservice-choice 10 bacnetconfirmedservicechoice,service-request 11 bacnet-confirmed-service-request optionalbit7bit6bit5bit4bit3bit2bit1bit0pdu typesegmorsa00max segsmax respinvoke idsequence number(only present by seg

12、=1)proposed window size(only present by seg=1)service chioceservice requestpdu type 0 (bacnet-confirmed-service-request-pdu)seg 0(unsegmented request)1 (segmented request)mor0 (no more segments follow)1 (more segments follow)sa0 (segmented response not accepted)1(segmented response accepted)max segs

13、 (0.7) (number of response segments accepted per 20.1.2.4)max resp(0.15) (size of maximum apdu accepted per 20.1.2.5)invoke id (0.255)sequence number(0.255) only present if seg = 1proposed window size (1.127)only present if seg = 1service choicebacnetconfirmedservicechoiceservice requestvariable enc

14、odingseg：指出當(dāng)前的數(shù)據(jù)單元是否為完整的還是為一部分分段信息mor：指出是否還有更多的分段信息sa： 為1時(shí)指出將收到一個(gè)復(fù)雜的回應(yīng)（complex ack）max segs ：指出設(shè)備將要接收到多少分段信息b'000' unspecified number of segments accepted.b'001' 2 segments accepted.b'010' 4 segments accepted.b'011' 8 segments accepted.b'100' 16 segments accep

15、ted.b'101' 32 segments accepted.b'110' 64 segments accepted.b'111' greater than 64 segments accepted.max resp：指出將收到的（apdu）最大長(zhǎng)度b'0000' up to minimummessagesize (50 octets)b'0001' up to 128 octetsb'0010' up to 206 octets (fits in a lontalk frame)b'00

16、11' up to 480 octets (fits in an arcnet frame)b'0100' up to 1024 octetsb'0101' up to 1476 octets (fits in an iso 8802-3 frame)invoke id：調(diào)用者idservice chioce：此處表明次報(bào)文的作用，詳見(jiàn)bacnetconfirmedservicechoiceservice request：根據(jù)bacnetconfirmedservicechoice不同而結(jié)構(gòu)不同，詳見(jiàn)bacnet-confirmed-service-re

17、questbacnetconfirmedservicechoice := 枚舉類型 - alarm and event servicesacknowledgealarm (0),confirmedcovnotification (1),confirmedeventnotification (2),getalarmsummary (3),getenrollmentsummary (4),geteventinformation (29),subscribecov (5),subscribecovproperty (28),lifesafetyoperation (27),- servicesato

18、micreadfile (6),atomicwritefile (7),- object access servicesaddlistelement (8),removelistelement (9),createobject (10),deleteobject (11),readproperty (12),readpropertyconditional (13),readpropertymultiple (14),readrange (26),writeproperty (15),writepropertymultiple (16),。上述標(biāo)記為紅色的表示本次應(yīng)用中所用到的，所以只對(duì)這些進(jìn)行

19、講解?？梢愿鶕?jù)bacnetconfirmedservicechoice找到相對(duì)應(yīng)的request或者ack的數(shù)據(jù)的結(jié)構(gòu)bacnet-confirmed-service-request := choice /對(duì)應(yīng)上面的choice- alarm and event servicesacknowledgealarm 0 acknowledgealarm-request,confirmedcovnotification 1 confirmedcovnotification-request,confirmedeventnotification 2 confirmedeventnotification-

20、request,- getalarmsummary conveys no parametersgetenrollmentsummary 4 getenrollmentsummary-request,geteventinformation 29 geteventinformation-request,subscribecov 5 subscribecov-request,subscribecovproperty 28 subscribecovproperty-request,lifesafetyoperation 27 lifesafetyoperation-request,- services

21、atomicreadfile 6 atomicread,atomicwritefile 7 atomicwrite,- object access servicesaddlistelement 8 addlistelement-request,removelistelement 9 removelistelement-request,createobject 10 createobject-request,deleteobject 11 deleteobject-request,readproperty 12 readproperty-request,readpropertycondition

22、al 13 readpropertyconditional-request,readpropertymultiple 14 readpropertymultiple-request,readrange 26 readrange-request,writeproperty 15 writeproperty-request,writepropertymultiple 16 writepropertymultiple-request,。上述標(biāo)記為紅色的既是針對(duì)bacnetconfirmedservicechoice所用到的數(shù)據(jù)結(jié)構(gòu)。readproperty-request := sequence /

23、讀數(shù)據(jù)請(qǐng)求和讀數(shù)據(jù)回答objectidentifier 0 bacnetobjectidentifier,propertyidentifier 1 bacnetpropertyidentifier,propertyarrayindex 2 unsigned optional -used only with array datatypereadpropertymultiple-request := sequence listofreadaccessspecs sequence of readaccessspecificationreadaccessspecification := sequenc

