BACnet通讯分析

来源：意榕旅游网

BACnet通讯

1、概述.

系统实现基于BACnet/IP（又称B/IP）网络进行通讯。BACnet虚拟链路层（BVLL）提供了BACnet网络层和某指定的通讯子系统的接口，本文指定了BACnet虚拟链路控制（BVLC）要求支持的定向和广播信息。本实现关于BACnet协议定义主要可分为三层：B/IP网络虚拟层，BACnet网络层和BACnet应用层。B/IP提供了TCP/IP一样的通讯结构，采用UDP的通讯方式。本文接下来将对此三层结构进行详细的讲解。

其文本协议的大致格式如下： BACnet/IP BVLC Type BVLC Function Length BACnet网络层 NPDU BACnet 应用层 APDU NPDU：BACnet网络层数据结构，下文进行详细的讲解 APDU：BACnet应用层数据结构，下文进行详细的讲解

2、BACnet/IP.

BVLC Type： 0x81，代表BACnet/IP网络

BVLC Function：指定报文的类型，何种作用；本应用使用的报文类型分为两种： 0A：点对点通讯

0B：广播通信 Length： NPDU： APDU：

指定报文的长度，包括BVLC Type、BVLC Function以及本身在内根据不同情况，报文长短不同，见下文的解析。

根据NPDU不同以及不同的请求，报文不同，见下文的解析。

3、BACnet NPDU结构.

版本信息控制字目标网络号目标网络长度目标地址原网络号原网络长度原地址路由数目消息类型卖方ID 应用层信息版本信息控制字

1 Byte 1 Byte 2 Bytes 1 Byte 可变长度 2 Bytes 1 Byte 可变 1 Byte 1 Byte 2 Bytes 可变 Version Control DNET DLEN DADR SNET SLEN SNET Hop Count Message Type Vendor ID APDU ：默认0x01 ：BIT7：1表示Message Type存在，为0时Message Type不存在

叮叮小文库

BIT6：保留，为0

BIT5：1表示DNET DLEN Hop Count存在，当DLEN为0时表明广播网络

DADR不存在；0表示DNET DLEN DADR Hop Count不存在

BIT4：保留，为0

BIT3：1表示SNET SLEN存在，当SLEN为0时表明无效SADR不存在；

0表示SNET SLEN SADR Hop Count不存在

BIT2：1表示为一个需确认的请求数据单元，一复杂ACK数据单元或一网络层

信息非reply的；0表示除去上述情形的数据单元

BIT1、0：网络优先级

11 = Life Safety message

10 = Critical Equipment message 01 = Urgent message 00 = Normal message

目标网络号：FFFF的时候表示广播目标长度：表示DADR的长度目标地址：目标网络MAC地址原网络号：同目标网络号原网络长度：表示SADR的长度原地址：原网络的MAC地址路由数目：消息类型：

数据需要经过的路由个数，当不存在DNET的时候，需设置为FF

X'00': Who-Is-Router-To-Network X'01': I-Am-Router-To-Network

X'02': I-Could-Be-Router-To-Network X'03': Reject-Message-To-Network X'04': Router-Busy-To-Network X'05': Router-Available-To-Network X'06': Initialize-Routing-Table X'07': Initialize-Routing-Table-Ack

X'08': Establish-Connection-To-Network X'09': Disconnect-Connection-To-Network X'0A' to X'7F': Reserved for use by ASHRAE

X'80' to X'FF': Available for vendor proprietary messages

当控制字的BIT7为1并且消息类型为X'80' to X'FF':的时候，才会存在本次开发没有用到，不再解释

卖方ID：

本次应用中控制字只用到0x20和0x04两种，前者为广播查询设备，后者微点对对取设备数据或属性。

4、BACnet APDU结构：（应用层协议数据单元）

BACnet网络层数据主要分为一下几种： BACnetPDU ::= CHOICE {

confirmed-request-PDU [0] BACnet-Confirmed-Request-PDU,

叮叮小文库

unconfirmed-request-PDU simpleACK-PDU complexACK-PDU segmentAck-PDU error-PDU reject-PDU abort-PDU [1] BACnet-Unconfirmed-Request-PDU,

[2] BACnet-SimpleACK-PDU, [3] BACnet-ComplexACK-PDU, [4] BACnet-SegmentACK-PDU, [5] BACnet-Error-PDU, [6] BACnet-Reject-PDU, [7] BACnet-Abort-PDU

}

对于本次应用，主要用到了

BACnet-Confirmed-Request-PDU（需确认的请求协议数据单元） BACnet-Unconfirmed-Request-PDU（无需确认的请求协议数据单元） BACnet-ComplexACK-PDU（复杂的ACK命令） BACnet-Error-PDU（报错的协议数据单元）

对于上述几种数据的分类主要根据pdu type（下文进行讲解）进行判定。

4.1. BACnet-Confirmed-Request-PDU的结构：

BACnet-Confirmed-Request-PDU ::= SEQUENCE {

pdu-type [0] Unsigned (0..15), -- 0 for this PDU type segmented-message [1] BOOLEAN, more-follows [2] BOOLEAN, segmented-response-accepted [3] BOOLEAN, reserved [4] Unsigned (0..3), -- must be set to zero max-segments-accepted [5] Unsigned (0..7), -- as per 20.1.2.4 max-APDU-length-accepted [6] Unsigned (0..15), -- as per 20.1.2.5 invokeID [7] Unsigned (0..255), sequence-number [8] Unsigned (0..255) OPTIONAL, -- only if segmented msg proposed-window-size [9] Unsigned (1..127) OPTIONAL, -- only if segmented msg service-choice [10] BACnetConfirmedServiceChoice, service-request [11] BACnet-Confirmed-Service-Request OPTIONAL } BIT7 0 BIT6 BIT5 Max Segs Invoke ID Sequence Number(only present by SEG==1) Proposed Window Size(only present by SEG==1) BIT4 BIT3 SEG BIT2 MOR BIT1 SA BIT0 0 PDU TYPE Max Resp Service Chioce Service Request…… PDU Type SEG

0 0 1

(BACnet-Confirmed-Service-Request-PDU) (Unsegmented Request) (Segmented Request)

叮叮小文库

MOR

0 (No More Segments Follow) 1 (More Segments Follow)

SA 0 (Segmented Response not accepted)

1 (Segmented Response accepted)

Max Segs (0..7) (Number of response segments accepted per 20.1.2.4) Max Resp (0..15) (Size of Maximum APDU accepted per 20.1.2.5)

Invoke ID (0..255) Sequence Number (0..255) Only present if SEG = 1 Proposed Window Size (1..127) Only present if SEG = 1 Service Choice BACnetConfirmedServiceChoice Service Request Variable Encoding

SEG：指出当前的数据单元是否为完整的还是为一部分分段信息 MOR：指出是否还有更多的分段信息

SA：为1时指出将收到一个复杂的回应（complex ack） Max Segs ：指出设备将要接收到多少分段信息 B'000' Unspecified number of segments accepted.

