Update on 2020-11-20 (Appended info. about JCI module)
MSTP baudrate is always painful for field technician. If the baudrate is wrong, device can’t join a MSTP bus.
Most devices have fixed baudrate. To modify the baudrate setting, technician have to physically access the device and change dip switches. Some devices support changing baudrate by BACnet service. but before that they should already have correctly baudrate setting for BACnet service to access it.
Some vendors implement auto baudrate, but introduce more problem than it solves. There are two types of auto baudrate mechanism:
Starting detection: The device detects and adopts baudrate on the bus when it starts. then never changes baudrate.
Dynamic detection: The device does same as starting detection type when it starts, but if it find there are error on bus for a predefined time, it considers that the baudrate is changed, it detects baudrate again.
For both types, it is difficult to change baudrate when devices is working. Simply changing baudrate on all fixed baudrate devices can not work, because auto baudrate devices are still working on old baudrate. The solution is to power off all auto baudrate devices, then power on all auto baudrate devices（Don’t power off/on auto baudrate devices one by one)
Our new firmware(>=2.0) introduces new baudrate management mechanism(Patent pending). There are 3 types of baudrate mode for BACRouter : Fixed/Auto/Force:
Fixed baudrate mode works as most traditional devices.
Auto baudrate mode is same as above-mentioned dynamic detection. The predefined time to re-initiate detection is 10 error frames, it usually take several seconds.
Forced baudrate mode is same as auto mode except that when the device get token, it changes baudrate to predefined value.
When there is a device with forced baudrate mode, the baudrate on the bus will be forced to predefined value. Devices with auto baudrate mode will automatically synchronize to predefined baudrate. Devices with fixed baudrate mode but baudrate setting different with predefined value will not be seen on bus (It’s easy to check out in “Recent active devices” field from BACRouter’s runtime info). Devices with starting detection type may run on wrong baudrate, they will not be seen on bus too, but powering off/on them one by one will synchronize them to forced value.
More than one device with forced baudrate mode could coexist on a bus, but the baudrate values on them should be same.
JCI FEC/IOM modules implements baudrate dynamic detection mechanism, the re-detect interval is about 150 sec on the test.
On a test bus , BACRouter cooperate perfectly with FEC2611, IOM3731, the baudrate is dynamically controlled by BACRouter from 9.6k ~ 76.8k, FEC2611 and IOM3731 will catch up after 2.5 minutes.
From firmware ver2.0, BACRouter introduced new “Max_info_frames by token occupy time” feature.
In BACnet standard of MSTP, a master device could hold token until it has sent frames up to Max_info_frames. The default value of Max_info_frames is 1. But for router, this value may be increased to improve bandwidth between networks. Mostly the suggested value for router is between 5 to 20.
MSTP works as a field bus for controllers; sensors and actuators. The data exchanging latency between devices usually should be guaranteed. We recommend devices get token at least every 1 second.
The APDUs passing router usually have size between 10~50 bytes, but could be up to 480 or 1476 (Extended frame). Larger APDU need more time to send or receive.
For APDU which need a reply from targeted device, router has to wait for reply. Usually the targeted device need more time to handle or generate larger APDU, router has to wait longer.
So the time router holding token could be varied much, which impacts latency guaranty of MSTP bus. To avoid this problem, “Max_info_frames by token occupy time” feature limits router’s token holding time.
The limitation is calculated by:
byte_time * 32 * Max_info_frames
For example, Max_info_frames is set to 10. The baud rate is 76800bps, so the byte_time is 0.13 milliseconds:
0.13 * 32 * 10 = 41.6 milliseconds.
When router founds it have held token for 41.6 milliseconds, it passes token to next station, though the frames it sent may be less than 10.
This feature could be enabled/disabled by user from WebUI.
The intent of this benchmark is to investigate the capability of BACRouter. Because of low baudrate of MSTP, there is not a bottleneck on routing packet to/from MSTP network.
BACRouter support 10/100M Ethernet interface, so there will be a challenge to flood it. The testing machine is a Notebook with i7 2.8G 4 cores CPU and 1000M Ethernet card, directly connected to BACRouter with CAT5+ cable. The result is:
Path
APDU size in byte
Max routing rate without packet drop
(per second)
Routing rate in packet flooding
(per second)
Packet flood rate
(per second)
BIP->Ethernet
4
13200
354
79087
750
8980
6111
13500
1476
5520
3800
6832
Ethernet->BIP
4
10100
1138
113000
750
8090
6030
11895
1476
6110
5542
6526
When BACRouter is flooded by small packets, the handling capability dramatically decreased, especially in BIP port.
On 2019-04-16, We made new benchmark on firmware version 2.18, with a new testing machine( i5 4 core CPU and 1000M Ethernet card). the result is:
Path
APDU size in byte
Max routing rate without packet drop
(per second)
Routing rate in packet flooding
(per second)
Packet flood rate
(per second)
BIP->Ethernet
4
15300
1887
68705
750
10300
8645
13005
1476
6300
5424
7179
Ethernet->BIP
4
12750
1937
111358
750
10300
8640
12281
1476
7300
7310
7453
The performance is improved much with new firmware.
