BACnet通訊分析

1、BACnet通訊1、概述.系統(tǒng)實現(xiàn)基于BACnet/IP（又稱B/IP）網(wǎng)絡(luò)進行通訊。BACnet虛擬鏈路層（BVLL）提供了BACnet網(wǎng)絡(luò)層和某指定的通訊子系統(tǒng)的接口，本文指定了BACnet虛擬鏈路控制（BVLC）要求支持的定向和廣播信息。本實現(xiàn)關(guān)于BACnet協(xié)議定義主要可分為三層：B/IP網(wǎng)絡(luò)虛擬層，BACnet網(wǎng)絡(luò)層和BACnet應(yīng)用層。B/IP提供了TCP/IP一樣的通訊結(jié)構(gòu)，采用UDP的通訊方式。本文接下來將對此三層結(jié)構(gòu)進行詳細的講解。其文本協(xié)議的大致格式如下：BACnet/IPBACnet網(wǎng)絡(luò)層BACnet 應(yīng)用層BVLC TypeBVLC FunctionLengthNPDU

2、APDUNPDU：BACnet網(wǎng)絡(luò)層數(shù)據(jù)結(jié)構(gòu)，下文進行詳細的講解APDU：BACnet應(yīng)用層數(shù)據(jù)結(jié)構(gòu)，下文進行詳細的講解2、BACnet/IP.BVLC Type：0x81，代表BACnet/IP網(wǎng)絡(luò)BVLC Function：指定報文的類型，何種作用；本應(yīng)用使用的報文類型分為兩種：0A：點對點通訊0B：廣播通信Length：指定報文的長度，包括BVLC Type、BVLC Function以及本身在內(nèi)NPDU：根據(jù)不同情況，報文長短不同，見下文的解析。APDU：根據(jù)NPDU不同以及不同的請求，報文不同，見下文的解析。3、BACnet NPDU結(jié)構(gòu).版本信息1 ByteVersion控制字1

3、ByteControl目標網(wǎng)絡(luò)號2 BytesDNET目標網(wǎng)絡(luò)長度1 ByteDLEN目標地址可變長度DADR原網(wǎng)絡(luò)號2 BytesSNET原網(wǎng)絡(luò)長度1 ByteSLEN原地址可變SNET路由數(shù)目1 ByteHop Count消息類型1 ByteMessage Type賣方ID2 BytesVendor ID應(yīng)用層信息可變APDU版本信息：默認0x01控制字：BIT7：1表示Message Type存在，為0時Message Type不存在 BIT6：保留，為0 BIT5：1表示DNET DLEN Hop Count存在，當(dāng)DLEN為0時表明廣播網(wǎng)絡(luò)DADR不存在；0表示DNET DLEN D

4、ADR Hop Count不存在 BIT4：保留，為0 BIT3：1表示SNET SLEN存在，當(dāng)SLEN為0時表明無效SADR不存在；0表示SNET SLEN SADR Hop Count不存在 BIT2：1表示為一個需確認的請求數(shù)據(jù)單元，一復(fù)雜ACK數(shù)據(jù)單元或一網(wǎng)絡(luò)層信息非reply的；0表示除去上述情形的數(shù)據(jù)單元 BIT1、0：網(wǎng)絡(luò)優(yōu)先級11 = Life Safety message10 = Critical Equipment message01 = Urgent message00 = Normal message目標網(wǎng)絡(luò)號：FFFF的時候表示廣播目標長度： 表示DADR的長度目標

5、地址： 目標網(wǎng)絡(luò)MAC地址原網(wǎng)絡(luò)號： 同目標網(wǎng)絡(luò)號原網(wǎng)絡(luò)長度：表示SADR的長度原地址： 原網(wǎng)絡(luò)的MAC地址路由數(shù)目：數(shù)據(jù)需要經(jīng)過的路由個數(shù)，當(dāng)不存在DNET的時候，需設(shè)置為FF消息類型：X00: Who-Is-Router-To-NetworkX01: I-Am-Router-To-NetworkX02: I-Could-Be-Router-To-NetworkX03: Reject-Message-To-NetworkX04: Router-Busy-To-NetworkX05: Router-Available-To-NetworkX06: Initialize-Routing-Tabl

6、eX07: Initialize-Routing-Table-AckX08: Establish-Connection-To-NetworkX09: Disconnect-Connection-To-NetworkX0A to X7F: Reserved for use by ASHRAEX80 to XFF: Available for vendor proprietary messages賣方ID：當(dāng)控制字的BIT7為1并且消息類型為X80 to XFF:的時候，才會存在本次開發(fā)沒有用到，不再解釋本次應(yīng)用中控制字只用到0x20和0x04兩種，前者為廣播查詢設(shè)備，后者微點對對取設(shè)備數(shù)據(jù)或?qū)傩?/p>