B'001' 2 segments accepted. B'010' 4 segments accepted. B'011' 8 segments accepted. B'100' 16 segments accepted. B'101' 32 segments accepted. B'110' 64 segments accepted.

B'111' Greater than 64 segments accepted.

Max Resp：指出将收到的（APDU）最大长度 B'0000' Up to MinimumMessageSize (50 octets)

B'0001' Up to 128 octets

B'0010' Up to 206 octets (fits in a LonTalk frame) B'0011' Up to 480 octets (fits in an ARCNET frame) B'0100' Up to 1024 octets

B'0101' Up to 1476 octets (fits in an ISO 8802-3 frame)

Invoke ID：调用者ID

Service Chioce：此处表明次报文的作用，详见BACnetConfirmedServiceChoice Service Request：根据BACnetConfirmedServiceChoice不同而结构不同，详见

BACnet-Confirmed-Service-Request

BACnetConfirmedServiceChoice ::= 枚举类型 {

-- Alarm and Event Services

acknowledgeAlarm (0), confirmedCOVNotification (1), confirmedEventNotification (2), getAlarmSummary (3), getEnrollmentSummary (4),

叮叮小文库

getEventInformation (29), subscribeCOV (5), subscribeCOVProperty (28), lifeSafetyOperation (27),

-- File Access Services

atomicReadFile (6), atomicWriteFile (7),

-- Object Access Services

addListElement (8), removeListElement (9), createObject (10), deleteObject (11), readProperty (12), readPropertyConditional (13), readPropertyMultiple (14), readRange (26), writeProperty (15), writePropertyMultiple (16), 。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。

}

上述标记为红色的表示本次应用中所用到的，所以只对这些进行讲解。

可以根据BACnetConfirmedServiceChoice找到相对应的Request或者Ack的数据的结构BACnet-Confirmed-Service-Request ::= CHOICE //对应上面的Choice {

-- Alarm and Event Services

acknowledgeAlarm [0] AcknowledgeAlarm-Request, confirmedCOVNotification [1] ConfirmedCOVNotification-Request, confirmedEventNotification [2] ConfirmedEventNotification-Request,

-- getAlarmSummary conveys no parameters

getEnrollmentSummary [4] GetEnrollmentSummary-Request, getEventInformation [29] GetEventInformation-Request, subscribeCOV [5] SubscribeCOV-Request, subscribeCOVProperty [28] SubscribeCOVProperty-Request, lifeSafetyOperation [27] LifeSafetyOperation-Request,

-- File Access Services

atomicReadFile [6] AtomicReadFile-Request, atomicWriteFile [7] AtomicWriteFile-Request,

-- Object Access Services

addListElement [8] AddListElement-Request,

叮叮小文库

removeListElement [9] RemoveListElement-Request, createObject [10] CreateObject-Request, deleteObject [11] DeleteObject-Request, readProperty [12] ReadProperty-Request, readPropertyConditional [13] ReadPropertyConditional-Request, readPropertyMultiple [14] ReadPropertyMultiple-Request, readRange [26] ReadRange-Request, writeProperty [15] WriteProperty-Request, writePropertyMultiple [16] WritePropertyMultiple-Request, 。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。

}

上述标记为红色的既是针对BACnetConfirmedServiceChoice所用到的数据结构。

ReadProperty-Request ::= SEQUENCE //读数据请求和读数据回答 {

objectIdentifier [0] BACnetObjectIdentifier, propertyIdentifier [1] BACnetPropertyIdentifier,

propertyArrayIndex [2] Unsigned OPTIONAL --used only with array datatype }

ReadPropertyMultiple-Request ::= SEQUENCE {

listOfReadAccessSpecs SEQUENCE OF ReadAccessSpecification }

ReadAccessSpecification ::= SEQUENCE {

objectIdentifier [0] BACnetObjectIdentifier,

listOfPropertyReferences [1] SEQUENCE OF BACnetPropertyReference }

BACnetPropertyReference ::= SEQUENCE {

propertyIdentifier [0] BACnetPropertyIdentifier,

propertyArrayIndex [1] Unsigned OPTIONAL --used only with array datatype

-- if omitted with an array the entire array is referenced

}

BACnetPropertyIdentifier ::= ENUMERATED {

accepted-modes (175), acked-transitions (0), ack-required (1), action (2),

action-text (3), active-text (4), active-vt-sessions (5), active-cov-subscriptions (152), adjust-value (176), alarm-value (6), alarm-values (7), all (8), all-writes-successful (9), apdu-segment-timeout (10), apdu-timeout (11), application-software-version (12), firmware-revision (44), archive (13), attempted-samples (124), list-of-group-members (53), list-of-object-property-references (54), list-of-session-keys (55), local-date (56), local-time (57), location (58), maintenance-required (158), manipulated-variable-reference (60), manual-slave-address-binding (170), maximum-output (61), maximum-value (135), maximum-value-timestamp (149), max-apdu-length-accepted (62), max-info-frames (63), max-master (64), max-pres-value (65), max-segments-accepted (167), member-of (159), minimum-off-time (66), minimum-on-time (67), minimum-output (68), event-state (36), model-name (70), number-of-APDU-retries (73), object-identifier (75), object-list (76), object-name (77), object-property-reference (78), object-type (79),

叮叮小文库

operation-expected optional out-of-service output-units -- see event-parameters polarity prescale present-value priority pulse-rate priority-array priority-for-writing protocol-object-types-supported protocol-revision protocol-services-supported protocol-version reliability relinquish-default schedule-default segmentation-supported state-text status-flags stop-time stop-when-full system-status tracking-value units variance-value vendor-identifier vendor-name -- see database-revision

(161), (80), (81), (82), (83), (84), (185), (85), (86), (186), (87), (88), (96), (139), (97), (98), (103), (104), (174), (107), (110), (111), (143), (144), (112), (164), (117), (151), (120), (121), (155),

}

上述标记为红色者既是本次应用所用到的属性对象

BACnetObjectIdentifier的编码分为两个部分： Object type 占用了10Bits Object Type的表格如下： BACnetObjectTypesSupported ::= BIT STRING {

-- accumulator (23), analog-input (0), analog-output (1), analog-value (2),

Instance Number 占用了22Bits 叮叮小文库

-- averaging (18),

binary-input (3), binary-output (4), binary-value (5), calendar (6), command (7), device (8), event-enrollment (9), file (10), group (11), loop (12), multi-state-input (13), multi-state-output (14), -- multi-state-value (19), notification-class (15), program (16),

}

设备对象所具备的所有属性及其数据结构如下： DEVICE ::= SEQUENCE {

object-identifier [75] BACnetObjectIdentifier, object-name [77] CharacterString, object-type [79] BACnetObjectType, system-status [112] BACnetDeviceStatus, vendor-name [121] CharacterString, vendor-identifier [120] Unsigned16, model-name [70] CharacterString, firmware-revision [44] CharacterString, application-software-version [12] CharacterString, location [58] CharacterString OPTIONAL, description [28] CharacterString OPTIONAL, protocol-version [98]Unsigned, protocol-revision [139]Unsigned, protocol-services-supported [97] BACnetServicesSupported, protocol-object-types-supported [96] BACnetObjectTypesSupported, object-list [76] SEQUENCE OF BACnetObjectIdentifier,

