BACnet通讯分析

1、概述.

系统实现基于BACnet/IP（又称B/IP）网络进行通讯。BACnet虚拟链路层（BVLL）提供了BACnet网络层和某指定的通讯子系统的接口，本文指定了BACnet虚拟链路控制（BVLC）要求支持的定向和广播信息。本实现关于BACnet协议定义主要可分为三层：B/IP网络虚拟层，BACnet网络层和BACnet应用层。B/IP提供了TCP/IP一样的通讯结构，采用UDP的通讯方式。本文接下来将对此三层结构进行详细的讲解。

其文本协议的大致格式如下：

BACnet/IP BACnet网络层 BACnet 应用层 BVLC Type BVLC Function Length NPDU APDU NPDU：BACnet网络层数据结构，下文进行详细的讲解

APDU：BACnet应用层数据结构，下文进行详细的讲解 2、BACnet/IP.

BVLC Type： 0x81，代表BACnet/IP网络

BVLC Function： 指定报文的类型，何种作用；本应用使用的报文类型分为两种：

0A：点对点通讯

0B：广播通信

Length： 指定报文的长度，包括BVLC Type、BVLC Function以及本身在内

NPDU： 根据不同情况，报文长短不同，见下文的解析。

APDU： 根据NPDU不同以及不同的请求，报文不同，见下文的解析。

3、BACnet NPDU结构.

版本信息 1 Byte Version 控制字 1 Byte Control 目标网络号 2 Bytes DNET 目标网络长度 1 Byte DLEN 目标地址 可变长度 DADR 原网络号 2 Bytes SNET 原网络长度 1 Byte SLEN 原地址 可变 SNET 路由数目 1 Byte Hop Count 消息类型 1 Byte Message Type 卖方ID 2 Bytes Vendor ID 应用层信息 可变 APDU 版本信息 ：默认0x01

控制字 ：BIT7：1表示Message Type存在，为0时Message Type不存在

BIT6：保留，为0

BIT5：1表示DNET DLEN Hop Count存在，当DLEN为0时表明广播网络

DADR不存在；0表示DNET DLEN DADR Hop Count不存在

BIT4：保留，为0

BIT3：1表示SNET SLEN存在，当SLEN为0时表明无效SADR不存在；

0表示SNET SLEN SADR Hop Count不存在

层

BIT2：1表示为一个需确认的请求数据单元，一复杂ACK数据单元或一网络

信息非reply的；0表示除去上述情形的数据单元

BIT1、0：网络优先级

11 = Life Safety message

10 = Critical Equipment message

01 = Urgent message

00 = Normal message

目标网络号：FFFF的时候表示广播

目标长度： 表示DADR的长度

目标地址： 目标网络MAC地址

原网络号： 同目标网络号

原网络长度：表示SADR的长度

原地址： 原网络的MAC地址

路由数目：消息类型：数据需要经过的路由个数，当不存在DNET的时候，需设置为FF

X'00': Who-Is-Router-To-Network

X'01': I-Am-Router-To-Network

X'02': I-Could-Be-Router-To-Network

X'03': Reject-Message-To-Network

X'04': Router-Busy-To-Network

X'05': Router-Available-To-Network

X'06': Initialize-Routing-Table

X'07': Initialize-Routing-Table-Ack

X'08': Establish-Connection-To-Network

X'09': Disconnect-Connection-To-Network

X'0A' to X'7F': Reserved for use by ASHRAE

X'80' to X'FF': Available for vendor proprietary messages

卖方ID： 当控制字的BIT7为1并且消息类型为X'80' to X'FF':的时候，才会存在

本次开发没有用到，不再解释

本次应用中控制字只用到0x20和0x04两种，前者为广播查询设备，后者微点对对取设备数据或属性。

4、BACnet APDU结构：（应用层协议数据单元）

BACnet网络层数据主要分为一下几种：

BACnetPDU ::= CHOICE

{

confirmed-request-PDU [0] BACnet-Confirmed-Request-PDU,

unconfirmed-request-PDU [1] BACnet-Unconfirmed-Request-PDU,

simpleACK-PDU [2] BACnet-SimpleACK-PDU,

complexACK-PDU [3] BACnet-ComplexACK-PDU,

segmentAck-PDU [4] BACnet-SegmentACK-PDU,

error-PDU [5] BACnet-Error-PDU,

reject-PDU [6] BACnet-Reject-PDU,

abort-PDU [7] BACnet-Abort-PDU

}

对于本次应用，主要用到了

BACnet-Confirmed-Request-PDU（需确认的请求协议数据单元）

BACnet-Unconfirmed-Request-PDU（无需确认的请求协议数据单元）

BACnet-ComplexACK-PDU（复杂的ACK命令）

BACnet-Error-PDU（报错的协议数据单元）

对于上述几种数据的分类主要根据pdu type（下文进行讲解）进行判定。

. BACnet-Confirmed-Request-PDU的结构：

BACnet-Confirmed-Request-PDU ::= SEQUENCE

{

pdu-type [0] Unsigned (0..15), -- 0 for this PDU type

segmented-message [1] BOOLEAN,

more-follows [2] BOOLEAN,

segmented-response-accepted [3] BOOLEAN,

reserved [4] Unsigned (0..3), -- must be set to zero

max-segments-accepted [5] Unsigned (0..7), -- as per 20.1.2.4

max-APDU-length-accepted [6] Unsigned (0..15), -- as per 20.1.2.5

invokeID [7] Unsigned (0..255),

sequence-number msg

[8] Unsigned (0..255) OPTIONAL, -- only if segmented

proposed-window-size segmented msg

[9] Unsigned (1..127) OPTIONAL, -- only if

service-choice [10] BACnetConfirmedServiceChoice,

service-request [11] BACnet-Confirmed-Service-Request OPTIONAL

}

BIT7 BIT6 BIT5 BIT4 BIT3 BIT2 BIT1 BIT0 PDU TYPE SEG MOR SA 0 0 Max Segs Max Resp Invoke ID Sequence Number(only present by SEG==1) Proposed Window Size(only present by SEG==1) Service Chioce Service Request…… PDU Type 0 (BACnet-Confirmed-Service-Request-PDU)

SEG 0 (Unsegmented Request)

1 (Segmented Request)

MOR 0 (No More Segments Follow)

1 (More Segments Follow)

SA 0 (Segmented Response not accepted)

1 (Segmented Response accepted)

Max Segs 20.1.2.4)

(0..7) (Number of response segments accepted per

Max Resp (0..15) (Size of Maximum APDU accepted per 20.1.2.5)

Invoke ID (0..255)

Sequence Number (0..255) Only present if SEG = 1

Proposed Window Size (1..127) Only present if SEG = 1

Service Choice BACnetConfirmedServiceChoice

Service Request Variable Encoding

SEG：指出当前的数据单元是否为完整的还是为一部分分段信息

MOR：指出是否还有更多的分段信息

SA： 为1时指出将收到一个复杂的回应（complex ack）

Max Segs ：指出设备将要接收到多少分段信息

B'000' Unspecified number of segments accepted.

