zigbee分析

Acronyms and Abbreviations缩略语

AES Advanced Encryption Standard
AF Application Framework
AFDE AF sub-layer Data Entity
AFME AF sub-layer Management Entity
API Application Programming Interface
APS Application Support sub-layer
BOS Basic Operating System
BPSK Bipolar Phase-Shift Keying
DSSS Direct-Sequence-Spread-Spectrum
HCL Home Controls-Lighting
MAC Media Access Control

NWK Network layer
OEM Original Equipment Manufacturer
PAN Personal Area Network
PDU Protocol Data Unit
RF Radio Frequency
SAP Service Access Point
ZDO ZigBee Device Objects
ZDP ZigBee Device Profile（规约）

一、zigbee网络介绍

其实就是讲zigbee的有点，比如低功耗，组网快，一个节点可以与多个节点建立连接。去网上一搜一大堆。

其中zigbee协议栈里有一些知识讲一下：

1.profile

Profile：每一个ZigBee 的网络设备都应该使用一个Profile, Profile 定义了设备的应用场景，WSN)，另外定义了设备的类型还有设备之间的信息交换规范。以便不同的节点甚至是不同厂商生产的节点能够协作。

有两种profile，一种是stack profile，一种是application profile。

1）stack profile

stack profile决定了zigbee stack为网络结构提供什么样的资源（resource）——比如网络类型，拓扑，以及与application相适应的特征（如安全类型）。

zigbee联盟已经制定了多个常见的stack profiles，应用在不同的场合如：Home Controls，Building

Automation，Plant Control。

除此之外，用户可以自定义自己需要的私有应用程序规约（private application profile）

2）Application Profile

一个Application Profile 关联一个特定的stack profile，并制定一些application profile自己特定的应用。

每一个Profile都有一个16位的标志。

Application Profiles可以分为Public Profiles和Private Profiles

Public Profiles

zigbee联盟制定的profile就是Public Profiles，制定它是为了实现不同厂商生产的设备在同一个应用中能够兼容。

Private Profiles (also known as ‘non-public’ profiles)

除了zigbee联盟制定的公有的profile，厂商还可以定义自己私有的profile，实现自己一些特定的应用。

二、zigbee结构与相关概念

1.zigbee结构

一个节点上的程序，它的结构可以认为分为3层次（level不是layer）：PHY/LINK level，zigbee stack level，application level。

application level和application layer是否是一个概念呢？文档没有说清楚。

2.网络层次概念（Network Level Concepts）

1）节点

节点角色：Co-ordinator（选择合适的信道，建立网络，网络初始化（网络ID等），允许节点加入）

Router（允许子节点通过它加入网络） End Device（不能转发消息）。

2）拓扑

星形（两个节点通信必须要经过coordinator），树形，网状

3）网络配置（Network Configuration）

网络配置的初始化是在coordinator上进行的。配置的内容包括：一个router可以连接的最多的节点个数，一个router可以连接的router的个数，从coordinator到最远节点的跳数，然后基于以上可以得到一个网络最多的节点个数。

配置内容：

• 深度（Depth）：
  

The depth of a device is the number of nodes from the root of the network tree (the Co-ordinator) to the device. The maximum network depth is then the maximum number of hops to the most distant device in the network from the Co-ordinator. This is set at configuration time and determines the overall diameter for the network. Note that a Star network has a network depth of 1.

• router子节点（Number of Children）
  

Each Router in the network can have a number of child devices attached to it. These may be either Routers or End Devices. The Co-ordinator specifies the number of child devices allowed per Router, and how many of these child devices can be Routers.

• 网络短地址分配（Network Address Allocation）
  

Network addresses are allocated during initialisation of the network. The Co-ordinator allocates each child Router a block of consecutive addresses to allocate to its children. These address blocks provide each Router with enough addresses to allocate to all of its potential children, as defined by the maximum routers, maximum children and maximum depth parameters. In turn, the block of addresses given to a Router will be subdivided amongst its child Routers and so on down the tree. Since the topology of a deployed network is not necessarily uniform (as many nodes may be needed in one geographic area and relatively fewer in another), it is possible for one Router to have all of its allocated addresses in use while those on another may be unused.（网络初始化的时候，coordinator会进行短地址分配，根据每个router子节点个数的最大值，分配给router一段地址，供它分配给其子节点。）