7、。4、BACnet APDU結(jié)構(gòu)：（應(yīng)用層協(xié)議數(shù)據(jù)單元）BACnet網(wǎng)絡(luò)層數(shù)據(jù)主要分為一下幾種：BACnetPDU := CHOICE confirmed-request-PDU 0 BACnet-Confirmed-Request-PDU,unconfirmed-request-PDU 1 BACnet-Unconfirmed-Request-PDU,simpleACK-PDU 2 BACnet-SimpleACK-PDU,complexACK-PDU 3 BACnet-ComplexACK-PDU,segmentAck-PDU 4 BACnet-SegmentACK-PDU,error-P

8、DU 5 BACnet-Error-PDU,reject-PDU 6 BACnet-Reject-PDU,abort-PDU 7 BACnet-Abort-PDU對于本次應(yīng)用，主要用到了BACnet-Confirmed-Request-PDU（需確認的請求協(xié)議數(shù)據(jù)單元）BACnet-Unconfirmed-Request-PDU（無需確認的請求協(xié)議數(shù)據(jù)單元）BACnet-ComplexACK-PDU（復(fù)雜的ACK命令）BACnet-Error-PDU（報錯的協(xié)議數(shù)據(jù)單元）對于上述幾種數(shù)據(jù)的分類主要根據(jù)pdu type（下文進行講解）進行判定。4.1.BACnet-Confirmed-Reque

9、st-PDU的結(jié)構(gòu)：BACnet-Confirmed-Request-PDU := SEQUENCE pdu-type 0 Unsigned (0.15), - 0 for this PDU typesegmented-message 1 BOOLEAN,more-follows 2 BOOLEAN,segmented-response-accepted 3 BOOLEAN,reserved 4 Unsigned (0.3), - must be set to zeromax-segments-accepted 5 Unsigned (0.7), - as per 20.1.2.4max-AP

10、DU-length-accepted6 Unsigned (0.15), - as per 20.1.2.5invokeID 7 Unsigned (0.255),sequence-number 8 Unsigned (0.255) OPTIONAL, - only if segmented msgproposed-window-size 9 Unsigned (1.127) OPTIONAL, - only if segmented msgservice-choice 10 BACnetConfirmedServiceChoice,service-request 11 BACnet-Conf

11、irmed-Service-Request OPTIONALBIT7BIT6BIT5BIT4BIT3BIT2BIT1BIT0PDU TYPESEGMORSA00Max SegsMax RespInvoke IDSequence Number(only present by SEG=1)Proposed Window Size(only present by SEG=1)Service ChioceService RequestPDU Type 0 (BACnet-Confirmed-Service-Request-PDU)SEG 0(Unsegmented Request)1 (Segment

12、ed Request)MOR0 (No More Segments Follow)1 (More Segments Follow)SA0 (Segmented Response not accepted)1(Segmented Response accepted)Max Segs (0.7) (Number of response segments accepted per 20.1.2.4)Max Resp(0.15) (Size of Maximum APDU accepted per 20.1.2.5)Invoke ID (0.255)Sequence Number(0.255) Onl

13、y present if SEG = 1Proposed Window Size (1.127)Only present if SEG = 1Service ChoiceBACnetConfirmedServiceChoiceService RequestVariable EncodingSEG：指出當(dāng)前的數(shù)據(jù)單元是否為完整的還是為一部分分段信息MOR：指出是否還有更多的分段信息SA： 為1時指出將收到一個復(fù)雜的回應(yīng)（complex ack）Max Segs ：指出設(shè)備將要接收到多少分段信息B000 Unspecified number of segments accepted.B001 2

14、segments accepted.B010 4 segments accepted.B011 8 segments accepted.B100 16 segments accepted.B101 32 segments accepted.B110 64 segments accepted.B111 Greater than 64 segments accepted.Max Resp：指出將收到的（APDU）最大長度B0000 Up to MinimumMessageSize (50 octets)B0001 Up to 128 octetsB0010 Up to 206 octets (fi

15、ts in a LonTalk frame)B0011 Up to 480 octets (fits in an ARCNET frame)B0100 Up to 1024 octetsB0101 Up to 1476 octets (fits in an ISO 8802-3 frame)Invoke ID：調(diào)用者IDService Chioce：此處表明次報文的作用，詳見BACnetConfirmedServiceChoiceService Request：根據(jù)BACnetConfirmedServiceChoice不同而結(jié)構(gòu)不同，詳見BACnet-Confirmed-Service-Re