B'001' 2 segments accepted.

B'010' 4 segments accepted.

B'011' 8 segments accepted.

B'100' 16 segments accepted.

B'101' 32 segments accepted.

B'110' segments accepted.

B'111' Greater than segments accepted.

Max Resp：指出将收到的（APDU）最大长度

B'0000' Up to MinimumMessageSize (50 octets)

B'0001' Up to 128 octets

B'0010' Up to 206 octets (fits in a LonTalk frame)

B'0011' Up to 480 octets (fits in an ARCNET frame)

B'0100' Up to 1024 octets

B'0101' Up to 1476 octets (fits in an ISO 8802-3 frame)

Invoke ID：调用者ID

Service Chioce：此处表明次报文的作用，详见BACnetConfirmedServiceChoice

Service Request：根据BACnetConfirmedServiceChoice不同而结构不同，详见

BACnet-Confirmed-Service-Request

BACnetConfirmedServiceChoice ::= 枚举类型

{

-- Alarm and Event Services

acknowledgeAlarm (0),

confirmedCOVNotification (1),

confirmedEventNotification (2),

getAlarmSummary (3),

getEnrollmentSummary (4),

getEventInformation (29),

subscribeCOV (5),

subscribeCOVProperty lifeSafetyOperation -- File Access Services

atomicReadFile atomicWriteFile -- Object Access Services

addListElement removeListElement createObject deleteObject readProperty readPropertyConditional readPropertyMultiple readRange writeProperty writePropertyMultiple (28),

(27),

(6),

(7),

(8),

(9),

(10),

(11),

(12),

(13),

(14),

(26),

(15),

(16),

。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。

}

上述标记为红色的表示本次应用中所用到的，所以只对这些进行讲解。

可以根据BACnetConfirmedServiceChoice找到相对应的Request或者Ack的数据的结构

BACnet-Confirmed-Service-Request ::= CHOICE

127) OPTIONAL,

-- required for MS/TP master, see

max-info-frames [63] Unsigned OPTIONAL,

-- required for MS/TP master, see

device-address-binding [30] SEQUENCE OF BACnetAddressBinding,

database-revision [155] Unsigned,

configuration-files [1] SEQUENCE OF BACnetObjectIdentifier,

last-restore-time [157] BACnetTimeStamp,

backup-failure-timeout [153] Unsigned16,

active-cov-subscriptions [152] SEQUENCE OF BACnetCOVSubscription,

max-segments-accepted [167] Unsigned,

slave-proxy-enable [172] SEQUENCE OF BOOLEAN OPTIONAL,

auto-slave-discovery [169] SEQUENCE OF BOOLEAN OPTIONAL,

slave-address-binding [171]SEQUENCE OF BACnetAddressBinding OPTIONAL,

manual-slave-address-binding [170] SEQUENCE OF BACnetAddressBinding OPTIONAL,

profile-name [168] CharacterString OPTIONAL

}

上述标记为红色者既是本次应用用到的设备属性对象

ANALOG-INPUT ::= SEQUENCE

{

object-identifier [75] BACnetObjectIdentifier,

object-name [77] CharacterString,

object-type [79] BACnetObjectType,

present-value [85] REAL,

description [28] CharacterString OPTIONAL,

device-type status-flags event-state reliability out-of-service update-interval units min-pres-value max-pres-value resolution cov-increment time-delay notification-class high-limit low-limit deadband [31] CharacterString OPTIONAL,