24、e objectidentifier 0 bacnetobjectidentifier,listofpropertyreferences 1 sequence of bacnetpropertyreferencebacnetpropertyreference := sequence propertyidentifier 0 bacnetpropertyidentifier,propertyarrayindex 1 unsigned optional -used only with array datatype- if omitted with an array the entire array

25、 is referencedbacnetpropertyidentifier := enumerated accepted-modes (175),acked-transitions (0),ack-required (1),action (2),action-text (3),active-text (4),active-vt-sessions (5),active-cov-subscriptions (152),adjust-value (176),alarm-value (6),alarm-values (7),all (8),all-writes-successful (9),apdu

26、-segment-timeout (10),apdu-timeout (11),application-software-version (12),firmware-revision (44),archive (13),attempted-samples (124),list-of-group-members (53),list-of-object-property-references (54),list-of-session-keys (55),local-date (56),local-time (57),location (58),maintenance-required (158),

27、manipulated-variable-reference (60),manual-slave-address-binding (170),maximum-output (61),maximum-value (135),maximum-value-timestamp (149),max-apdu-length-accepted (62),max-info-frames (63),max-master (64),max-pres-value (65),max-segments-accepted (167),member-of (159),minimum-off-time (66),minimu

28、m-on-time (67),minimum-output (68),event-state (36),model-name (70),number-of-apdu-retries (73),object-identifier (75),object-list (76),object-name (77),object-property-reference (78),object-type (79),operation-expected (161),optional (80),out-of-service (81),output-units (82),- see event-parameters

29、 (83),polarity (84),prescale (185),present-value (85),priority (86),pulse-rate (186),priority-array (87),priority-for-writing (88),protocol-object-types-supported (96),protocol-revision (139),protocol-services-supported (97),protocol-version (98),reliability (103),relinquish-default (104),schedule-d

30、efault (174),segmentation-supported (107),state-text (110),status-flags (111),stop-time (143),stop-when-full (144),system-status (112),tracking-value (164),units (117),variance-value (151),vendor-identifier (120),vendor-name (121),- see database-revision (155),上述標(biāo)記為紅色者既是本次應(yīng)用所用到的屬性對(duì)象bacnetobjectident

31、ifier的編碼分為兩個(gè)部分：object typeinstance number占用了10bits占用了22bitsobject type的表格如下：bacnetobjecttypessupported := bit string - accumulator (23),analog-input (0),analog-output (1),analog-value (2),- averaging (18),binary-input (3),binary-output (4),binary-value (5),calendar (6),command (7),device (8),event-e

32、nrollment (9),file (10),group (11),loop (12),multi-state-input (13),multi-state-output (14),- multi-state-value (19),notification-class (15),program (16),設(shè)備對(duì)象所具備的所有屬性及其數(shù)據(jù)結(jié)構(gòu)如下：device := sequence object-identifier 75 bacnetobjectidentifier,object-name 77 characterstring,object-type 79 bacnetobjecttype

33、,system-status 112 bacnetdevicestatus,vendor-name 121 characterstring,vendor-identifier 120 unsigned16,model-name 70 characterstring,firmware-revision 44 characterstring,application-software-version 12 characterstring,location 58 characterstring optional,description 28 characterstring optional,proto

34、col-version 98unsigned,protocol-revision 139unsigned,protocol-services-supported 97 bacnetservicessupported,protocol-object-types-supported 96 bacnetobjecttypessupported,object-list 76 sequence of bacnetobjectidentifier, - accessed as a bacnetarraymax-apdu-length-supported 62 unsigned,segmentation-s

35、upported 107 bacnetsegmentation,vt-classes-supported 122 sequence of bacnetvtclass optional,active-vt-sessions 5 sequence of bacnetvtsession optional,local-time 57 time optional,local-date 56 date optional,utc-offset 119 integer optional,daylight-savings-status 24 boolean optional,apdu-segment-timeo

36、ut 10 unsigned,apdu-timeout 11 unsigned,number-of-apdu-retries 73 unsigned,list-of-session-keys 55 sequence of bacnetsessionkey optional,time-synchronization-recipients 116 sequence of bacnetrecipient optional, - required for time mastermax-master 64 unsigned(1.127) optional, - required for ms/tp ma

37、ster, see 12.11max-info-frames 63 unsigned optional, - required for ms/tp master, see 12.11device-address-binding 30 sequence of bacnetaddressbinding,database-revision 155 unsigned,configuration-files 154 sequence of bacnetobjectidentifier,last-restore-time 157 bacnettimestamp,backup-failure-timeout