-- accessed as a BACnetARRAY

max-APDU-length-supported [62] Unsigned, segmentation-supported [107] BACnetSegmentation, vt-classes-supported [122] SEQUENCE OF BACnetVTClass OPTIONAL, active-vt-sessions [5] SEQUENCE OF BACnetVTSession OPTIONAL, local-time [57] Time OPTIONAL, local-date [56] Date OPTIONAL, utc-offset [119] INTEGER OPTIONAL,

叮叮小文库

daylight-savings-status apdu-segment-timeout apdu-timeout number-of-APDU-retries list-of-session-keys time-synchronization-recipients

[24] BOOLEAN OPTIONAL, [10] Unsigned, [11] Unsigned, [73] Unsigned,

[55] SEQUENCE OF BACnetSessionKey OPTIONAL, [116] SEQUENCE OF BACnetRecipient OPTIONAL,

-- required for time master

max-master [64] Unsigned(1..127) OPTIONAL,

-- required for MS/TP master, see 12.11

max-info-frames [63] Unsigned OPTIONAL,

-- required for MS/TP master, see 12.11

device-address-binding [30] SEQUENCE OF BACnetAddressBinding, database-revision [155] Unsigned, configuration-files [154] SEQUENCE OF BACnetObjectIdentifier, last-restore-time [157] BACnetTimeStamp, backup-failure-timeout [153] Unsigned16, active-cov-subscriptions [152] SEQUENCE OF BACnetCOVSubscription, max-segments-accepted [167] Unsigned, slave-proxy-enable [172] SEQUENCE OF BOOLEAN OPTIONAL, auto-slave-discovery [169] SEQUENCE OF BOOLEAN OPTIONAL, slave-address-binding [171]SEQUENCE OF BACnetAddressBinding OPTIONAL, manual-slave-address-binding [170] SEQUENCE OF BACnetAddressBinding OPTIONAL, profile-name [168] CharacterString OPTIONAL }

上述标记为红色者既是本次应用用到的设备属性对象

ANALOG-INPUT ::= SEQUENCE {

叮叮小文库

time-delay [113] Unsigned OPTIONAL, notification-class [17] Unsigned OPTIONAL, high-limit [45] REAL OPTIONAL, low-limit [59] REAL OPTIONAL, deadband [25] REAL OPTIONAL,

limit-enable [52] BACnetLimitEnable OPTIONAL,

event-enable [35] BACnetEventTransitionBits OPTIONAL, acked-transitions [0] BACnetEventTransitionBits OPTIONAL, notify-type [72] BACnetNotifyType OPTIONAL,

event-time-stamps [130] SEQUENCE OF BACnetTimeStamp OPTIONAL,

-- accessed as a BACnetARRAY profile-name

[168] CharacterString OPTIONAL

}

ANALOG-OUTPUT ::= SEQUENCE {

object-identifier [75] BACnetObjectIdentifier, object-name [77] CharacterString, object-type [79] BACnetObjectType, present-value [85] REAL, description [28] CharacterString OPTIONAL, device-type [31] CharacterString OPTIONAL, status-flags [111] BACnetStatusFlags, event-state [36] BACnetEventState, reliability [103] BACnetReliability OPTIONAL, out-of-service [81] BOOLEAN, units [117] BACnetEngineeringUnits, min-pres-value [69] REAL OPTIONAL, max-pres-value [65] REAL OPTIONAL, resolution [106] REAL OPTIONAL, priority-array [87] BACnetPriorityArray, relinquish-default [104] REAL, cov-increment [22] REAL OPTIONAL, time-delay [113] Unsigned OPTIONAL, notification-class [17] Unsigned OPTIONAL, high-limit [45] REAL OPTIONAL, low-limit [59] REAL OPTIONAL, deadband [25] REAL OPTIONAL, limit-enable [52] BACnetLimitEnable OPTIONAL, event-enable [35] BACnetEventTransitionBits OPTIONAL, acked-transitions [0] BACnetEventTransitionBits OPTIONAL, notify-type [72] BACnetNotifyType OPTIONAL, event-time-stamps [130] SEQUENCE OF BACnetTimeStamp OPTIONAL,

-- accessed as a BACnetARRAY

profile-name [168] CharacterString OPTIONAL

}

ANALOG-VALUE ::= SEQUENCE {

object-identifier [75] BACnetObjectIdentifier, object-name [77] CharacterString, object-type [79] BACnetObjectType, present-value [85] REAL, description [28] CharacterString OPTIONAL, status-flags [111] BACnetStatusFlags, event-state [36] BACnetEventState, reliability [103] BACnetReliability OPTIONAL, out-of-service [81] BOOLEAN, units [117] BACnetEngineeringUnits, priority-array [87] BACnetPriorityArray OPTIONAL, relinquish-default [104] REAL OPTIONAL, cov-increment [22] REAL OPTIONAL, time-delay [113] Unsigned OPTIONAL, notification-class [17] Unsigned OPTIONAL, high-limit [45] REAL OPTIONAL, low-limit [59] REAL OPTIONAL, deadband [25] REAL OPTIONAL, limit-enable [52] BACnetLimitEnable OPTIONAL, event-enable [35] BACnetEventTransitionBits OPTIONAL, acked-transitions [0] BACnetEventTransitionBits OPTIONAL, notify-type [72] BACnetNotifyType OPTIONAL,

event-time-stamps [130] SEQUENCE OF BACnetTimeStamp OPTIONAL,

-- accessed as a BACnetARRAY

profile-name [168] CharacterString OPTIONAL }

BINARY-INPUT ::= SEQUENCE {

object-identifier [75] BACnetObjectIdentifier, object-name [77] CharacterString, object-type [79] BACnetObjectType, present-value [85] BACnetBinaryPV, description [28] CharacterString OPTIONAL, device-type [31] CharacterString OPTIONAL, status-flags [111] BACnetStatusFlags, event-state [36] BACnetEventState, reliability [103] BACnetReliability OPTIONAL, out-of-service [81] BOOLEAN, polarity [84] BACnetPolarity, inactive-text [46] CharacterString OPTIONAL,