[111] BACnetStatusFlags,

[36] BACnetEventState,

[103] BACnetReliability OPTIONAL,

[81] BOOLEAN,

[118] Unsigned OPTIONAL,

[117] BACnetEngineeringUnits,

[69] REAL OPTIONAL,

[65] REAL OPTIONAL,

[106] REAL OPTIONAL,

[22] REAL OPTIONAL,

[113] Unsigned OPTIONAL,

[17] Unsigned OPTIONAL,

[45] REAL OPTIONAL,

[59] REAL OPTIONAL,

[25] REAL OPTIONAL,

limit-enable [52] BACnetLimitEnable OPTIONAL,

event-enable [35] BACnetEventTransitionBits OPTIONAL,

acked-transitions [0] BACnetEventTransitionBits OPTIONAL,

notify-type [72] BACnetNotifyType OPTIONAL,

event-time-stamps [130] SEQUENCE OF BACnetTimeStamp OPTIONAL,

-- accessed as a BACnetARRAY

profile-name [168] CharacterString OPTIONAL

}

ANALOG-OUTPUT ::= SEQUENCE

{

object-identifier [75] BACnetObjectIdentifier,

object-name [77] CharacterString,

object-type [79] BACnetObjectType,

present-value [85] REAL,

description [28] CharacterString OPTIONAL,

device-type [31] CharacterString OPTIONAL,

status-flags [111] BACnetStatusFlags,

event-state [36] BACnetEventState,

reliability [103] BACnetReliability OPTIONAL,

out-of-service [81] BOOLEAN,

units [117] BACnetEngineeringUnits,

min-pres-value [69] REAL OPTIONAL,

max-pres-value [65] REAL OPTIONAL,

resolution [106] REAL OPTIONAL,

priority-array [87] BACnetPriorityArray,

relinquish-default [104] REAL,

cov-increment [22] REAL OPTIONAL,

time-delay [113] Unsigned OPTIONAL,

notification-class [17] Unsigned OPTIONAL,

high-limit [45] REAL OPTIONAL,

low-limit [59] REAL OPTIONAL,

deadband [25] REAL OPTIONAL,

limit-enable [52] BACnetLimitEnable OPTIONAL,

event-enable [35] BACnetEventTransitionBits OPTIONAL,

acked-transitions [0] BACnetEventTransitionBits OPTIONAL,

notify-type [72] BACnetNotifyType OPTIONAL,

event-time-stamps [130] SEQUENCE OF BACnetTimeStamp OPTIONAL,

-- accessed as a BACnetARRAY

profile-name [168] CharacterString OPTIONAL

}

ANALOG-VALUE ::= SEQUENCE

{

object-identifier [75] BACnetObjectIdentifier,

object-name [77] CharacterString,

object-type [79] BACnetObjectType,

present-value [85] REAL,

description [28] CharacterString OPTIONAL,

status-flags [111] BACnetStatusFlags,

event-state [36] BACnetEventState,

reliability [103] BACnetReliability OPTIONAL,

out-of-service [81] BOOLEAN,

units [117] BACnetEngineeringUnits,

priority-array [87] BACnetPriorityArray OPTIONAL,

relinquish-default [104] REAL OPTIONAL,

cov-increment [22] REAL OPTIONAL,

time-delay [113] Unsigned OPTIONAL,

notification-class [17] Unsigned OPTIONAL,

high-limit [45] REAL OPTIONAL,

low-limit [59] REAL OPTIONAL,

deadband [25] REAL OPTIONAL,

limit-enable [52] BACnetLimitEnable OPTIONAL,

event-enable [35] BACnetEventTransitionBits OPTIONAL,

acked-transitions [0] BACnetEventTransitionBits OPTIONAL,

notify-type [72] BACnetNotifyType OPTIONAL,

event-time-stamps [130] SEQUENCE OF BACnetTimeStamp OPTIONAL,

-- accessed as a BACnetARRAY

profile-name [168] CharacterString OPTIONAL

}

BINARY-INPUT ::= SEQUENCE

{

object-identifier [75] BACnetObjectIdentifier,

object-name [77] CharacterString,

object-type [79] BACnetObjectType,

present-value [85] BACnetBinaryPV,

description [28] CharacterString OPTIONAL,

device-type [31] CharacterString OPTIONAL,

status-flags [111] BACnetStatusFlags,

event-state [36] BACnetEventState,

reliability [103] BACnetReliability OPTIONAL,

out-of-service [81] BOOLEAN,

polarity [84] BACnetPolarity,

inactive-text [46] CharacterString OPTIONAL,

active-text [4] CharacterString OPTIONAL,

change-of-state-time [16] BACnetDateTime OPTIONAL,

change-of-state-count [15] Unsigned OPTIONAL,

time-of-state-count-reset [115] BACnetDateTime OPTIONAL,

elapsed-active-time [33] Unsigned32 OPTIONAL,

time-of-active-time-reset [114] BACnetDateTime OPTIONAL,

time-delay [113] Unsigned OPTIONAL,

notification-class [17] Unsigned OPTIONAL,

alarm-value [6] BACnetBinaryPV OPTIONAL,

event-enable [35] BACnetEventTransitionBits OPTIONAL,

acked-transitions [0] BACnetEventTransitionBits OPTIONAL,

notify-type [72] BACnetNotifyType OPTIONAL,

event-time-stamps [130] SEQUENCE OF BACnetTimeStamp OPTIONAL,

-- accessed as a BACnetARRAY

profile-name [168] CharacterString OPTIONAL

}

BINARY-OUTPUT ::= SEQUENCE

{

object-identifier object-name object-type present-value description device-type status-flags event-state reliability out-of-service polarity inactive-text [75] BACnetObjectIdentifier,

[77] CharacterString,

[79] BACnetObjectType,

[85] BACnetBinaryPV,

[28] CharacterString OPTIONAL,

[31] CharacterString OPTIONAL,

[111]BACnetStatusFlags,

[36] BACnetEventState,

[103]BACnetReliability OPTIONAL,

[81] BOOLEAN,

[84] BACnetPolarity,

[46] CharacterString OPTIONAL,

active-text [4] CharacterString OPTIONAL,

change-of-state-time [16] BACnetDateTime OPTIONAL,

change-of-state-count [15] Unsigned OPTIONAL,

time-of-state-count-reset [115] BACnetDateTime OPTIONAL,

elapsed-active-time [33] Unsigned32 OPTIONAL,

time-of-active-time-reset [114] BACnetDateTime OPTIONAL,

minimum-off-time [66] Unsigned32 OPTIONAL,

minimum-on-time [67] Unsigned32 OPTIONAL,

priority-array [87] BACnetPriorityArray,

relinquish-default [104] BACnetBinaryPV,

time-delay [113] Unsigned OPTIONAL,

notification-class [17] Unsigned OPTIONAL,

feedback-value [40] BACnetBinaryPV OPTIONAL,

event-enable [35] BACnetEventTransitionBits OPTIONAL,

acked-transitions [0] BACnetEventTransitionBits OPTIONAL,

notify-type [72] BACnetNotifyType OPTIONAL,

event-time-stamps profile-name }

BINARY-VALUE ::= SEQUENCE {

object-identifier object-name object-type present-value description status-flags event-state reliability out-of-service inactive-text [130] SEQUENCE OF BACnetTimeStamp OPTIONAL,