3）启动网络

coordinator负责启动网络，首先他选择一个合适的频道，接着启动网络，生成PAN ID，然后响应其他节点加入网络的请求。

4）加入网络步骤

coordinator和router都有让其他节点加入网络的能力。加入网络过程如下：

The new node first scans the available channels to find operating networks and identifies which one it should join. Multiple networks may operate in the same channel and are differentiated by their PAN IDs.（一个节点周围有多个PAN时该选择哪个？）
The node may be able to ‘see’ multiple Routers and a Co-ordinator from the same network, in which case it selects which one it should connect to. Usually, this is the one with the best signal.（一个节点周围既有coordinator又有router时通常根据信号的好坏选择跟谁建立连接）
The node then sends a message to the Router asking to join the network.（节点请求加入网络）
The Router decides whether the node is a permitted device, whether the Router is currentlyallowing devices to join and whether it has address space available. If all these criteria are satisfied, the Router will then allow the device to join and allocate it an address.（router考察能否让节点加入网络）

5）Stack Profiles

一个Stack Profiles规定了网络的depth，网络拓扑，子节点个数等。zigbee联盟已经针对特定应用定义了一些stack profile。对于一些特定的应用中，标准stack profile不适用，这是stack参数由设计者指定。

6）短地址

短地址为16位，由父节点分配，两个PAN中的节点可能有相同的ID.

7）消息传播（Message Propagation）

消息里需要包括两种地址才能保证到达目标节点：

目标节点地址和下一跳节点的地址。

在mesh网络中，当节点在目标节点通信范围内的时候，消息只需要目标节点的地址。

当节点不在目标节点通信范围内的时候，消息需要包含下一跳地址（下一跳需要在到目标节点的路由上）。

注意：对于节点上的应用程序来说，并不知道要传递的消息和消息的内容，转发机制（relaying mechanism）是由zigbee stack管理的（除非是在路由发现的情况下）。

8）消息路由和路由发现

ZigBee stack network layer支持路由发现（route discovery），通过路由发现网络可以找到到达目标节点的最佳路由，路由发现有三种选择：

• SUPPRESS route discovery（禁止路由发现）: The message is routed along the tree.只是简单的将消息沿着树传播。
• ENABLE route discovery: 消息会沿着已经被发现的路由传播，如果不存在这样的路由，Router就开始一次新的路由发现。找到合适的路由之后就沿着路由传播消息。如果Router没有空间存储新路由时，就沿着树传播消息。The message is routed along an already discovered mesh route, if one exists, otherwise the Router initiates a route discovery. Once this is complete, the message will be sent along the calculated route. If the Router does not have the capacity to store the new route, it will direct the message along the tree.
• FORCE route discovery:这个选择要谨慎，因为它会大大增加网络业务。 If the Router has the route capacity, it will initiate a route discovery, even if a known route already exists. Once this is complete, the message will be sent along the calculated route. If the Router does not have the route capacity, it will route the message along the tree. This option should be used sparingly, as it generates a great deal of network traffic.
  

下面是两个end device之间的路由发现机制（如果用简单的DTN路由协议不会用到它，如果稍微有点难度的协议，就会需要使用转发机制，但是这里的路由发现协议显然不适合DTN转发协议，目前来看，转发机制在stack的网络层，好像是不能修改的。）：

• A route discovery broadcast is sent by the parent Router of the source End Device, containing the target destination End Device network address.
• All routers will eventually receive the broadcast, one of which is the parent of the destination End Device
• The parent Router of the destination node sends back a reply addressed to the parent router of the source.
• As the reply travels back through the network, the hop count and a signal quality measure for each hop are recorded. Each Router in the path can build a routing table entry containing the best path to the destination End Device
The choice of best path is usually the one with the least number of hops, although if a hop on the most direct route has a poor signal quality (and hence a greater chance that retries will be needed), a route with more hops may be chosen.
• Eventually each Router in the path will have a routing table entry and the route from source to destination End Device is established. Note that the corresponding route from destination to source is not known – the route discovered is unidirectional.