16、questBACnetConfirmedServiceChoice := 枚舉類型 - Alarm and Event ServicesacknowledgeAlarm (0),confirmedCOVNotification (1),confirmedEventNotification (2),getAlarmSummary (3),getEnrollmentSummary (4),getEventInformation (29),subscribeCOV (5),subscribeCOVProperty (28),lifeSafetyOperation (27),- Servicesato

17、micReadFile (6),atomicWriteFile (7),- Object Access ServicesaddListElement (8),removeListElement (9),createObject (10),deleteObject (11),readProperty (12),readPropertyConditional (13),readPropertyMultiple (14),readRange (26),writeProperty (15),writePropertyMultiple (16),。上述標記為紅色的表示本次應(yīng)用中所用到的，所以只對這些進行

18、講解?？梢愿鶕?jù)BACnetConfirmedServiceChoice找到相對應(yīng)的Request或者Ack的數(shù)據(jù)的結(jié)構(gòu)BACnet-Confirmed-Service-Request := CHOICE /對應(yīng)上面的Choice- Alarm and Event ServicesacknowledgeAlarm 0 AcknowledgeAlarm-Request,confirmedCOVNotification 1 ConfirmedCOVNotification-Request,confirmedEventNotification 2 ConfirmedEventNotification-

19、Request,- getAlarmSummary conveys no parametersgetEnrollmentSummary 4 GetEnrollmentSummary-Request,getEventInformation 29 GetEventInformation-Request,subscribeCOV 5 SubscribeCOV-Request,subscribeCOVProperty 28 SubscribeCOVProperty-Request,lifeSafetyOperation 27 LifeSafetyOperation-Request,- Services

20、atomicReadFile 6 AtomicRead,atomicWriteFile 7 AtomicWrite,- Object Access ServicesaddListElement 8 AddListElement-Request,removeListElement 9 RemoveListElement-Request,createObject 10 CreateObject-Request,deleteObject 11 DeleteObject-Request,readProperty 12 ReadProperty-Request,readPropertyCondition

21、al 13 ReadPropertyConditional-Request,readPropertyMultiple 14 ReadPropertyMultiple-Request,readRange 26 ReadRange-Request,writeProperty 15 WriteProperty-Request,writePropertyMultiple 16 WritePropertyMultiple-Request,。上述標記為紅色的既是針對BACnetConfirmedServiceChoice所用到的數(shù)據(jù)結(jié)構(gòu)。ReadProperty-Request := SEQUENCE /

22、讀數(shù)據(jù)請求和讀數(shù)據(jù)回答objectIdentifier 0 BACnetObjectIdentifier,propertyIdentifier 1 BACnetPropertyIdentifier,propertyArrayIndex 2 Unsigned OPTIONAL -used only with array datatypeReadPropertyMultiple-Request := SEQUENCE listOfReadAccessSpecs SEQUENCE OF ReadAccessSpecificationReadAccessSpecification := SEQUENC

23、E objectIdentifier 0 BACnetObjectIdentifier,listOfPropertyReferences 1 SEQUENCE OF BACnetPropertyReferenceBACnetPropertyReference := SEQUENCE propertyIdentifier 0 BACnetPropertyIdentifier,propertyArrayIndex 1 Unsigned OPTIONAL -used only with array datatype- if omitted with an array the entire array

24、 is referencedBACnetPropertyIdentifier := ENUMERATED accepted-modes (175),acked-transitions (0),ack-required (1),action (2),action-text (3),active-text (4),active-vt-sessions (5),active-cov-subscriptions (152),adjust-value (176),alarm-value (6),alarm-values (7),all (8),all-writes-successful (9),apdu

25、-segment-timeout (10),apdu-timeout (11),application-software-version (12),firmware-revision (44),archive (13),attempted-samples (124),list-of-group-members (53),list-of-object-property-references (54),list-of-session-keys (55),local-date (56),local-time (57),location (58),maintenance-required (158),

26、manipulated-variable-reference (60),manual-slave-address-binding (170),maximum-output (61),maximum-value (135),maximum-value-timestamp (149),max-apdu-length-accepted (62),max-info-frames (63),max-master (64),max-pres-value (65),max-segments-accepted (167),member-of (159),minimum-off-time (66),minimu

27、m-on-time (67),minimum-output (68),event-state (36),model-name (70),number-of-APDU-retries (73),object-identifier (75),object-list (76),object-name (77),object-property-reference (78),object-type (79),operation-expected (161),optional (80),out-of-service (81),output-units (82),- see event-parameters

