BACnet通讯分析.docx

1、BACnet通讯分析BACnet通讯1、概述.系统实现基于BACnet/IP（又称B/IP）网络进行通讯。BACnet虚拟链路层（BVLL）提供了BACnet网络层和某指定的通讯子系统的接口，本文指定了BACnet虚拟链路控制（BVLC）要求支持的定向和广播信息。本实现关于BACnet协议定义主要可分为三层：B/IP网络虚拟层，BACnet网络层和BACnet应用层。B/IP提供了TCP/IP一样的通讯结构，采用UDP的通讯方式。本文接下来将对此三层结构进行详细的讲解。其文本协议的大致格式如下：BACnet/IPBACnet网络层BACnet 应用层BVLC TypeBVLC Function

2、LengthNPDUAPDUNPDU：BACnet网络层数据结构，下文进行详细的讲解APDU：BACnet应用层数据结构，下文进行详细的讲解2、BACnet/IP. BVLC Type： 0x81，代表BACnet/IP网络 BVLC Function： 指定报文的类型，何种作用；本应用使用的报文类型分为两种： 0A：点对点通讯0B：广播通信 Length： 指定报文的长度，包括BVLC Type、BVLC Function以及本身在内 NPDU： 根据不同情况，报文长短不同，见下文的解析。 APDU： 根据NPDU不同以及不同的请求，报文不同，见下文的解析。 3、BACnet NPDU结构.

3、版本信息1 ByteVersion控制字1 ByteControl目标网络号2 BytesDNET目标网络长度1 ByteDLEN目标地址可变长度DADR原网络号2 BytesSNET原网络长度1 ByteSLEN原地址可变SNET路由数目1 ByteHop Count消息类型1 ByteMessage Type卖方ID2 BytesVendor ID应用层信息可变APDU版本信息 ：默认0x01控制字 ：BIT7：1表示Message Type存在，为0时Message Type不存在 BIT6：保留，为0 BIT5：1表示DNET DLEN Hop Count存在，当DLEN为0时表明广播

4、网络DADR不存在；0表示DNET DLEN DADR Hop Count不存在 BIT4：保留，为0 BIT3：1表示SNET SLEN存在，当SLEN为0时表明无效SADR不存在；0表示SNET SLEN SADR Hop Count不存在 BIT2：1表示为一个需确认的请求数据单元，一复杂ACK数据单元或一网络层信息非reply的；0表示除去上述情形的数据单元 BIT1、0：网络优先级 11 = Life Safety message10 = Critical Equipment message01 = Urgent message00 = Normal message目标网络号：FFF

5、F的时候表示广播目标长度： 表示DADR的长度目标地址： 目标网络MAC地址原网络号： 同目标网络号原网络长度：表示SADR的长度原地址： 原网络的MAC地址路由数目： 数据需要经过的路由个数，当不存在DNET的时候，需设置为FF消息类型： X00: Who-Is-Router-To-NetworkX01: I-Am-Router-To-NetworkX02: I-Could-Be-Router-To-NetworkX03: Reject-Message-To-NetworkX04: Router-Busy-To-NetworkX05: Router-Available-To-NetworkX

6、06: Initialize-Routing-TableX07: Initialize-Routing-Table-AckX08: Establish-Connection-To-NetworkX09: Disconnect-Connection-To-NetworkX0A to X7F: Reserved for use by ASHRAEX80 to XFF: Available for vendor proprietary messages卖方ID： 当控制字的BIT7为1并且消息类型为X80 to XFF:的时候，才会存在 本次开发没有用到，不再解释本次应用中控制字只用到0x20和0x

7、04两种，前者为广播查询设备，后者微点对对取设备数据或属性。4、BACnet APDU结构：（应用层协议数据单元）BACnet网络层数据主要分为一下几种：BACnetPDU := CHOICE confirmed-request-PDU 0 BACnet-Confirmed-Request-PDU,unconfirmed-request-PDU 1 BACnet-Unconfirmed-Request-PDU,simpleACK-PDU 2 BACnet-SimpleACK-PDU,complexACK-PDU 3 BACnet-ComplexACK-PDU,segmentAck-PDU 4