-- accessed as a BACnetARRAY

[168] CharacterString OPTIONAL

[75] BACnetObjectIdentifier,

[77] CharacterString,

[79] BACnetObjectType,

[85] BACnetBinaryPV,

[28] CharacterString OPTIONAL,

[111] BACnetStatusFlags,

[36] BACnetEventState,

[103] BACnetReliability OPTIONAL,

[81] BOOLEAN,

[46] CharacterString OPTIONAL,

active-text [4] CharacterString OPTIONAL,

change-of-state-time [16] BACnetDateTime OPTIONAL,

change-of-state-count [15] Unsigned OPTIONAL,

time-of-state-count-reset [115] BACnetDateTime OPTIONAL,

elapsed-active-time [33] Unsigned32 OPTIONAL,

time-of-active-time-reset [114] BACnetDateTime OPTIONAL,

minimum-off-time [66] Unsigned32 OPTIONAL,

minimum-on-time [67] Unsigned32 OPTIONAL,

priority-array [87] BACnetPriorityArray OPTIONAL,

relinquish-default [104] BACnetBinaryPV OPTIONAL,

time-delay [113] Unsigned OPTIONAL,

notification-class [17] Unsigned OPTIONAL,

alarm-value [6] BACnetBinaryPV OPTIONAL,

event-enable [35] BACnetEventTransitionBits OPTIONAL,

acked-transitions [0] BACnetEventTransitionBits OPTIONAL,

notify-type [72] BACnetNotifyType OPTIONAL,

event-time-stamps [130] SEQUENCE OF BACnetTimeStamp OPTIONAL,

-- accessed as a BACnetARRAY

profile-name [168] CharacterString OPTIONAL

}

MULTI-STATE-INPUT ::= SEQUENCE

{

object-identifier [75] BACnetObjectIdentifier,

object-name [77] CharacterString,

object-type [79] BACnetObjectType,

present-value [85]Unsigned,

--maximum value is restricted by the number-of-states

description [28] CharacterString OPTIONAL,

device-type [31] CharacterString OPTIONAL,

status-flags [111] BACnetStatusFlags,

event-state [36] BACnetEventState,

reliability [103] BACnetReliability OPTIONAL,

out-of-service [81] BOOLEAN,

number-of-states [74] Unsigned,

state-text [110] SEQUENCE OF CharacterString OPTIONAL,

-- accessed as a BACnetARRAY

time-delay [113] Unsigned OPTIONAL,

notification-class [17] Unsigned OPTIONAL,

alarm-values [7] SEQUENCE OF Unsigned OPTIONAL,

fault-values [39] SEQUENCE OF Unsigned OPTIONAL,

event-enable [35] BACnetEventTransitionBits OPTIONAL,

acked-transitions [0] BACnetEventTransitionBits OPTIONAL,

notify-type [72] BACnetNotifyType OPTIONAL,

event-time-stamps [130] SEQUENCE OF BACnetTimeStamp OPTIONAL,

-- accessed as a BACnetARRAY

profile-name [168] CharacterString OPTIONAL

}

MULTI-STATE-OUTPUT ::= SEQUENCE

object-identifier object-name object-type present-value description device-type status-flags event-state reliability out-of-service number-of-states state-text priority-array [75] BACnetObjectIdentifier,

[77] CharacterString,

[79] BACnetObjectType,

[85] Unsigned,

-- maximum value is restricted by number-of-states

[28] CharacterString OPTIONAL,

[31] CharacterString OPTIONAL,

[111] BACnetStatusFlags,

[36] BACnetEventState,

[103] BACnetReliability OPTIONAL,

[81] BOOLEAN,

[74] Unsigned,

[110] SEQUENCE OF CharacterString OPTIONAL,

-- accessed as a BACnetARRAY

[87] BACnetPriorityArray,

the

{

relinquish-default [104] Unsigned,

time-delay [113] Unsigned OPTIONAL,

notification-class [17] Unsigned OPTIONAL,

feedback-value [40] Unsigned OPTIONAL,

event-enable [35] BACnetEventTransitionBits OPTIONAL,

acked-transitions [0] BACnetEventTransitionBits OPTIONAL,

notify-type [72] BACnetNotifyType OPTIONAL,

event-time-stamps [130] SEQUENCE OF BACnetTimeStamp OPTIONAL,

-- accessed as a BACnetARRAY

profile-name [168] CharacterString OPTIONAL

}

MULTI-STATE-VALUE ::= SEQUENCE

{

object-identifier [75] BACnetObjectIdentifier,

object-name [77] CharacterString,

object-type [79] BACnetObjectType,

present-value description status-flags event-state reliability out-of-service number-of-states state-text priority-array relinquish-default time-delay notification-class alarm-values fault-values [85] Unsigned,

-- maximum value is restricted by the number-of-states

[28] CharacterString OPTIONAL,

[111] BACnetStatusFlags,

[36] BACnetEventState,

[103] BACnetReliability OPTIONAL,

[81] BOOLEAN,

[74] Unsigned,

[110] SEQUENCE OF CharacterString OPTIONAL,

-- accessed as a BACnetARRAY

[87] BACnetPriorityArray OPTIONAL,

[104] Unsigned OPTIONAL,

[113] Unsigned OPTIONAL,

[17] Unsigned OPTIONAL,

[7] SEQUENCE OF Unsigned OPTIONAL,

[39] SEQUENCE OF Unsigned OPTIONAL,

event-enable [35] BACnetEventTransitionBits OPTIONAL,

acked-transitions [0] BACnetEventTransitionBits OPTIONAL,

notify-type [72] BACnetNotifyType OPTIONAL,

event-time-stamps [130] SEQUENCE OF BACnetTimeStamp OPTIONAL,

--accessed as a BACnetARRAY

profile-name [168] CharacterString OPTIONAL

}

BACnetObjectType ::= ENUMERATED

{

accumulator (23),

analog-input (0),

analog-output (1),

analog-value (2),

averaging (18),

binary-input (3),

binary-output (4),

binary-value calendar command device event-enrollment file group life-safety-point life-safety-zone loop multi-state-input multi-state-output multi-state-value notification-class program pulse-converter (5),

(6),

(7),

(8),

(9),

(10),

(11),

(21), (22),

(12),

(13), (14), (19), (15), (16),

(24),

schedule (17),

-- see averaging (18),

-- see multi-state-value (19),

trend-log (20),

-- see life-safety-point (21),

-- see life-safety-zone (22),

-- see accumulator (23),

-- see pulse-converter (24),

}

上述标记为红色者即为本次应用所用到的对象类型

BACnetAddressBinding ::= SEQUENCE

{

deviceObjectIdentifier BACnetObjectIdentifier,

deviceAddress BACnetAddress

}

BACnetAddress ::= SEQUENCE

{

network-number Unsigned16, -- A value of 0 indicates the local network

mac-address OCTET STRING -- A string of length 0 indicates a broadcast

}

priority-array的类型结构解释：

BACnetPriorityArray ::= SEQUENCE SIZE (16) OF BACnetPriorityValue

-- accessed as a BACnetARRAY

BACnetPriorityValue ::= CHOICE

{

null NULL,

real REAL,

binary BACnetBinaryPV,

integer Unsigned,

constructedValue [0] ABSTRACT-SYNTAX.&Type

}

relinquish-default的结构

BACnetBinaryPV ::= ENUMERATED

{

inactive (0),

active (1)

}

status-flags的类型结构：

BACnetStatusFlags ::= BIT STRING

{

in-alarm (0),

fault (1),

overridden (2),

out-of-service (3)