叮叮小文库

active-text [4] CharacterString OPTIONAL,

change-of-state-time [16] BACnetDateTime OPTIONAL, change-of-state-count [15] Unsigned OPTIONAL,

time-of-state-count-reset [115] BACnetDateTime OPTIONAL, elapsed-active-time [33] Unsigned32 OPTIONAL,

time-of-active-time-reset [114] BACnetDateTime OPTIONAL, time-delay [113] Unsigned OPTIONAL, notification-class [17] Unsigned OPTIONAL,

alarm-value [6] BACnetBinaryPV OPTIONAL,

event-enable [35] BACnetEventTransitionBits OPTIONAL, acked-transitions [0] BACnetEventTransitionBits OPTIONAL, notify-type [72] BACnetNotifyType OPTIONAL,

event-time-stamps [130] SEQUENCE OF BACnetTimeStamp OPTIONAL,

-- accessed as a BACnetARRAY profile-name

[168] CharacterString OPTIONAL

}

BINARY-OUTPUT ::= SEQUENCE {

object-identifier [75] BACnetObjectIdentifier, object-name [77] CharacterString, object-type [79] BACnetObjectType, present-value [85] BACnetBinaryPV, description [28] CharacterString OPTIONAL, device-type [31] CharacterString OPTIONAL, status-flags [111]BACnetStatusFlags, event-state [36] BACnetEventState, reliability [103]BACnetReliability OPTIONAL, out-of-service [81] BOOLEAN, polarity [84] BACnetPolarity, inactive-text [46] CharacterString OPTIONAL, active-text [4] CharacterString OPTIONAL, change-of-state-time [16] BACnetDateTime OPTIONAL, change-of-state-count [15] Unsigned OPTIONAL,

time-of-state-count-reset [115] BACnetDateTime OPTIONAL, elapsed-active-time [33] Unsigned32 OPTIONAL,

叮叮小文库

acked-transitions [0] BACnetEventTransitionBits OPTIONAL, notify-type [72] BACnetNotifyType OPTIONAL,

event-time-stamps [130] SEQUENCE OF BACnetTimeStamp OPTIONAL,

-- accessed as a BACnetARRAY profile-name

[168] CharacterString OPTIONAL

}

BINARY-VALUE ::= SEQUENCE {

object-identifier [75] BACnetObjectIdentifier, object-name [77] CharacterString, object-type [79] BACnetObjectType, present-value [85] BACnetBinaryPV, description [28] CharacterString OPTIONAL, status-flags [111] BACnetStatusFlags, event-state [36] BACnetEventState, reliability [103] BACnetReliability OPTIONAL, out-of-service [81] BOOLEAN, inactive-text [46] CharacterString OPTIONAL, active-text [4] CharacterString OPTIONAL, change-of-state-time [16] BACnetDateTime OPTIONAL, change-of-state-count [15] Unsigned OPTIONAL,

time-of-state-count-reset [115] BACnetDateTime OPTIONAL, elapsed-active-time [33] Unsigned32 OPTIONAL,

time-of-active-time-reset [114] BACnetDateTime OPTIONAL, minimum-off-time [66] Unsigned32 OPTIONAL, minimum-on-time [67] Unsigned32 OPTIONAL, priority-array [87] BACnetPriorityArray OPTIONAL, relinquish-default [104] BACnetBinaryPV OPTIONAL, time-delay [113] Unsigned OPTIONAL, notification-class [17] Unsigned OPTIONAL, alarm-value [6] BACnetBinaryPV OPTIONAL, event-enable [35] BACnetEventTransitionBits OPTIONAL, acked-transitions [0] BACnetEventTransitionBits OPTIONAL, notify-type [72] BACnetNotifyType OPTIONAL, event-time-stamps [130] SEQUENCE OF BACnetTimeStamp OPTIONAL,

-- accessed as a BACnetARRAY

profile-name [168] CharacterString OPTIONAL }

MULTI-STATE-INPUT ::= SEQUENCE {

object-identifier [75] BACnetObjectIdentifier, object-name [77] CharacterString, object-type [79] BACnetObjectType,

叮叮小文库

present-value description device-type status-flags event-state reliability out-of-service number-of-states state-text

time-delay notification-class alarm-values fault-values event-enable acked-transitions notify-type event-time-stamps profile-name

[85]Unsigned,

--maximum value is restricted by the number-of-states [28] CharacterString OPTIONAL, [31] CharacterString OPTIONAL, [111] BACnetStatusFlags, [36] BACnetEventState,

[103] BACnetReliability OPTIONAL, [81] BOOLEAN, [74] Unsigned,

[110] SEQUENCE OF CharacterString OPTIONAL,

-- accessed as a BACnetARRAY [113] Unsigned OPTIONAL, [17] Unsigned OPTIONAL,

[7] SEQUENCE OF Unsigned OPTIONAL, [39] SEQUENCE OF Unsigned OPTIONAL, [35] BACnetEventTransitionBits OPTIONAL, [0] BACnetEventTransitionBits OPTIONAL, [72] BACnetNotifyType OPTIONAL,

[130] SEQUENCE OF BACnetTimeStamp OPTIONAL,

-- accessed as a BACnetARRAY [168] CharacterString OPTIONAL

}

MULTI-STATE-OUTPUT ::= SEQUENCE {

object-identifier [75] BACnetObjectIdentifier, object-name [77] CharacterString, object-type [79] BACnetObjectType, present-value [85] Unsigned,

-- maximum value is restricted by the number-of-states

description [28] CharacterString OPTIONAL, device-type [31] CharacterString OPTIONAL, status-flags [111] BACnetStatusFlags, event-state [36] BACnetEventState, reliability [103] BACnetReliability OPTIONAL, out-of-service [81] BOOLEAN, number-of-states [74] Unsigned, state-text [110] SEQUENCE OF CharacterString OPTIONAL,

-- accessed as a BACnetARRAY

priority-array [87] BACnetPriorityArray, relinquish-default [104] Unsigned, time-delay [113] Unsigned OPTIONAL, notification-class [17] Unsigned OPTIONAL, feedback-value [40] Unsigned OPTIONAL, event-enable [35] BACnetEventTransitionBits OPTIONAL,

叮叮小文库

acked-transitions [0] BACnetEventTransitionBits OPTIONAL, notify-type [72] BACnetNotifyType OPTIONAL,

event-time-stamps [130] SEQUENCE OF BACnetTimeStamp OPTIONAL,

-- accessed as a BACnetARRAY profile-name

[168] CharacterString OPTIONAL

}

MULTI-STATE-VALUE ::= SEQUENCE {

object-identifier [75] BACnetObjectIdentifier, object-name [77] CharacterString, object-type [79] BACnetObjectType, present-value [85] Unsigned,

-- maximum value is restricted by the number-of-states

description [28] CharacterString OPTIONAL, status-flags [111] BACnetStatusFlags, event-state [36] BACnetEventState, reliability [103] BACnetReliability OPTIONAL, out-of-service [81] BOOLEAN, number-of-states [74] Unsigned, state-text [110] SEQUENCE OF CharacterString OPTIONAL,

-- accessed as a BACnetARRAY

priority-array [87] BACnetPriorityArray OPTIONAL, relinquish-default [104] Unsigned OPTIONAL, time-delay [113] Unsigned OPTIONAL, notification-class [17] Unsigned OPTIONAL, alarm-values [7] SEQUENCE OF Unsigned OPTIONAL, fault-values [39] SEQUENCE OF Unsigned OPTIONAL, event-enable [35] BACnetEventTransitionBits OPTIONAL, acked-transitions [0] BACnetEventTransitionBits OPTIONAL, notify-type [72] BACnetNotifyType OPTIONAL,

event-time-stamps [130] SEQUENCE OF BACnetTimeStamp OPTIONAL,

--accessed as a BACnetARRAY

profile-name [168] CharacterString OPTIONAL }

BACnetObjectType ::= ENUMERATED {

accumulator (23), analog-input (0), analog-output (1), analog-value (2), averaging (18), binary-input (3), binary-output (4),