8、BACnet-SegmentACK-PDU,error-PDU 5 BACnet-Error-PDU,reject-PDU 6 BACnet-Reject-PDU,abort-PDU 7 BACnet-Abort-PDU对于本次应用，主要用到了BACnet-Confirmed-Request-PDU（需确认的请求协议数据单元）BACnet-Unconfirmed-Request-PDU（无需确认的请求协议数据单元）BACnet-ComplexACK-PDU（复杂的ACK命令）BACnet-Error-PDU（报错的协议数据单元）对于上述几种数据的分类主要根据pdu type（下文进行讲解）进行

9、判定。4.1. BACnet-Confirmed-Request-PDU的结构：BACnet-Confirmed-Request-PDU := SEQUENCE pdu-type 0 Unsigned (0.15), - 0 for this PDU typesegmented-message 1 BOOLEAN,more-follows 2 BOOLEAN,segmented-response-accepted 3 BOOLEAN,reserved 4 Unsigned (0.3), - must be set to zeromax-segments-accepted 5 Unsigned

10、(0.7), - as per 20.1.2.4max-APDU-length-accepted 6 Unsigned (0.15), - as per 20.1.2.5invokeID 7 Unsigned (0.255),sequence-number 8 Unsigned (0.255) OPTIONAL, - only if segmented msgproposed-window-size 9 Unsigned (1.127) OPTIONAL, - only if segmented msgservice-choice 10 BACnetConfirmedServiceChoice

11、,service-request 11 BACnet-Confirmed-Service-Request OPTIONALBIT7BIT6BIT5BIT4BIT3BIT2BIT1BIT0PDU TYPESEGMORSA00Max SegsMax RespInvoke IDSequence Number(only present by SEG=1)Proposed Window Size(only present by SEG=1)Service ChioceService RequestPDU Type 0 (BACnet-Confirmed-Service-Request-PDU)SEG 0

12、 (Unsegmented Request)1 (Segmented Request)MOR 0 (No More Segments Follow)1 (More Segments Follow)SA 0 (Segmented Response not accepted)1 (Segmented Response accepted)Max Segs (0.7) (Number of response segments accepted per 20.1.2.4)Max Resp (0.15) (Size of Maximum APDU accepted per 20.1.2.5)Invoke

13、ID (0.255)Sequence Number (0.255) Only present if SEG = 1Proposed Window Size (1.127) Only present if SEG = 1Service Choice BACnetConfirmedServiceChoiceService Request Variable EncodingSEG：指出当前的数据单元是否为完整的还是为一部分分段信息MOR：指出是否还有更多的分段信息SA： 为1时指出将收到一个复杂的回应（complex ack）Max Segs ：指出设备将要接收到多少分段信息 B000 Unspec

14、ified number of segments accepted.B001 2 segments accepted.B010 4 segments accepted.B011 8 segments accepted.B100 16 segments accepted.B101 32 segments accepted.B110 64 segments accepted.B111 Greater than 64 segments accepted.Max Resp：指出将收到的（APDU）最大长度 B0000 Up to MinimumMessageSize (50 octets)B0001

15、Up to 128 octetsB0010 Up to 206 octets (fits in a LonTalk frame)B0011 Up to 480 octets (fits in an ARCNET frame)B0100 Up to 1024 octetsB0101 Up to 1476 octets (fits in an ISO 8802-3 frame)Invoke ID：调用者IDService Chioce：此处表明次报文的作用，详见BACnetConfirmedServiceChoiceService Request：根据BACnetConfirmedServiceC

16、hoice不同而结构不同，详见BACnet-Confirmed-Service-RequestBACnetConfirmedServiceChoice := 枚举类型 - Alarm and Event ServicesacknowledgeAlarm (0),confirmedCOVNotification (1),confirmedEventNotification (2),getAlarmSummary (3),getEnrollmentSummary (4),getEventInformation (29),subscribeCOV (5),subscribeCOVProperty (

17、28),lifeSafetyOperation (27),- File Access ServicesatomicReadFile (6),atomicWriteFile (7),- Object Access ServicesaddListElement (8),removeListElement (9),createObject (10),deleteObject (11),readProperty (12),readPropertyConditional (13),readPropertyMultiple (14),readRange (26),writeProperty (15),wr