}

Reliability的类型结构：

BACnetReliability ::= ENUMERATED {

no-fault-detected (0),

no-sensor (1),

over-range (2),

under-range (3),

open-loop (4),

shorted-loop (5),

no-output (6),

unreliable-other (7),

process-error (8),

multi-state-fault (9),

configuration-error (10),

}

system-status的类型结构：

BACnetDeviceStatus ::= ENUMERATED

{

operational (0),

operational-read-only (1),

download-required (2),

download-in-progress (3),

non-operational (4),

backup-in-progress (5),

}

Units的解释说明如下：

BACnetEngineeringUnits ::= ENUMERATED

{

--Electrical

milliamperes (2),

amperes (3),

amperes-per-meter (167),

amperes-per-square-meter (168),

ampere-square-meters (169),

farads (170),

henrys (171),

ohms (4),

ohm-meters (172),

milliohms (145),

kilohms (122),

megohms (123),

siemens (173), -- 1 mho equals 1 siemens

siemens-per-meter (174),

teslas (175),

volts (5),

millivolts (124),

kilovolts (6),

megavolts (7),

volt-amperes (8),

kilovolt-amperes (9),

megavolt-amperes (10),

volt-amperes-reactive (11),

kilovolt-amperes-reactive (12),

megavolt-amperes-reactive (13),

volts-per-degree-Kelvin (176),

volts-per-meter (177),

degrees-phase (14),

power-factor (15),

webers (178),

--Energy

joules (16),

kilojoules (17),

kilojoules-per-kilogram (125),

megajoules (126),

watt-hours (18),

kilowatt-hours (19),

megawatt-hours (146),

btus (20),

kilo-btus (147),

mega-btus (148),

therms (21),

ton-hours (22),

--Frequency

cycles-per-hour (25),

cycles-per-minute (26),

hertz (27),

kilohertz (129),

megahertz (130),

per-hour (131),

--Power

milliwatts (132),

watts (47),

kilowatts (48),

megawatts (49),

btus-per-hour (50),

kilo-btus-per-hour (157),

horsepower (51),

tons-refrigeration (52),

--Temperature

degrees-Celsius (62),

degrees-Kelvin (63),

degrees-Kelvin-per-hour (181),

degrees-Kelvin-per-minute (182),

degrees-Fahrenheit (),

degree-days-Celsius (65),

degree-days-Fahrenheit (66),

delta-degrees-Fahrenheit (120),

delta-degrees-Kelvin (121),

--Time

years (67),

months (68),

weeks (69),

days (70),

hours (71),

minutes (72),

seconds (73),

hundredths-seconds (158),

milliseconds (159),

--Other

degrees-angular (90),

degrees-Celsius-per-hour (91),

degrees-Celsius-per-minute (92),

degrees-Fahrenheit-per-hour (93),

degrees-Fahrenheit-per-minute (94),

joule-seconds (183),

kilograms-per-cubic-meter (186),

kilowatt-hours-per-square-meter (137),

kilowatt-hours-per-square-foot (138),

megajoules-per-square-meter (139),

megajoules-per-square-foot (140),

no-units (95),

newton-seconds (187),

newtons-per-meter (188),

parts-per-million (96),

parts-per-billion (97),

percent (98),

percent-obscuration-per-foot (143),

percent-obscuration-per-meter (144),

percent-per-second (99),

per-minute (100),

per-second (101),

psi-per-degree-Fahrenheit (102),

radians (103),

radians-per-second (184),

revolutions-per-minute (104),

square-meters-per-Newton (185),

watts-per-meter-per-degree-Kelvin (1),

watts-per-square-meter-degree-kelvin (141)

}

event-state的结构如下：

BACnetEventState ::= ENUMERATED {

normal (0),

fault (1),

offnormal (2),

high-limit (3),

low-limit (4),

life-safety-alarm (5),

}

protocol-services-supported的结构如下：

BACnetServicesSupported ::= BIT STRING

{

-- Alarm and Event Services

acknowledgeAlarm (0),

confirmedCOVNotification (1),

confirmedEventNotification (2),

getAlarmSummary (3),

getEnrollmentSummary (4),

-- getEventInformation (39),

subscribeCOV (5),

-- subscribeCOVProperty (38),

-- lifeSafetyOperation (37),

-- File Access Services

atomicReadFile (6),

atomicWriteFile (7),

-- Object Access Services

addListElement (8),

removeListElement (9),

createObject (10),

deleteObject (11),

readProperty (12),

readPropertyConditional (13),

readPropertyMultiple (14),

-- readRange (35),

writeProperty (15),

writePropertyMultiple (16),

-- Remote Device Management Services

deviceCommunicationControl (17),

confirmedPrivateTransfer (18),

confirmedTextMessage (19),

reinitializeDevice (20),

-- Virtual Terminal Services

vtOpen (21),

vtClose (22),

vtData (23),

-- Security Services

authenticate (24),

requestKey (25),

-- Unconfirmed Services

i-Am (26),

i-Have (27),

unconfirmedCOVNotification (28),

unconfirmedEventNotification (29),

unconfirmedPrivateTransfer (30),

unconfirmedTextMessage (31),

timeSynchronization (32),

-- utcTimeSynchronization (36),

who-Has (33),

who-Is (34),

}

BACnetSegmentation ::= ENUMERATED

{

segmented-both (0),

segmented-transmit (1),

segmented-receive (2),

no-segmentation (3)

}

. BACnet-Unconfirmed-Request-PDU结构：

BACnet-Unconfirmed-Request-PDU ::= SEQUENCE

{

pdu-type [0] Unsigned (0..15), -- 1 for this PDU type

reserved [1] Unsigned (0..15), -- must be set to zero

service-choice [2] BACnetUnconfirmedServiceChoice,

service-request [3] BACnet-Unconfirmed-Service-Request

}

BIT7 BIT6 BIT5 BIT4 BIT3 BIT2 BIT1 BIT0 PDU TYPE Reserved Service Chioce Service Request PDU TYPE ：1

Service Chioce：详见BACnetUnconfirmedServiceChoice

Service Request：根据BACnetConfirmedServiceChoice不同而结构不同，详见

BACnet-Unconfirmed-Service-Request

其它同上

BACnetUnconfirmedServiceChoice ::= ENUMERATED

{

i-Am (0),

i-Have (1),

unconfirmedCOVNotification (2),

unconfirmedEventNotification (3),

unconfirmedPrivateTransfer (4),

unconfirmedTextMessage (5),

timeSynchronization (6),

who-Has (7),

who-Is (8),

utcTimeSynchronization (9)