叮叮小文库

binary-value (5), calendar (6), command (7), device (8), event-enrollment (9), file (10), group (11), life-safety-point (21), life-safety-zone (22), loop (12), multi-state-input (13), multi-state-output (14), multi-state-value (19), notification-class (15), program (16), pulse-converter (24), schedule (17), -- see averaging (18), -- see multi-state-value (19), trend-log (20), -- see life-safety-point (21), -- see life-safety-zone (22), -- see accumulator (23), -- see pulse-converter (24),

}

上述标记为红色者即为本次应用所用到的对象类型 BACnetAddressBinding ::= SEQUENCE {

deviceObjectIdentifier BACnetObjectIdentifier, deviceAddress BACnetAddress }

BACnetAddress ::= SEQUENCE {

network-number Unsigned16, -- A value of 0 indicates the local network mac-address OCTET STRING -- A string of length 0 indicates a broadcast }

priority-array的类型结构解释：

BACnetPriorityArray ::= SEQUENCE SIZE (16) OF BACnetPriorityValue

-- accessed as a BACnetARRAY

BACnetPriorityValue ::= CHOICE {

null NULL, real REAL,

binary BACnetBinaryPV, integer Unsigned,

constructedValue [0] ABSTRACT-SYNTAX.&Type }

relinquish-default的结构

BACnetBinaryPV ::= ENUMERATED {

inactive (0), active (1) }

status-flags的类型结构：

BACnetStatusFlags ::= BIT STRING {

in-alarm (0), fault (1), overridden (2), out-of-service (3)

}

Reliability的类型结构：

BACnetReliability ::= ENUMERATED {

no-fault-detected (0), no-sensor (1), over-range (2), under-range (3), open-loop (4), shorted-loop (5), no-output (6), unreliable-other (7), process-error (8), multi-state-fault (9), configuration-error (10), }

system-status的类型结构：

BACnetDeviceStatus ::= ENUMERATED {

operational (0), operational-read-only (1), download-required (2), download-in-progress (3), non-operational (4), backup-in-progress (5), }

叮叮小文库

Units的解释说明如下：

BACnetEngineeringUnits ::= ENUMERATED {

--Electrical

milliamperes (2), amperes (3),

amperes-per-meter (167),

amperes-per-square-meter (168), ampere-square-meters (169), farads (170), henrys (171), ohms (4),

ohm-meters (172), milliohms (145), kilohms (122), megohms (123),

siemens (173), -- 1 mho equals 1 siemens siemens-per-meter (174), teslas (175), volts (5),

millivolts (124), kilovolts (6), megavolts (7), volt-amperes (8), kilovolt-amperes (9), megavolt-amperes (10), volt-amperes-reactive (11), kilovolt-amperes-reactive (12), megavolt-amperes-reactive (13), volts-per-degree-Kelvin (176), volts-per-meter (177), degrees-phase (14), power-factor (15), webers (178), --Energy

joules (16), kilojoules (17),

kilojoules-per-kilogram (125), megajoules (126), watt-hours (18), kilowatt-hours (19), megawatt-hours (146), btus (20),

kilo-btus (147),

叮叮小文库

mega-btus (148), therms (21), ton-hours (22), --Frequency

cycles-per-hour (25), cycles-per-minute (26), hertz (27),

kilohertz (129), megahertz (130), per-hour (131), --Power

milliwatts (132), watts (47), kilowatts (48), megawatts (49), btus-per-hour (50),

kilo-btus-per-hour (157), horsepower (51),

tons-refrigeration (52), --Temperature

degrees-Celsius (62), degrees-Kelvin (63),

degrees-Kelvin-per-hour (181), degrees-Kelvin-per-minute (182), degrees-Fahrenheit (64), degree-days-Celsius (65), degree-days-Fahrenheit (66), delta-degrees-Fahrenheit (120), delta-degrees-Kelvin (121), --Time

years (67), months (68), weeks (69), days (70), hours (71), minutes (72), seconds (73),

hundredths-seconds (158), milliseconds (159), --Other

degrees-angular (90),

degrees-Celsius-per-hour (91), degrees-Celsius-per-minute (92), degrees-Fahrenheit-per-hour (93),

叮叮小文库

degrees-Fahrenheit-per-minute (94), joule-seconds (183),

kilograms-per-cubic-meter (186),

kilowatt-hours-per-square-meter (137), kilowatt-hours-per-square-foot (138), megajoules-per-square-meter (139), megajoules-per-square-foot (140), no-units (95),

newton-seconds (187), newtons-per-meter (188), parts-per-million (96), parts-per-billion (97), percent (98),

percent-obscuration-per-foot (143), percent-obscuration-per-meter (144), percent-per-second (99), per-minute (100), per-second (101),

psi-per-degree-Fahrenheit (102), radians (103),

radians-per-second (184), revolutions-per-minute (104), square-meters-per-Newton (185),

watts-per-meter-per-degree-Kelvin (189), watts-per-square-meter-degree-kelvin (141) }

event-state的结构如下：

BACnetEventState ::= ENUMERATED {

normal (0), fault (1), offnormal (2), high-limit (3), low-limit (4), life-safety-alarm (5), }

protocol-services-supported的结构如下： BACnetServicesSupported ::= BIT STRING {

-- Alarm and Event Services

acknowledgeAlarm (0), confirmedCOVNotification (1), confirmedEventNotification (2), getAlarmSummary (3),

叮叮小文库

getEnrollmentSummary (4), -- getEventInformation (39), subscribeCOV (5), -- subscribeCOVProperty (38), -- lifeSafetyOperation (37), -- File Access Services

atomicReadFile (6), atomicWriteFile (7), -- Object Access Services

addListElement (8), removeListElement (9), createObject (10), deleteObject (11), readProperty (12), readPropertyConditional (13), readPropertyMultiple (14), -- readRange (35), writeProperty (15), writePropertyMultiple (16), -- Remote Device Management Services

deviceCommunicationControl (17), confirmedPrivateTransfer (18), confirmedTextMessage (19), reinitializeDevice (20), -- Virtual Terminal Services

vtOpen (21), vtClose (22), vtData (23), -- Security Services

authenticate (24), requestKey (25), -- Unconfirmed Services

i-Am (26), i-Have (27), unconfirmedCOVNotification (28), unconfirmedEventNotification (29), unconfirmedPrivateTransfer (30), unconfirmedTextMessage (31), timeSynchronization (32), -- utcTimeSynchronization (36), who-Has (33), who-Is (34), }

叮叮小文库

BACnetSegmentation ::= ENUMERATED {

segmented-both (0), segmented-transmit (1), segmented-receive (2), no-segmentation (3) }