18、itePropertyMultiple (16),。上述标记为红色的表示本次应用中所用到的，所以只对这些进行讲解。可以根据BACnetConfirmedServiceChoice找到相对应的Request或者Ack的数据的结构BACnet-Confirmed-Service-Request := CHOICE /对应上面的Choice- Alarm and Event ServicesacknowledgeAlarm 0 AcknowledgeAlarm-Request,confirmedCOVNotification 1 ConfirmedCOVNotification-Request,co

19、nfirmedEventNotification 2 ConfirmedEventNotification-Request,- getAlarmSummary conveys no parametersgetEnrollmentSummary 4 GetEnrollmentSummary-Request,getEventInformation 29 GetEventInformation-Request,subscribeCOV 5 SubscribeCOV-Request,subscribeCOVProperty 28 SubscribeCOVProperty-Request,lifeSaf

20、etyOperation 27 LifeSafetyOperation-Request,- File Access ServicesatomicReadFile 6 AtomicReadFile-Request,atomicWriteFile 7 AtomicWriteFile-Request,- Object Access ServicesaddListElement 8 AddListElement-Request,removeListElement 9 RemoveListElement-Request,createObject 10 CreateObject-Request,delet

21、eObject 11 DeleteObject-Request,readProperty 12 ReadProperty-Request,readPropertyConditional 13 ReadPropertyConditional-Request,readPropertyMultiple 14 ReadPropertyMultiple-Request,readRange 26 ReadRange-Request,writeProperty 15 WriteProperty-Request,writePropertyMultiple 16 WritePropertyMultiple-Re

22、quest,。上述标记为红色的既是针对BACnetConfirmedServiceChoice所用到的数据结构。ReadProperty-Request := SEQUENCE /读数据请求和读数据回答objectIdentifier 0 BACnetObjectIdentifier,propertyIdentifier 1 BACnetPropertyIdentifier,propertyArrayIndex 2 Unsigned OPTIONAL -used only with array datatypeReadPropertyMultiple-Request := SEQUENCE l

23、istOfReadAccessSpecs SEQUENCE OF ReadAccessSpecificationReadAccessSpecification := SEQUENCE objectIdentifier 0 BACnetObjectIdentifier,listOfPropertyReferences 1 SEQUENCE OF BACnetPropertyReferenceBACnetPropertyReference := SEQUENCE propertyIdentifier 0 BACnetPropertyIdentifier,propertyArrayIndex 1 U

24、nsigned OPTIONAL -used only with array datatype- if omitted with an array the entire array is referencedBACnetPropertyIdentifier := ENUMERATED accepted-modes (175),acked-transitions (0),ack-required (1),action (2),action-text (3),active-text (4),active-vt-sessions (5),active-cov-subscriptions (152),

25、adjust-value (176),alarm-value (6),alarm-values (7),all (8),all-writes-successful (9),apdu-segment-timeout (10),apdu-timeout (11),application-software-version (12),firmware-revision (44),archive (13),attempted-samples (124),list-of-group-members (53),list-of-object-property-references (54),list-of-s

26、ession-keys (55),local-date (56),local-time (57),location (58),maintenance-required (158),manipulated-variable-reference (60),manual-slave-address-binding (170),maximum-output (61),maximum-value (135),maximum-value-timestamp (149),max-apdu-length-accepted (62),max-info-frames (63),max-master (64),ma

27、x-pres-value (65),max-segments-accepted (167),member-of (159),minimum-off-time (66),minimum-on-time (67),minimum-output (68),event-state (36),model-name (70),number-of-APDU-retries (73),object-identifier (75),object-list (76),object-name (77),object-property-reference (78),object-type (79),operation

28、-expected (161),optional (80),out-of-service (81),output-units (82),- see event-parameters (83),polarity (84),prescale (185),present-value (85),priority (86),pulse-rate (186),priority-array (87),priority-for-writing (88),protocol-object-types-supported (96),protocol-revision (139),protocol-services-supported (97),pro