28、 (83),polarity (84),prescale (185),present-value (85),priority (86),pulse-rate (186),priority-array (87),priority-for-writing (88),protocol-object-types-supported (96),protocol-revision (139),protocol-services-supported (97),protocol-version (98),reliability (103),relinquish-default (104),schedule-d

29、efault (174),segmentation-supported (107),state-text (110),status-flags (111),stop-time (143),stop-when-full (144),system-status (112),tracking-value (164),units (117),variance-value (151),vendor-identifier (120),vendor-name (121),- see database-revision (155),上述標記為紅色者既是本次應(yīng)用所用到的屬性對象BACnetObjectIdent

30、ifier的編碼分為兩個部分：Object typeInstance Number占用了10Bits占用了22BitsObject Type的表格如下：BACnetObjectTypesSupported := BIT STRING - accumulator (23),analog-input (0),analog-output (1),analog-value (2),- averaging (18),binary-input (3),binary-output (4),binary-value (5),calendar (6),command (7),device (8),event-e

31、nrollment (9),file (10),group (11),loop (12),multi-state-input (13),multi-state-output (14),- multi-state-value (19),notification-class (15),program (16),設(shè)備對象所具備的所有屬性及其數(shù)據(jù)結(jié)構(gòu)如下：DEVICE := SEQUENCE object-identifier 75 BACnetObjectIdentifier,object-name 77 CharacterString,object-type 79 BACnetObjectType

32、,system-status 112 BACnetDeviceStatus,vendor-name 121 CharacterString,vendor-identifier 120 Unsigned16,model-name 70 CharacterString,firmware-revision 44 CharacterString,application-software-version 12 CharacterString,location 58 CharacterString OPTIONAL,description 28 CharacterString OPTIONAL,proto

33、col-version 98Unsigned,protocol-revision 139Unsigned,protocol-services-supported 97 BACnetServicesSupported,protocol-object-types-supported 96 BACnetObjectTypesSupported,object-list 76 SEQUENCE OF BACnetObjectIdentifier, - accessed as a BACnetARRAYmax-APDU-length-supported 62 Unsigned,segmentation-s

34、upported 107 BACnetSegmentation,vt-classes-supported 122 SEQUENCE OF BACnetVTClass OPTIONAL,active-vt-sessions 5 SEQUENCE OF BACnetVTSession OPTIONAL,local-time 57 Time OPTIONAL,local-date 56 Date OPTIONAL,utc-offset 119 INTEGER OPTIONAL,daylight-savings-status 24 BOOLEAN OPTIONAL,apdu-segment-timeo

35、ut 10 Unsigned,apdu-timeout 11 Unsigned,number-of-APDU-retries 73 Unsigned,list-of-session-keys 55 SEQUENCE OF BACnetSessionKey OPTIONAL,time-synchronization-recipients 116 SEQUENCE OF BACnetRecipient OPTIONAL, - required for time mastermax-master 64 Unsigned(1.127) OPTIONAL, - required for MS/TP ma

36、ster, see 12.11max-info-frames 63 Unsigned OPTIONAL, - required for MS/TP master, see 12.11device-address-binding 30 SEQUENCE OF BACnetAddressBinding,database-revision 155 Unsigned,configuration-files 154 SEQUENCE OF BACnetObjectIdentifier,last-restore-time 157 BACnetTimeStamp,backup-failure-timeout

37、 153 Unsigned16,active-cov-subscriptions 152 SEQUENCE OF BACnetCOVSubscription,max-segments-accepted 167 Unsigned,slave-proxy-enable 172 SEQUENCE OF BOOLEAN OPTIONAL,auto-slave-discovery 169 SEQUENCE OF BOOLEAN OPTIONAL,slave-address-binding 171SEQUENCE OF BACnetAddressBinding OPTIONAL,manual-slave-

38、address-binding 170 SEQUENCE OF BACnetAddressBinding OPTIONAL,pro 168 CharacterString OPTIONAL上述標記為紅色者既是本次應(yīng)用用到的設(shè)備屬性對象ANALOG-INPUT := SEQUENCE object-identifier 75 BACnetObjectIdentifier,object-name 77 CharacterString,object-type 79 BACnetObjectType,present-value 85 REAL,description 28 CharacterStrin

39、g OPTIONAL,device-type 31 CharacterString OPTIONAL,status-flags 111 BACnetStatusFlags,event-state 36 BACnetEventState,reliability 103 BACnetReliability OPTIONAL,out-of-service 81 BOOLEAN,update-interval 118 Unsigned OPTIONAL,units 117 BACnetEngineeringUnits,min-pres-value 69 REAL OPTIONAL,max-pres-v