透明路由（Routing Transparency）

通常情况下路由对于应用程序是透明的，但是在mesh网络拓扑中，当节点要发送信息时，如果没有可用的路由，在发消息之前，在 Co-ordinator or Router的application level（我怀疑只是调用stack里的函数进行初始化，而真正的路由发现机制的程序代码是无法修改的，或者说想添加自己的DTN转发机制是很难得，就我目前的理解来看）会初始化并完成路由发现。我的理解是，mesh网络中如果没有可用路由，而是任信息在网络中转发的话，由于router很多，会造成网络业务增加，相比之下，有一条路由更可靠，而移动DTN就像一个router之间时而连接时而断开的mesh网络，用路由发现的方法寻找消息传播最佳路径是不可能的，使用路由转发机制才靠谱，但问题是，jennic是够给予我们增加转发机制的API。Message routing is normally performed automatically by the ZigBee stack, without any intervention from the applications running on the Router or Co-ordinator. Therefore, routing is usually, but not always, transparent to the applications.
Routing is not transparent in a Mesh topology when a direct or indirect message is sent to a destination address for which a route has not already been discovered (and route discovery is active). In this case, the Co-ordinator or Router must initiate and complete a route discovery (at application level) before sending the message.

3.应用程序层次概念（Application Level Concepts）

1）多应用程序和端点（Multiple Applications and Endpoints）

一个节点可以有多个应用程序运行，比如监测温度和监测湿度的两个应用程序，然后每个应用程序对应一个端点，类似套接字里的端口。Endpoint addresses for user applications are numbered from 1 to 240.Endpoint 255 is the broadcast endpoint address; the same data can be sent to all applications on a node by sending the message to that address.所以两个节点的程序通信的时候，一个节点不仅要知道dest节点的地址，还要知道那个程序对应的endpoint。

2）Application Profiles

The ZigBee Alliance has defined a number of standard profiles for ZigBee devices. A profile relates to a particular application and/or market and contains descriptions of the types of devices and interfaces which are needed for that particular application.

Within each Application Profile, a number of Device Descriptions are defined, describing the types of devices the profile supports.在Application Profile里描述了特定应用中会用到的节点上的设备（如开关，led，一些控制器。节点上的device很多，在某一个应用中不是所有的devices都会用的上），每个设备在Application Profile里对应一个device ID。

profile定义了：device的类型（厂商型号等），device产生的信息时作为输出还是输入，信息的格式。

属性包括：信息的分段划分（individual pieces是帧格式吗？），可能的值，格式与类型。

多个属性组成了簇（clusters）。下面会详细讲。

As well as defining the devices types supported, the profile also specifies the information that a device can generate as output and can use as input, together with the format this information takes. The individual pieces of information are called attributes, and their possible values and format or type (e.g. 8- or 16-bit integer, time value etc) are defined as part of the Device Descriptions in the profile. Attributes aregrouped together into “clusters” for the device, which can be either inputs or outputs. Clusters and attributes are described in detail below.

3）属性和簇

A given ZigBee device profile has associated “attributes” and “clusters” which define the type of data that a device with this profile may exchange with other ZigBee devices.

• Attribute
  

Each data item that passes between devices of a ZigBee network is called an attribute. Each attribute has its own unique identifier. For example, a switch device can have an attribute with identifier OnOff whose value represents the action to be performed: On (0xFF), Off (0x00), Toggle (0xF0).

• Cluster
  

A number of attributes are grouped into a “cluster”, where each cluster has its own unique identifier. For example, for an HCL Switch Remote Control (SRC) device, there is a cluster with identifier OnOffSRC containing the attribute OnOff. Clusters may be mandatory or optional for a device to support.

A cluster may contain several attributes.A profile can have several associated clusters.

The Application Profile defines which clusters are mandatory（强制的） and which clusters are optional for the device. The clusters supported by a device determine the other devices with which it can communicate.比如，温度传感器读取得clusters和温度控制的clusters的格式应该是兼容的（compatible）。

4）发现（Discovery）

zigbee specification是设备容易了解网络中其他节点的能力（capacity），如他们的地址（MAC地址或短地址）点上运行的应用程序类型，他们的供电，休眠行为。这些信息存储在节点的Descriptors中，查询节点（enquiring node ）用它来调整自己的行为来适应网络的需要。（ This information is stored in descriptors (see below) on each node, and is used by the enquiring node to tailor its behaviour to the requirements of the network.） Discovery的典型应用是在被介绍进一个用户定义网络（如一个安全或者灯控制系统）中时使用。为了让节点加入网络，用户可能需要按某个按钮，打开某个开关等行为；首先节点需要找到是否有合适的节点进行对话。比如在HCL（灯控制系统）中，一个节点要适应HCL profile，它需要尝试找到一个controller节点——好把自己的开关状态信息发送过去。 （For a device implementing the switch conforming to the HCL profile, it tries to find devices containing HCL load controllers to which it would make sense to send its switch state information.）