38、 153 unsigned16,active-cov-subscriptions 152 sequence of bacnetcovsubscription,max-segments-accepted 167 unsigned,slave-proxy-enable 172 sequence of boolean optional,auto-slave-discovery 169 sequence of boolean optional,slave-address-binding 171sequence of bacnetaddressbinding optional,manual-slave-

39、address-binding 170 sequence of bacnetaddressbinding optional,pro 168 characterstring optional上述標(biāo)記為紅色者既是本次應(yīng)用用到的設(shè)備屬性對(duì)象analog-input := sequence object-identifier 75 bacnetobjectidentifier,object-name 77 characterstring,object-type 79 bacnetobjecttype,present-value 85 real,description 28 characterstrin

40、g optional,device-type 31 characterstring optional,status-flags 111 bacnetstatusflags,event-state 36 bacneteventstate,reliability 103 bacnetreliability optional,out-of-service 81 boolean,update-interval 118 unsigned optional,units 117 bacnetengineeringunits,min-pres-value 69 real optional,max-pres-v

41、alue 65 real optional,resolution 106 real optional,cov-increment 22 real optional,time-delay 113 unsigned optional,notification-class 17 unsigned optional,high-limit 45 real optional,low-limit 59 real optional,deadband 25 real optional,limit-enable 52 bacnetlimitenable optional,event-enable 35 bacne

42、teventtransitionbits optional,acked-transitions 0 bacneteventtransitionbits optional,notify-type 72 bacnetnotifytype optional,event-time-stamps 130 sequence of bacnettimestamp optional,- accessed as a bacnetarraypro 168 characterstring optionalanalog-output := sequence object-identifier 75 bacnetobj

43、ectidentifier,object-name 77 characterstring,object-type 79 bacnetobjecttype,present-value 85 real,description 28 characterstring optional,device-type 31 characterstring optional,status-flags 111 bacnetstatusflags,event-state 36 bacneteventstate,reliability 103 bacnetreliability optional,out-of-serv

44、ice 81 boolean,units 117 bacnetengineeringunits,min-pres-value 69 real optional,max-pres-value 65 real optional,resolution 106 real optional,priority-array 87 bacnetpriorityarray,relinquish-default 104 real,cov-increment 22 real optional,time-delay 113 unsigned optional,notification-class 17 unsigne

45、d optional,high-limit 45 real optional,low-limit 59 real optional,deadband 25 real optional,limit-enable 52 bacnetlimitenable optional,event-enable 35 bacneteventtransitionbits optional,acked-transitions 0 bacneteventtransitionbits optional,notify-type 72 bacnetnotifytype optional,event-time-stamps

46、130 sequence of bacnettimestamp optional,- accessed as a bacnetarraypro 168 characterstring optionalanalog-value := sequence object-identifier 75 bacnetobjectidentifier,object-name 77 characterstring,object-type 79 bacnetobjecttype,present-value 85 real,description 28 characterstring optional,status

47、-flags 111 bacnetstatusflags,event-state 36 bacneteventstate,reliability 103 bacnetreliability optional,out-of-service 81 boolean,units 117 bacnetengineeringunits,priority-array 87 bacnetpriorityarray optional,relinquish-default 104 real optional,cov-increment 22 real optional,time-delay 113 unsigne

48、d optional,notification-class 17 unsigned optional,high-limit 45 real optional,low-limit 59 real optional,deadband 25 real optional,limit-enable 52 bacnetlimitenable optional,event-enable 35 bacneteventtransitionbits optional,acked-transitions 0 bacneteventtransitionbits optional,notify-type 72 bacn

49、etnotifytype optional,event-time-stamps 130 sequence of bacnettimestamp optional,- accessed as a bacnetarraypro 168 characterstring optionalbinary-input := sequence object-identifier 75 bacnetobjectidentifier,object-name 77 characterstring,object-type 79 bacnetobjecttype,present-value 85 bacnetbinar

50、ypv,description 28 characterstring optional,device-type 31 characterstring optional,status-flags 111 bacnetstatusflags,event-state 36 bacneteventstate,reliability 103 bacnetreliability optional,out-of-service 81 boolean,polarity 84 bacnetpolarity,inactive-text 46 characterstring optional,active-text

51、 4 characterstring optional,change-of-state-time 16 bacnetdatetime optional,change-of-state-count 15 unsigned optional,time-of-state-count-reset 115 bacnetdatetime optional,elapsed-active-time 33 unsigned32 optional,time-of-active-time-reset 114 bacnetdatetime optional,time-delay 113 unsigned optional,notification-class 17