4.2. BACnet-Unconfirmed-Request-PDU结构：

BACnet-Unconfirmed-Request-PDU ::= SEQUENCE {

pdu-type [0] Unsigned (0..15), -- 1 for this PDU type reserved [1] Unsigned (0..15), -- must be set to zero service-choice [2] BACnetUnconfirmedServiceChoice, service-request [3] BACnet-Unconfirmed-Service-Request } BIT7 BIT6 BIT5 BIT4 BIT3 BIT2 BIT1 BIT0 PDU TYPE Service Chioce Service Request

PDU TYPE ：1

Service Chioce：详见BACnetUnconfirmedServiceChoice

Service Request：根据BACnetConfirmedServiceChoice不同而结构不同，详见

BACnet-Unconfirmed-Service-Request

其它同上

BACnetUnconfirmedServiceChoice ::= ENUMERATED {

i-Am (0), i-Have (1), unconfirmedCOVNotification (2), unconfirmedEventNotification (3), unconfirmedPrivateTransfer (4), unconfirmedTextMessage (5), timeSynchronization (6), who-Has (7), who-Is (8), utcTimeSynchronization (9) }

BACnet-Unconfirmed-Service-Request ::= CHOICE {

Reserved 叮叮小文库

i-Am i-Have unconfirmedCOVNotification unconfirmedEventNotification unconfirmedPrivateTransfer unconfirmedTextMessage timeSynchronization who-Has who-Is utcTimeSynchronization

}

[0]I-Am-Request, [1] I-Have-Request,

[2] UnconfirmedCOVNotification-Request, [3] UnconfirmedEventNotification-Request, [4] UnconfirmedPrivateTransfer-Request, [5] UnconfirmedTextMessage-Request, [6] TimeSynchronization-Request, [7] Who-Has-Request, [8] Who-Is-Request,

[9] UTCTimeSynchronization-Request

I-Am-Request ::= SEQUENCE {

iAmDeviceIdentifier BACnetObjectIdentifier, maxAPDULengthAccepted Unsigned, segmentationSupported BACnetSegmentation, vendorID Unsigned }

Who-Is-Request ::= SEQUENCE

deviceInstanceRangeLowLimit [0] Unsigned (0..4194303) OPTIONAL deviceInstanceRangeHighLimit [1] Unsigned (0..4194303) OPTIONAL }

deviceInstanceRangeLowLimit：下限（3 octor） deviceInstanceRangeHighLimit：上限（3 octor）

4.3. BACnet-ComplexACK-PDU结构：

BACnet-ComplexACK-PDU ::= SEQUENCE {

pdu-type [0] Unsigned (0..15), -- 3 for this PDU type segmented-message [1] BOOLEAN, more-follows [2] BOOLEAN, reserved [3] Unsigned (0..3), -- must be set to zero invokeID [4] Unsigned (0..255), sequence-number [5] Unsigned (0..255) OPTIONAL, --only if segment proposed-window-size [6] Unsigned (1..127) OPTIONAL, -- only if segment service-ACK-choice [7] BACnetConfirmedServiceChoice, service-ACK [8] BACnet-Confirmed-Service-ACK } BIT7 BIT6 BIT5 BIT4 BIT3 SEG BIT2 MOR BIT1 0 24

BIT0 PDU TYPE -

叮叮小文库

Original Invoke ID Sequence Number(only present by SEG==1) Proposed Window Size(only present by SEG==1) Service Ack Chioce Service ACK PDU TYPE ：1

Service Ack Chioce：详见BACnetConfirmedServiceChoice

Service ACK：根据BACnetConfirmedServiceChoice不同而结构不同，详见

BACnet-Confirmed-Service-ACK

其它同上

BACnet-Confirmed-Service-ACK ::= CHOICE {

-- Alarm and Event Services

getAlarmSummary [3] GetAlarmSummary-ACK, getEnrollmentSummary [4] GetEnrollmentSummary-ACK, getEventInformation [29] GetEventInformation-ACK, -- File Access Services

atomicReadFile [6] AtomicReadFile-ACK, atomicWriteFile [7] AtomicWriteFile-ACK, -- Object Access Services

createObject [10] CreateObject-ACK, readProperty [12] ReadProperty-ACK, readPropertyConditional [13] ReadPropertyConditional-ACK, readPropertyMultiple [14] ReadPropertyMultiple-ACK, readRange [26] ReadRange-ACK, -- Remote Device Management Services

confirmedPrivateTransfer [18] ConfirmedPrivateTransfer-ACK,

-- Virtual Terminal Services

vtOpen [21] VT-Open-ACK, vtData [23] VT-Data-ACK, -- Security Services

authenticate [24] Authenticate-ACK

}

ReadProperty-ACK ::= SEQUENCE {

objectIdentifier [0] BACnetObjectIdentifier, propertyIdentifier [1] BACnetPropertyIdentifier, propertyArrayIndex [2] Unsigned OPTIONAL, --used only with array datatype propertyValue [3] ABSTRACT-SYNTAX.&Type }

ReadPropertyMultiple-ACK ::= SEQUENCE {

叮叮小文库

listOfReadAccessResult SEQUENCE OF ReadAccessResult

}

ReadAccessResult ::= SEQUENCE {

objectIdentifier [0] BACnetObjectIdentifier, listOfResults [1] SEQUENCE OF SEQUENCE {

propertyIdentifier [2] BACnetPropertyIdentifier, propertyArrayIndex [3] Unsigned OPTIONAL readResult CHOICE {

propertyValue [4] ABSTRACT-SYNTAX.&Type, propertyAccessError [5] Error }

} OPTIONAL }

4.4. BACnet-Error-PDU结构：

BACnet-Error-PDU ::= SEQUENCE {

pdu-type [0] Unsigned (0..15), -- 5 for this PDU type reserved [1] Unsigned (0..15), -- must be set to zero original-invokeID [2] Unsigned (0..255), error-choice [3] BACnetConfirmedServiceChoice, error [4] BACnet-Error } BIT7 BIT6 BIT5 BIT4 BIT3 BIT2 0 Original Invoke ID Error Choice Error 。。。。 PDU TYPE：5

Original Invoke ID：调用者ID

Error Chioce：详见BACnetConfirmedServiceChioce

Error：根据Error Chioce不同而不同，详见BACnet-Error

BACnet-Error ::= CHOICE {

other [127] Error, -- Alarm and Event Services

acknowledgeAlarm [0] Error,

BIT1 BIT0 PDU TYPE confirmedCOVNotification [1] Error, confirmedEventNotification [2] Error, getAlarmSummary [3] Error, 。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。 -- Object Access Services

addListElement [8] ChangeList-Error, removeListElement [9] ChangeList-Error, createObject [10] CreateObject-Error, deleteObject [11] Error, readProperty [12] Error, readPropertyConditional [13] Error, readPropertyMultiple [14] Error, readRange [26] Error, writeProperty [15] Error, writePropertyMultiple [16] WritePropertyMultiple-Error, -- Remote Device Management Services

deviceCommunicationControl [17] Error, confirmedPrivateTransfer [18] ConfirmedPrivateTransfer-Error, confirmedTextMessage [19] Error, 。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。 }