• Device Discovery
  

Device Discovery returns information about the addresses of a network node. The retrieved information返回信息 can be the MAC (IEEE) address of the node with a given network address, or the network address of a node with a given MAC address.对于router和coordinator除了返回自己的地址之外，还会有选择的返回与之相关的节点的地址。. In this way, it is possible to discover all the devices in a network by requesting this information from the Co-ordinator (network address 0) and then using the list of addresses corresponding to the children of the Co-ordinator to launch other queries about their child nodes.

• Service Discovery
  

Service Discovery allows a node to request information from a remote node about the remote node’s capabilities. This information is stored in a number of descriptors (see below) on the remote node, and includes:
• The device type and capabilities of the node
• The power characteristics of the node
• Information about each application running on the node
• Optional information such as serial numbers
• Other user-defined information; for example, easily understandable names such as “MtgRoomLight”.
Requests for these descriptors are made by a device as part of the discovery process that is typically part of the device’s configuration and integration into a ZigBee network.

5）描述（Descriptors）

节点中存储了3个强制的描述（descriptors ）和两个可选择的描述。其中3个强制描述是Node, Node Power and Simple descriptors。可选择的两个描述是the Complex and User descriptors 。

For each node, there is only one Node and Node Power descriptor. For each applicationrunning on an endpoint, there is a Simple descriptor and there may also be Complex and User descriptors in the device.

The Node, Power Node and Simple descriptors are outlined below. For full details of descriptors, refer to the ZigBee Application Framework API Reference Manual（在这里我不得不抱怨一下，jennic的中文参考资料少的可怜，只能读英文手册，蛋疼无比）.

• Node Descriptor
  

The Node descriptor contains information on the capabilities of the node, including:
• Type (End Device, Router or Co-ordinator)
• Frequency band in use (868 MHz, 902 MHz or 2400 MHz)
• MAC capabilities – that is, whether:
􀁹 the device can be a PAN Co-ordinator
􀁹 the node implements a Full-Function or Reduced-Function IEEE 802.15.4 device
􀁹 the device is mains powered
􀁹 the device is capable of using MAC security
􀁹 the receiver stays on during idle periods
• Manufacturer code
• Maximum buffer size (the largest data packet that can be sent by an application in one operation)

• Node Power Descriptor
  

This Node Power descriptor contains information on how the node is powered:
• Power mode – whether the device receiver is on all the time, wakes up periodically as determined by the network or only when an application requires (e.g. button press or period measurement)
• Available power sources – indicates whether mains, rechargeable or disposable batteries (or any combination) can be used to power the device
• Current power sources - indicates which power source (from mains, rechargeable or disposable batteries) is currently being used to power the device
• Current power source level – indicates the level of charge of the current power source

• Simple Descriptor
  

The Simple descriptor for an application includes:
• The endpoint in the device that the application resides on
• The Application Profile that it implements
• The Application Profile device identifier and version
• Whether there are corresponding Complex and User descriptors
• Lists of input and output clusters (see Section 2.3.3) that the application uses and provides, respectively

6）ZDO（ZigBee Device Objects）

ZDO是一个应用程序，管理各种被描述过的进程（processes），它在应用层，对应end point 0，扮演一下角色。

• Defines the type of network device: Co-ordinator, Router or End Device.
• Initialises the node to allow applications to be run
• Performs the Device and Service Discovery process
• Implements the processes needed to allow a Co-ordinator to create a network, and Routers and End Devices to join and leave a network
• Initiates and responds to binding requests (see Section 2.4.2)
• Provides security services which allow secure relationships to be established between applications
• Allows remote nodes to retrieve information from the node, such as routing and binding tables, and to perform remote management of the node, such as instructing it to leave the network。

ZDO功能的实现是基于stack提供的服务，ZDO通过zigbee device profile和cluster mechanism（应用程序之间用来进行交互）种方式使得用户程序可以使用（access）stack服务。

4.节点间建立通信

这一节是关于一些进程（processes）使网络设备之间交换信息和执行（perform）有用的功能（functions）。为此，一个设备必须能够找到网络中其他设备，连个设备要通信，他们的交互的数据格式应该是兼容的。可以使用service discovery实现两点兼容。

The Service Discovery and Binding mechanisms are described in the subsections below.