}

BACnet-Unconfirmed-Service-Request ::= CHOICE

{

i-Am [0]I-Am-Request,

i-Have [1] I-Have-Request,

unconfirmedCOVNotification [2] UnconfirmedCOVNotification-Request,

unconfirmedEventNotification [3] UnconfirmedEventNotification-Request,

unconfirmedPrivateTransfer [4] UnconfirmedPrivateTransfer-Request,

unconfirmedTextMessage [5] UnconfirmedTextMessage-Request,

timeSynchronization [6] TimeSynchronization-Request,

who-Has [7] Who-Has-Request,

who-Is [8] Who-Is-Request,

utcTimeSynchronization [9] UTCTimeSynchronization-Request

}

I-Am-Request ::= SEQUENCE

{

iAmDeviceIdentifier BACnetObjectIdentifier,

maxAPDULengthAccepted Unsigned,

segmentationSupported BACnetSegmentation,

vendorID Unsigned

}

Who-Is-Request ::= SEQUENCE

deviceInstanceRangeLowLimit [0] Unsigned (0..4194303) OPTIONAL

deviceInstanceRangeHighLimit [1] Unsigned (0..4194303) OPTIONAL

}

deviceInstanceRangeLowLimit：下限（3 octor）

deviceInstanceRangeHighLimit：上限（3 octor）

. BACnet-ComplexACK-PDU结构：

BACnet-ComplexACK-PDU ::= SEQUENCE

{

pdu-type [0] Unsigned (0..15), -- 3 for this PDU type

segmented-message [1] BOOLEAN,

more-follows [2] BOOLEAN,

reserved [3] Unsigned (0..3), -- must be set to zero

invokeID [4] Unsigned (0..255),

sequence-number [5] Unsigned (0..255) OPTIONAL, --only if segment

proposed-window-size [6] Unsigned (1..127) OPTIONAL, -- only if segment

service-ACK-choice [7] BACnetConfirmedServiceChoice,

service-ACK [8] BACnet-Confirmed-Service-ACK

}

BIT7 BIT6 BIT5 BIT4 BIT3 BIT2 BIT1 BIT0 PDU TYPE SEG MOR 0 Original Invoke ID Sequence Number(only present by SEG==1) Proposed Window Size(only present by SEG==1) Service Ack Chioce Service ACK PDU TYPE ：1

Service Ack Chioce：详见BACnetConfirmedServiceChoice

Service ACK：根据BACnetConfirmedServiceChoice不同而结构不同，详见

BACnet-Confirmed-Service-ACK

其它同上

BACnet-Confirmed-Service-ACK ::= CHOICE

{

-- Alarm and Event Services

getAlarmSummary [3] GetAlarmSummary-ACK,

getEnrollmentSummary [4] GetEnrollmentSummary-ACK,

getEventInformation [29] GetEventInformation-ACK,

-- File Access Services

atomicReadFile [6] AtomicReadFile-ACK,

atomicWriteFile [7] AtomicWriteFile-ACK,

-- Object Access Services

createObject [10] CreateObject-ACK,

readProperty [12] ReadProperty-ACK,

readPropertyConditional [13] ReadPropertyConditional-ACK,

readPropertyMultiple [14] ReadPropertyMultiple-ACK,

readRange [26] ReadRange-ACK,

-- Remote Device Management Services

confirmedPrivateTransfer [18] ConfirmedPrivateTransfer-ACK,

-- Virtual Terminal Services

vtOpen [21] VT-Open-ACK,

vtData [23] VT-Data-ACK,

-- Security Services

authenticate [24] Authenticate-ACK

}

ReadProperty-ACK ::= SEQUENCE

{

objectIdentifier [0] BACnetObjectIdentifier,

propertyIdentifier [1] BACnetPropertyIdentifier,propertyArrayIndex [2] Unsigned OPTIONAL, --used datatype

propertyValue [3] ABSTRACT-SYNTAX.&Type

}

ReadPropertyMultiple-ACK ::= SEQUENCE

{

listOfReadAccessResult SEQUENCE OF ReadAccessResult

}

ReadAccessResult ::= SEQUENCE

{

objectIdentifier [0] BACnetObjectIdentifier,

only with array

listOfResults [1] SEQUENCE OF SEQUENCE

{

propertyIdentifier [2] BACnetPropertyIdentifier,

propertyArrayIndex [3] Unsigned OPTIONAL

readResult CHOICE

{

propertyValue [4] ABSTRACT-SYNTAX.&Type,

propertyAccessError [5] Error

}

} OPTIONAL

}

. BACnet-Error-PDU结构：

BACnet-Error-PDU ::= SEQUENCE

{

pdu-type [0] Unsigned (0..15), -- 5 for this PDU type

reserved [1] Unsigned (0..15), -- must be set to zero

original-invokeID [2] Unsigned (0..255),

error-choice [3] BACnetConfirmedServiceChoice,

error [4] BACnet-Error

}

BIT7 BIT6 BIT5 BIT4 BIT3 BIT2 BIT1 BIT0 PDU TYPE 0 Original Invoke ID Error Choice Error 。。。。 PDU TYPE：5

Original Invoke ID：调用者ID

Error Chioce：详见BACnetConfirmedServiceChioce

Error：根据Error Chioce不同而不同，详见BACnet-Error

BACnet-Error ::= CHOICE

{

other [127] Error,

-- Alarm and Event Services

acknowledgeAlarm [0] Error,

confirmedCOVNotification [1] Error,

confirmedEventNotification [2] Error,

getAlarmSummary [3] Error,

。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。

-- Object Access Services

addListElement [8] ChangeList-Error,

removeListElement [9] ChangeList-Error,

createObject [10] CreateObject-Error,

deleteObject [11] Error,

readProperty [12] Error,

readPropertyConditional [13] Error,

readPropertyMultiple [14] Error,

readRange [26] Error,

writeProperty [15] Error,

writePropertyMultiple [16] WritePropertyMultiple-Error,

-- Remote Device Management Services

deviceCommunicationControl [17] Error,

confirmedPrivateTransfer [18] ConfirmedPrivateTransfer-Error,

confirmedTextMessage [19] Error,

。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。

}

Error ::= SEQUENCE

{

error-class ENUMERATED

{

device (0),

object (1),

property (2),

resources (3),

security (4),

services (5),

vt (6),

},

error-code ENUMERATED

{

other authentication-failed character-set-not-supported invalid-array-index invalid-configuration-data invalid-data-type unknown-property }