Error ::= SEQUENCE {

error-class ENUMERATED {

device (0), object (1), property (2), resources (3), security (4), services (5), vt (6), },

error-code ENUMERATED {

other (0), authentication-failed (1), character-set-not-supported (41), invalid-array-index (42), invalid-configuration-data (46), invalid-data-type (9), unknown-property (32),

} }

叮叮小文库

5、BACnet APDU可变部分的编码

这部分的数据编码通常分为两个部分：数据类型描述部分和数据部分。描述部分主要描述接下来的数据是什么类型，如何编码，所占长度等信息；关于这部分需要详细的说明如下：

首先描述部分含有一个Tags，主要分为两类：应用Tag和上下文Tag，前者的结构如下： BIT7---BIT4 Tag number Bit3 Class Bit2—Bit0 Length/Value/Type Tag number: 指出了数据的类型（0-14只占据4位数据，当高四位置为‘1111’时表示接

下来的一个字节作为Tag的描述）

Class： 0时表示数据位应用数据类型，1表示上下文数据类型；此种情况下Tag Number

为上下文Tag

Length/Value/Type：当（0-4）时表示数据的长度，当为’101’时表示后边的octor代表数据的长度.如果为’110’表示为一个opening tag,那么必然需要一个closeing

Tag( ‘111’) Application tags: 0: NULL 1: Boolean 2: unsigned integer 3: signed interger 4: Real(ASNSI/IEEE-754) 5： Double（ANSI/IEEE-754 double precision floating point） 6： octor string 7： Character string 8： Bit string 9： Enumerated 10：Date 11：Time 12：BACnetObjectIdentifier

Context-special tags：含有一个context tag 如其位于结构中的第一个context tag则

为1，第二个context tag则为2

Example: Application-tagged null value

ASN.1 = NULL

Application Tag = Null (Tag Number = 0) Encoded Tag = X'00'

Example: Application-tagged Boolean value（Boolean 编码在一个字节中）

ASN.1 = BOOLEAN Value = FALSE

Application Tag = Boolean (Tag Number = 1) Encoded Tag = X'10'

Example: Context-tagged Boolean value（上下文Boolean的编码）

ASN.1 = [2] BOOLEAN Value = TRUE Context Tag = 2 Encoded Tag = X'29' Encoded Data = X'01'

Example: Application-tagged unsigned integer

ASN.1 = Unsigned Value = 72

Application Tag = Unsigned Integer (Tag Number = 2) Encoded Tag = X'21' Encoded Data = X'48'

Example: Application-tagged signed integer ASN.1 = INTEGER Value = 72

Application Tag = Signed Integer (Tag Number = 3) Encoded Tag = X'31' Encoded Data = X'48'

Example: Application-tagged single precision real

ASN.1 = REAL Value = 72.0

Application Tag = Real (Tag Number = 4) Encoded Tag = X'44'

Encoded Data = X'42900000'

Example: Application-tagged double precision real（双精度占用8字节）ASN.1 = Double Value = 72.0

Application Tag = Double (Tag Number = 5) Encoded Tag = X'55' Extended Length = X'08'

Encoded Data = X'4052000000000000'

Example: Application-tagged octet string

ASN.1 = OCTET STRING Value = X'1234FF'

Application Tag = Octet String (Tag Number = 6) Encoded Tag = X'63'

Encoded Data = X'1234FF'

叮叮小文库

The initial octet shall specify the character set with the following encoding:

X'00' ANSI X3.4

X'01' IBM™/Microsoft™ DBCS X'02' JIS C 6226

X'03' ISO 10646 (UCS-4) X'04' ISO 10646 (UCS-2) X'05' ISO 8859-1

Example: Application-tagged character string ASN.1 = CharacterString

Value = \"This is a BACnet string!\" (ANSI X3.4)

Application Tag = Character String (Tag Number = 7) Encoded Tag = X'75' Length Extension = X'19'

Character Set = X'00' (ANSI X3.4)

Encoded Data = X'546869732069732061204241436E657420737472696E6721'

Example: Application-tagged character string (DBCS) ASN.1 = CharacterString

Value = \"This is a BACnet String!\" (IBM/Microsoft DBCS, code page 850) Application Tag = Character String (Tag Number = 7) Encoded Tag = X'75'

Length Extension = X'1B' Encoded Data = X'010352546869732069732061204241436E657420737472696E6721' 不再举例，本程序使用(ANSI X3.4)类型的字符串编码

Example: Application-tagged bit string

ASN.1 = BIT STRING Value = B'10101'

Application Tag = Bit String (Tag Number = 8) Encoded Tag = X'82' Encoded Data = X'03A8'

Example: Application-tagged enumeration

ASN.1 = BACnetObjectType Value = ANALOG-INPUT (0)

Application Tag = Enumerated (Tag Number = 9) Encoded Tag = X '91' Encoded Data = X '00'

Example: Application-tagged date value

ASN.1 = Date

Value = January 24, 1991 (Day of week = Thursday)

Application Tag = Date (Tag Number = 10) Encoded Tag = X'A4'

Encoded Data = X'5B011804'

Example: Application-tagged time value

ASN.1 = Time

Value = 5:35:45.17 P.M. = 17:35:45.17 Application Tag = Time (Tag Number = 11) Encoded Tag = X'B4'

Encoded Data = X'11232D11'

Example: Application-tagged object identifier value

ASN.1 = ObjectIdentifier Value = (Binary Input, 15)

Application Tag = ObjectIdentifier (Tag Number = 12) Encoded Tag = X'C4'

Encoded Data = X'00C0000F'

Context-special tags： Example: Context-tagged null value

ASN.1 = [3] NULL Context Tag = 3 Encoded Tag = X'38'

Example: Context-tagged Boolean value ASN.1 = [6] BOOLEAN Value = FALSE Context Tag = 6 Encoded Tag = X'69' Encoded Data = X'00'

Example: Context-tagged unsigned integer ASN.1 = [0] Unsigned Value = 256 Context Tag = 0

Encoded Tag = X'0A' Encoded Data = X'0100'

Example: Context-tagged signed integer

ASN.1 = [5] INTEGER Value = -72 Context Tag = 5 Encoded Tag = X'59' Encoded Data = X'B8'

Example: Context-tagged single precision real

ASN.1 = [0] REAL

叮叮小文库

Value = -33.3 Context Tag = 0

Encoded Tag = X'0C'

Encoded Data = X'C2053333'

Example: Context-tagged double precision real

ASN.1 = [1] Double Value = -33.3 Context Tag = 1

Encoded Tag = X'1D' Extended Length = X'08'

Encoded Data = X'C040A66666666666' Example: Context-tagged octet string

ASN.1 = [1] OctetString Value = X'4321' Context Tag = 1

Encoded Tag = X'1A' Encoded Data = X'4321'