40、alue 65 REAL OPTIONAL,resolution 106 REAL OPTIONAL,cov-increment 22 REAL OPTIONAL,time-delay 113 Unsigned OPTIONAL,notification-class 17 Unsigned OPTIONAL,high-limit 45 REAL OPTIONAL,low-limit 59 REAL OPTIONAL,deadband 25 REAL OPTIONAL,limit-enable 52 BACnetLimitEnable OPTIONAL,event-enable 35 BACne

41、tEventTransitionBits OPTIONAL,acked-transitions 0 BACnetEventTransitionBits OPTIONAL,notify-type 72 BACnetNotifyType OPTIONAL,event-time-stamps 130 SEQUENCE OF BACnetTimeStamp OPTIONAL,- accessed as a BACnetARRAYpro 168 CharacterString OPTIONALANALOG-OUTPUT := SEQUENCE object-identifier 75 BACnetObj

42、ectIdentifier,object-name 77 CharacterString,object-type 79 BACnetObjectType,present-value 85 REAL,description 28 CharacterString OPTIONAL,device-type 31 CharacterString OPTIONAL,status-flags 111 BACnetStatusFlags,event-state 36 BACnetEventState,reliability 103 BACnetReliability OPTIONAL,out-of-serv

43、ice 81 BOOLEAN,units 117 BACnetEngineeringUnits,min-pres-value 69 REAL OPTIONAL,max-pres-value 65 REAL OPTIONAL,resolution 106 REAL OPTIONAL,priority-array 87 BACnetPriorityArray,relinquish-default 104 REAL,cov-increment 22 REAL OPTIONAL,time-delay 113 Unsigned OPTIONAL,notification-class 17 Unsigne

44、d OPTIONAL,high-limit 45 REAL OPTIONAL,low-limit 59 REAL OPTIONAL,deadband 25 REAL OPTIONAL,limit-enable 52 BACnetLimitEnable OPTIONAL,event-enable 35 BACnetEventTransitionBits OPTIONAL,acked-transitions 0 BACnetEventTransitionBits OPTIONAL,notify-type 72 BACnetNotifyType OPTIONAL,event-time-stamps

45、130 SEQUENCE OF BACnetTimeStamp OPTIONAL,- accessed as a BACnetARRAYpro 168 CharacterString OPTIONALANALOG-VALUE := SEQUENCE object-identifier 75 BACnetObjectIdentifier,object-name 77 CharacterString,object-type 79 BACnetObjectType,present-value 85 REAL,description 28 CharacterString OPTIONAL,status

46、-flags 111 BACnetStatusFlags,event-state 36 BACnetEventState,reliability 103 BACnetReliability OPTIONAL,out-of-service 81 BOOLEAN,units 117 BACnetEngineeringUnits,priority-array 87 BACnetPriorityArray OPTIONAL,relinquish-default 104 REAL OPTIONAL,cov-increment 22 REAL OPTIONAL,time-delay 113 Unsigne

47、d OPTIONAL,notification-class 17 Unsigned OPTIONAL,high-limit 45 REAL OPTIONAL,low-limit 59 REAL OPTIONAL,deadband 25 REAL OPTIONAL,limit-enable 52 BACnetLimitEnable OPTIONAL,event-enable 35 BACnetEventTransitionBits OPTIONAL,acked-transitions 0 BACnetEventTransitionBits OPTIONAL,notify-type 72 BACn

48、etNotifyType OPTIONAL,event-time-stamps 130 SEQUENCE OF BACnetTimeStamp OPTIONAL,- accessed as a BACnetARRAYpro 168 CharacterString OPTIONALBINARY-INPUT := SEQUENCE object-identifier 75 BACnetObjectIdentifier,object-name 77 CharacterString,object-type 79 BACnetObjectType,present-value 85 BACnetBinar

49、yPV,description 28 CharacterString OPTIONAL,device-type 31 CharacterString OPTIONAL,status-flags 111 BACnetStatusFlags,event-state 36 BACnetEventState,reliability 103 BACnetReliability OPTIONAL,out-of-service 81 BOOLEAN,polarity 84 BACnetPolarity,inactive-text 46 CharacterString OPTIONAL,active-text

50、 4 CharacterString OPTIONAL,change-of-state-time 16 BACnetDateTime OPTIONAL,change-of-state-count 15 Unsigned OPTIONAL,time-of-state-count-reset 115 BACnetDateTime OPTIONAL,elapsed-active-time 33 Unsigned32 OPTIONAL,time-of-active-time-reset 114 BACnetDateTime OPTIONAL,time-delay 113 Unsigned OPTIONAL,notification-class 17 Unsigned OPTIONAL,alarm-value