1）service Discovery

一个节点通过service discovery寻找和选择跟哪个节点通信，节点通过广播消息获得其他节点的服务请求，有需求的节点会单播进行回复。意味着节点可能受到不止一个回复。

在回复的信息里包含了romote node的网络地址，节点会存储下来romote节点的网络地址，以备以后再与之通信。

2）Bingding

一种节点之间进行绑定，绑定之后通信更方便，但是绑定关系被存放在coordinator中，我的毕设不需要这个功能。

5.软件详细结构

前面简单的把程序分为三层，下面介绍详细分层：

1）软件分层

The above diagram shows (from bottom to top):

• Physical/Data Link Level
  

This consists of the IEEE 802.15.4 PHY and MAC layers, described in Section 2.1.

• ZigBee Stack Level
  

This includes:
• Network (NWK) layer: The NWK layer handles network addressing and routing by invoking actions in the MAC layer. Its tasks include:
􀁹 Starting the network and assigning network addresses (Co-ordinator only)
􀁹 Adding devices to and removing them from the network
􀁹 Routing messages to their intended destinations
􀁹 Applying security to outgoing messages
􀁹 Implementing Route Discovery in Mesh topologies and storing routing table information
• Security plane: If implemented (not available in the Jennic ZigBee stack), this plane spans the NWK and APS layers (see below), and provides security services; for example, security key management, datastream encryption and decryption. It may use hardware functions provided in the node to perform the encode and decode functions efficiently.

• Application Level
  

This includes:
• Applications: Up to 240 application instances are supported on a single ZigBee node. Each application instance is a network endpoint and is numbered between 1 and 240 (note that endpoint 0 is reserved for the ZigBee Device Objects of the node).
• Application Framework (AF): The AF facilitates interaction between the applications and the APS layer (see below) through an interface known as a Service Access Point or SAP (see Section 2.5.2). All application instances are contained inside this framework.（是否可以理解为，AF由一系列SAP构成）
plication Support sub-layer (APS): The APS layer is responsible for:
􀁹 Communicating with the relevant application; for example, when a message arrives to illuminate an LED, the APS layer relays this instruction to the responsible application using the endpoint information in the message. The message is passed through the Service Access Point which exists between the APS layer and each application (endpoint).
􀁹 Maintaining binding tables (see Section 2.4.2) and sending messages between bound nodes.

• ZigBee Device Objects (ZDO): The ZDO represents the ZigBee node type of the device (Co-ordinator, Router or End Device) and has a number of communication roles. The ZDO is an endpoint, numbered 0. For more information, refer to Section 2.3.6.
• ZDO Management plane: This plane spans the NWK and APS layers, and allows the ZigBee Device Objects (ZDO) to communicate with these layers when performing its internal tasks. It also allows the ZDO to deal with requests from applications for network access and security functions using ZigBee Device Profile messages.

2）ervice Access Points
A Service Access Point or SAP implements a set of operations to pass information and commands between layers. There are usually four types of operation implemented by a SAP:
• Request: Typically, a layer using the services of another layer generates a Request to the lower layer.

对于请求的回复分为两种：confirm和response
• Confirm: In general, the lower layer responds with a Confirm, which indicates whether it has accepted or rejected the request. A rejection could occur if the Request is invalid or the layer does not implement the operation concerned (the operation could be defined as optional).
• Response: Normally, Requests result in some sort of Response from the lower layer. This may be a simple status message indicating that the Request has been performed, or may contain further information that the Request has asked for. Responses can be immediate or delayed:
􀁹 Synchronous Response: Responses may be generated immediately after the Request has been issued; for instance, if the information or command is available on the local node.
􀁹 Asynchronous Response: A Request may require messages to be sent over the network to a remote node, in which case there will be a delay between issuing the Request and the arrival of the Response.
The SAP mechanism allows both types of Response to be handled and delivered to the higher layer.
• Indication: An Indication is generated when the lower layer has unsolicited（主动提供的） information or commands to be delivered to the higher layer, possibly as a result of a Requestfor information local to the node from a remote node.如当底层接到远端节点发来的请求时会向上层主动提供信息。