Example: Context-tagged character string

ASN.1 = [5] CharacterString

Value = \"This is a BACnet string!\" (ANSI X3.4) Context Tag = 5

Encoded Tag = X'5D' Length Extension = X'19'

Character Set = X'00' (ANSI X3.4)

Encoded Data = X'546869732069732061204241

436E657420737472696E6721'

Example: Context-tagged bit string

ASN.1 = [0] BIT STRING Value = B'10101' Context Tag = 0

Encoded Tag = X'0A'

Unused Bits in Last Octet = X'03' Encoded Data = X'A8'

Example: Context-tagged enumeration

ASN.1 = [9] BACnetObjectType Value = ANALOG-INPUT (0) Context Tag = 9 Encoded Tag = X'99' Encoded Data = X'00'

Example: Context-tagged date value

ASN.1 = [9] Date

Value = January 24, 1991 (Day of week = Thursday) Context Tag = 9

Encoded Tag = X'9C'

叮叮小文库

Encoded Data = X'5B011805' Example: Context-tagged time value

ASN.1 = [4] Time

Value = 5:35:45.17 P.M. = 17:35:45.17 Context Tag = 4

Encoded Tag = X'4C'

Encoded Data = X'11232D11'

Example: Context-tagged object identifier value

ASN.1 = [4] ObjectIdentifier Value = (Binary Input, 15) Context Tag = 4

Encoded Tag = X'4C'

Encoded Data = X'00C0000F'

6、通讯步骤

描述数据通讯的步骤，以此作为描述文档进行备份及参考。本次应用数据通讯主要分为如下几步：

➢ IED设备发送广播命令，查询网络中的BACnet设备；通讯机（实现BACnet）接

收到命令后，同样回应一条广播命令，告诉IED自己属于BACnet设备 ➢ IED开始点对点通讯，查询设备属性；通讯机应答复杂回应（命令的一种），送上

属性信息或者回应属性不存在的错误应答

➢ IED开始召唤设备的所具备的数据对象的属性（ID、名称等）；通讯机应答这些数

据对象信息（对象ID、名称等）或者错误的对象不存在应答 ➢ IED开始召唤数据对象的值；通讯局送上某个或某些数据对象的数据信息或一些属

性信息

接下来进行报文举例说明：

6.1. 广播查找设备命令

81 0B 00 0C 01 20 FF FF 00 FF 10 08 00 00-00 00 00 00 解释： 81： B/IP虚拟协议的标示 0B：广播通信 00 0C：长度

01 20 FF FF 00 FF为NPDU部分，见NPDU部分报文的说明如下： 01：网络层的版本 20：表明目标网络信息存在 FF FF： DNET设为0xFFFF表示广播 00： DLEN为0，表示DADR不存在，广播报文 FF： Hop Count在这里需设置为FF 10 08 00 00 00 00 00 00 ：此为APDU部分，详见解释如下： 10：表示无需确认的请求信息

08：类型为WHO-IS 00（6个）：表示网络地址的范围不限

81 0B 00 18 01 20 FF FF 00 FF 10 00 C4 02-00 12 BD 22 05 B2 91 03 21 25

此报文是上面报文的应答

- 叮叮小文库

叮叮小文库

这里的类型为00，及时I-AM的意思，紧接的报文为I-AM-REQUEST的格式，参照第四章及第五章的内容。

6.2. 读取某一设备信息

81 0A 00 11 01 04 02 04 5F 0C 0C 02 00 12-BD 19 61 00 读取ID为0x02BD设备的属性（0x61）

81 0A 00 1A 01 00 30 5F 0C 0C 02 00 12 BD 19 61 3E 85 06 01 00 0B 00 30 60 3F 回答上述属性，这里的回应格式根据所要属性的格式进行组织。详见第五章

81 0A 00 1D 01 04 02 04 60 0E 0C 02 00 12-BD 1E 09 79 09 6B 09 78 09 4D 09 70 09 46 1F

读取ID为0x02BD设备的多个属性（0x79 0x6B 0x78 0x4D 0x70 0x46）

81 0A 00 6A 01 00 30 60 0E 0C 02 00 12 BD-1E 29 79 4E 75 19 00 46 69 65 6C 64 53 65 72 76-65 72 20 54 65 63 68 6E 6F 6C 6F 67 69 65 73 4F-29 6B 4E 91 03 4F 29 78 4E 21 25 4F 29 4D 4E 75-11 00 49 6E 74 65 67 72 61 5F 31 36 33 30 5F 42-43 4E 4F 29 70 4E 91 00 4F 29 46 4E 75 0C 00 50-72 6F 74 6F 43 65 73 73 6F 72 4F 1F 上述报文的应答格式，详见第五章的内容

81 0A 00 12 01 04 02 04 61 0C 0C 02 00 12-BD 1A 08 F3 读取属性0x08F3，由于不存在此属性，故报错如下 81 0A 00 0D 01 00 50 61 0C 91 02 91 20 00-00 00 00 00

81 0A 00 13 01 04 02 04 62 0C 0C 02 00 12-BD 19 4C 29 00

读取设备的object_list，带有数值下标（0x2900）,第一个先回答object的个数，然后才开始每个对象。回应如下：

81 0A 00 16 01 00 30 62 0C 0C 02 00 12 BD-19 4C 29 00 3E 21 45 3F

81 0A 00 13 01 04 02 04 63 0C 0C 02 00 12-BD 19 4C 29 01

再次读取设备的object_list，此为第一个对象，回答为device的ID，然后才是设备的数据对象

81 0A 00 19 01 00 30 63 0C 0C 02 00 12 BD-19 4C 29 01 3E C4 02 00 12 BD 3F

81 0A 00 13 01 04 02 04 64 0C 0C 02 00 12-BD 19 4C 29 02 读取设备的第一个数据对象。

81 0A 00 19 01 00 30 64 0C 0C 02 00 12 BD-19 4C 29 02 3E C4 00 80 00 C8 3F 回答第一个数据对象的ID信息

6.3. 读取数据信息

81 0A 00 11 01 04 02 04 65 0C 0C 00 80 00-C8 19 4D 00 读取analog-value对象的名称属性

81 0A 00 24 01 00 30 65 0C 0C 00 80 00 C8-19 4D 3E 75 10 00 53 65 74 5F 6E 6F 64 65 5F 6F-66 66 73 65 74 3F

回答analog-value对象的名称

- 35

叮叮小文库

81 0A 00 17 01 04 02 04 73 0E 0C 00 00 00-0F 1E 09 75 09 55 09 6F 1F 读取analog-input的多个属性

81 0A 00 26 01 00 30 73 0E 0C 00 00 00 0F-1E 29 75 4E 91 0B 4F 29 55 4E 44 00 00 00 00 4F-29 6F 4E 82 04 00 4F 1F 回答analog-input的属性询问

其它的数据访问方式基本相同的道理，至于报文格式的细节解释详见第四、五章的内容

- 36

因篇幅问题不能全部显示，请点此查看更多更全内容

查看全文