}

5、BACnet APDU可变部分的编码

(1),

(41),

(42),

(46),

(0),

(9),(32), 这部分的数据编码通常分为两个部分：数据类型描述部分和数据部分。描述部分主要

描述接下来的数据是什么类型，如何编码，所占长度等信息；关于这部分需要详细的说明如下：

首先描述部分含有一个Tags，主要分为两类：应用Tag和上下文Tag，前者的结构如下：

BIT7---BIT4 Bit3 Bit2—Bit0 Tag number Class Length/Value/Type Tag number: 接

指出了数据的类型（0-14只占据4位数据，当高四位置为‘1111’时表示

下来的一个字节作为Tag的描述）

Class： Number

0时表示数据位应用数据类型，1表示上下文数据类型；此种情况下Tag

为上下文Tag

Length/Value/Type：当（0-4）时表示数据的长度，当为’101’时表示后边的octor代表数据

的长度.如果为’110’表示为一个opening tag,那么必然需要一个

closeing

Tag( ‘111’)

Application tags:

0: NULL

1: Boolean

2: unsigned integer

3: signed interger

4: Real(ASNSI/IEEE-7)

5： Double（ANSI/IEEE-7 double precision floating point）

6： octor string

7： Character string

8： Bit string

9： Enumerated

10：Date

11：Time

12：BACnetObjectIdentifier

Context-special tags： 含有一个context tag 如其位于结构中的第一个context tag则

为1，第二个context tag则为2

Example: Application-tagged null value

= NULL

Application Tag = Null (Tag Number = 0)

Encoded Tag = X'00'

Example: Application-tagged Boolean value（Boolean 编码在一个字节中 ）

= BOOLEAN

Value = FALSE

Application Tag = Boolean (Tag Number = 1)

Encoded Tag = X'10'

Example: Context-tagged Boolean value（上下文Boolean的编码）

= [2] BOOLEAN

Value = TRUE

Context Tag = 2

Encoded Tag = X'29'

Encoded Data = X'01'

Example: Application-tagged unsigned integer

= Unsigned

Value = 72

Application Tag = Unsigned Integer (Tag Number = 2)

Encoded Tag = X'21'

Encoded Data = X'48'

Example: Application-tagged signed integer

= INTEGER

Value = 72

Application Tag = Signed Integer (Tag Number = 3)

Encoded Tag = X'31'

Encoded Data = X'48'

Example: Application-tagged single precision real

= REAL

Value =

Application Tag = Real (Tag Number = 4)

Encoded Tag = X'44'

Encoded Data = X''

Example: Application-tagged double precision real（双精度占用8字节）

= Double

Value =

Application Tag = Double (Tag Number = 5)

Encoded Tag = X'55'

Extended Length = X'08'

Encoded Data = X'00000000'

Example: Application-tagged octet string

= OCTET STRING

Value = X'1234FF'

Application Tag = Octet String (Tag Number = 6)

Encoded Tag = X'63'

Encoded Data = X'1234FF'

The initial octet shall specify the character set with the following encoding:

X'00' ANSI

X'01' IBM?/Microsoft? DBCS

X'02' JIS C 6226

X'03' ISO 106 (UCS-4)

X'04' ISO 106 (UCS-2)

X'05' ISO 8859-1

Example: Application-tagged character string

= CharacterString

Value = \"This is a BACnet string!\" (ANSI

Application Tag = Character String (Tag Number = 7)

Encoded Tag = X'75'

Length Extension = X'19'

Character Set = X'00' (ANSI

Encoded Data = X'436E7472696E6721'

Example: Application-tagged character string (DBCS)

= CharacterString

Value = \"This is a BACnet String!\" (IBM/Microsoft DBCS, code page 850)

Application Tag = Character String (Tag Number = 7)

Encoded Tag = X'75'

Length Extension = X'1B'

Encoded Data =

X'0436E7472696E6721'

不再举例，本程序使用(ANSI 类型的字符串编码

Example: Application-tagged bit string

= BIT STRING

Value = B'10101'

Application Tag = Bit String (Tag Number = 8)

Encoded Tag = X'82'

Encoded Data = X'03A8'

Example: Application-tagged enumeration

= BACnetObjectType

Value = ANALOG-INPUT (0)

Application Tag = Enumerated (Tag Number = 9)

Encoded Tag = X '91'

Encoded Data = X '00'

Example: Application-tagged date value

= Date

Value = January 24, 1991 (Day of week = Thursday)

Application Tag = Date (Tag Number = 10)

Encoded Tag = X'A4'

Encoded Data = X'5B011804'

Example: Application-tagged time value

= Time

Value = 5:35: . = 17:35:

Application Tag = Time (Tag Number = 11)

Encoded Tag = X'B4'

Encoded Data = X'11232D11'

Example: Application-tagged object identifier value

= ObjectIdentifier

Value = (Binary Input, 15)

Application Tag = ObjectIdentifier (Tag Number = 12)

Encoded Tag = X'C4'

Encoded Data = X'00C0000F'

Context-special tags：

Example: Context-tagged null value

= [3] NULL

Context Tag = 3

Encoded Tag = X'38'

Example: Context-tagged Boolean value

= [6] BOOLEAN

Value = FALSE

Context Tag = 6

Encoded Tag = X'69'

Encoded Data = X'00'

Example: Context-tagged unsigned integer

= [0] Unsigned

Value = 256

Context Tag = 0

Encoded Tag = X'0A'

Encoded Data = X'0100'

Example: Context-tagged signed integer

= [5] INTEGER

Value = -72

Context Tag = 5

Encoded Tag = X'59'

Encoded Data = X'B8'

Example: Context-tagged single precision real

= [0] REAL

Value =

Context Tag = 0

Encoded Tag = X'0C'

Encoded Data = X'C2053333'

Example: Context-tagged double precision real

= [1] Double

Value =

Context Tag = 1

Encoded Tag = X'1D'

Extended Length = X'08'

Encoded Data = X'C040A666'

Example: Context-tagged octet string

= [1] OctetString

Value = X'4321'

Context Tag = 1

Encoded Tag = X'1A'

Encoded Data = X'4321'

Example: Context-tagged character string

= [5] CharacterString

Value = \"This is a BACnet string!\" (ANSI

Context Tag = 5

Encoded Tag = X'5D'

Length Extension = X'19'

Character Set = X'00' (ANSI

Encoded Data = X'

436E7472696E6721'

Example: Context-tagged bit string

= [0] BIT STRING

Value = B'10101'

Context Tag = 0

Encoded Tag = X'0A'

Unused Bits in Last Octet = X'03'

Encoded Data = X'A8'

Example: Context-tagged enumeration

= [9] BACnetObjectType

Value = ANALOG-INPUT (0)

Context Tag = 9

Encoded Tag = X'99'

Encoded Data = X'00'

Example: Context-tagged date value

= [9] Date

Value = January 24, 1991 (Day of week = Thursday)

Context Tag = 9

Encoded Tag = X'9C'

Encoded Data = X'5B011805'

Example: Context-tagged time value

= [4] Time

Value = 5:35: . = 17:35:

Context Tag = 4

Encoded Tag = X'4C'

Encoded Data = X'11232D11'

Example: Context-tagged object identifier value

= [4] ObjectIdentifier

Value = (Binary Input, 15)

Context Tag = 4

Encoded Tag = X'4C'

Encoded Data = X'00C0000F'

6、通讯步骤

描述数据通讯的步骤，以此作为描述文档进行备份及参考。本次应用数据通讯主要分为如下几步：

IED设备发送广播命令，查询网络中的BACnet设备；通讯机（实现BACnet）接收到命令后，同样回应一条广播命令，告诉IED自己属于BACnet设备

IED开始点对点通讯，查询设备属性；通讯机应答复杂回应（命令的一种），送上属性信息或者回应属性不存在的错误应答

IED开始召唤设备的所具备的数据对象的属性（ID、名称等）；通讯机应答这些数据对象信息（对象ID、名称等）或者错误的对象不存在应答

IED开始召唤数据对象的值；通讯局送上某个或某些数据对象的数据信息或一些属性信息

接下来进行报文举例说明：

. 广播查找设备命令

81 0B 00 0C 01 20 FF FF 00 FF 10 08 00 00-00 00 00 00

解释：

81： B/IP虚拟协议的标示

0B： 广播通信

00 0C： 长度

01 20 FF FF 00 FF为NPDU部分，见NPDU部分报文的说明如下：

01： 网络层的版本

20： 表明目标网络信息存在

FF FF： DNET设为0xFFFF表示广播

00： DLEN为0，表示DADR不存在，广播报文

FF： Hop Count在这里需设置为FF

10 08 00 00 00 00 00 00 ：此为APDU部分，详见解释如下：

10：表示无需确认的请求信息

08：类型为WHO-IS

00（6个）：表示网络地址的范围不限

81 0B 00 18 01 20 FF FF 00 FF 10 00 C4 02-00 12 BD 22 05 B2 91 03 21 25

此报文是上面报文的应答

这里的类型为00，及时I-AM的意思，紧接的报文为I-AM-REQUEST的格式，参照第四

章及第五章的内容。

6.2. 读取某一设备信息

81 0A 00 11 01 04 02 04 5F 0C 0C 02 00 12-BD 19 61 00

读取ID为0x02BD设备的属性（0x61）

81 0A 00 1A 01 00 30 5F 0C 0C 02 00 12 BD 19 61 3E 85 06 01 00 0B 00 30 60 3F

回答上述属性，这里的回应格式根据所要属性的格式进行组织。详见第五章

81 0A 00 1D 01 04 02 04 60 0E 0C 02 00 12-BD 1E 09 79 09 6B 09 78 09 4D 09 70 09 46 1F

读取ID为0x02BD设备的多个属性（0x79 0x6B 0x78 0x4D 0x70 0x46）

81 0A 00 6A 01 00 30 60 0E 0C 02 00 12 BD-1E 29 79 4E 75 19 00 46 69 65 6C 53 65 72 76-65 72 20 65 63 68 6E 6F 6C 6F 67 69 65 73 4F-29 6B 4E 91 03 4F 29 78 4E 21 25 4F 29 4D 4E 75-11 00 49 6E 74 65 67 72 61 5F 31 36 33 30 5F 42-43 4E 4F 29 70 4E 91 00 4F 29 46 4E 75 0C 00 50-72 6F 74 6F 43 65 73 73 6F 72 4F 1F

上述报文的应答格式，详见第五章的内容

81 0A 00 12 01 04 02 04 61 0C 0C 02 00 12-BD 1A 08 F3

读取属性0x08F3，由于不存在此属性，故报错如下

81 0A 00 0D 01 00 50 61 0C 91 02 91 20 00-00 00 00 00

81 0A 00 13 01 04 02 04 62 0C 0C 02 00 12-BD 19 4C 29 00

读取设备的object_list，带有数值下标（0x2900）,第一个先回答object的个数，然后才开始每个对象。回应如下：

81 0A 00 16 01 00 30 62 0C 0C 02 00 12 BD-19 4C 29 00 3E 21 45 3F

81 0A 00 13 01 04 02 04 63 0C 0C 02 00 12-BD 19 4C 29 01

再次读取设备的object_list，此为第一个对象，回答为device的ID，然后才是设备的数据对象

81 0A 00 19 01 00 30 63 0C 0C 02 00 12 BD-19 4C 29 01 3E C4 02 00 12 BD 3F

81 0A 00 13 01 04 02 04 0C 0C 02 00 12-BD 19 4C 29 02

读取设备的第一个数据对象。

81 0A 00 19 01 00 30 0C 0C 02 00 12 BD-19 4C 29 02 3E C4 00 80 00 C8 3F

回答第一个数据对象的ID信息

6.3. 读取数据信息

81 0A 00 11 01 04 02 04 65 0C 0C 00 80 00-C8 19 4D 00

读取analog-value对象的名称属性

81 0A 00 24 01 00 30 65 0C 0C 00 80 00 C8-19 4D 3E 75 10 00 53 65 74 5F 6E 6F

65 5F 6F-66 66 73 65 74 3F

回答analog-value对象的名称

81 0A 00 17 01 04 02 04 73 0E 0C 00 00 00-0F 1E 09 75 09 55 09 6F 1F

读取analog-input的多个属性

81 0A 00 26 01 00 30 73 0E 0C 00 00 00 0F-1E 29 75 4E 91 0B 4F 29 55 4E 44 00 00 00 00 4F-29 6F 4E 82 04 00 4F 1F

回答analog-input的属性询问

其它的数据访问方式基本相同的道理，至于报文格式的细节解释详见第四、五章的内容