Because the same time online for all devices could not be guaranteed, there is no auto addressing solution could avoid MAC conflict. We remove this feature on firmware 3.x. To help determine max_master and unused MAC on bus, “Sniffer mode” could be enabled, then “Current max master” could be obtained from run time info. Unused MAC also could be chosen referred to “Recently active devices”.
Every device on a MSTP bus should have a unique MAC address. For master device, the available address range is 0~127, and 128~254 for slave device.
Usually MAC address is set by DIP switch, jumper, LCD screen, firmware downloaded by configuration tools. Some devices support MAC address modification through BACnet object/property, but before doing that, it should have a valid MAC address to join BACnet network.
If the unique MAC address could be automatic obtained like we get IP address just by plugging notebook into home/office network, it would save a lot of time in commission.
“Zero-Config” only works on fixed configuration that Max-master is 127 and automatic assigned address range is 64~127. If not, it may cause mess.
To avoid above limitation, BACRouter implements proprietary auto addressing solution and keep compatible with “Zero-Config”. It has some attractive features:
Learning Max-master from bus traffic.
Assigning MAC address from highest unused one.
So users have more freedom on MAC address schema, For example, leave address 0~30 for fixed address devices, set Max-master as 40, so automatic addressing devices would use 31~40.
Both Zero-Config and BACRouter’s solution have trouble when a automatic addressing device is pulled out bus then plugged in again without reboot, because a new attached automatic addressing device would occupy the same address.(BACRouter is more weak in such situation because of it’s predictable address assigning), So
ALWAYS power on automatic addressing device after attaching to bus.
But what is BACRouter’s solution to this problem, let’s look for the clues from the standard.
9.5.2 Variables
SilenceTimer: A timer with nominal 5 millisecond resolution used to measure and generate silence on the medium between octets. It is incremented by a timer process and is cleared by the Receive State Machine when activity is detected and by the SendFrame procedure as each octet is transmitted.
9.5.3 Parameters:
Tframe_gap: The maximum idle time a sending node may allow to elapse between octets of a frame the node is transmitting: 20 bits times.
Tturnaround: The minimum time after the end of the stop bit of the final octet of a received frame before a node may enable its EIA-485 driver: 40 bits time.
Tpostdrive: The maximum time after the end of the stop bit of the final octet of a transmitted frame before a node must disable its EIA-485 driver: 15 bit times.
9.5.5 The SendFrame Procedure
If SilenceTimer is less than Tturnaround, wait (Tturnaround – SilenceTimer).
9.2.3 Timing
Transmitter disable: The node shall disable its EIA-485 driver within Tpostdrive after the beginning of the stop bit of the final octet of a frame in order that it not interfere with any subsequent frame transmitted by another node. This specification allows, but does not encourage, the use of a “padding” octet after the final octet of a frame in order to facilitate the use of common UART transmit interrupts for driver disable control. If a “padding” octet is used, its value shall be X’FF’. The “padding” octet is not considered part of the frame, that is, it shall be included within Tpostdrive.
(It’s unclear that whether the Tturnaround include “padding” octet, but in 135.1 testing standard, chapter 12.1.3.4 “Verify T turnaround”: If the reference master employs a “padding” octet of X’FF’ as the last octet of every frame, then the time shall be measured starting from the trailing edge of the stop bit of the octet that precedes the X’FF’ “pad” octet in the frame transmitted by the reference master)
So in a valid frame, the maximum bus idle is Tframe_gap plus tailing bit “1” in the previous octet. it’s 29 bits time (assuming previous octet is X’FF’)
Considering “padding” octet, the minimum bus idle between 2 frames is Tturnaround – Tpostdrive + 9 (tailing bit “1” in the “padding” octet), it’s 34 bits time.
BACRouter use a revised RSM to implement previous logic:
When the time between receiving 2 sequential bytes is longer than 20 bits time, the receiving frame is aborted.
Idle time on the bus greater than or equal to 33 bits time means there is a new frame.
To be compatible with devices not respecting to Tturnaround, any data following valid frame will be regarded as new frame.
In 115200bps, one bit time is only 8.7us. To precisely measure duration of idle line, the timer granularity of BACRouter is set to only 5us. It help to resist to frame desynchronization, and reach 98.8% bandwidth utilization on 115.2kbps because BACRouter no more waste time when 40 bits Tturnaround is over.
As pointed out by previous article “BACnet MSTP frame lost synchronization” , BACnet MSTP has a design flaw on frame synchronization, but how to utilize it to perform attack and strictly obey the standard at the same time?
We make some assumptions here:
There are at least 3 devices on the bus with MAC address 1, 8,10. The device 1 is carefully designed to perform attack. Device 8 and 10 are innocent.
Device 1 supports extended frame, device 8 and 10 are not.
The timers of 3 devices is precise enough.
The work flow of device 1 is:
When get token, send out frame A
Pass token to MAC address 2
When get token again, send out frame B
Pass token to MAC address 2
goto step 1 again.
Frame A is a valid proprietary frame (hexadecimal);
Every thing will go well if there is no frame desynchronization, but after hours running, if device 8 losses synchronization with frame A header (It has same effect if device 10 losses synchronization when device 1 sends frame B) , device 8 find another frame when scan Frame A’s data portion:
For device 10, it get a valid Not-For-Us frame header, so it enter SKIP-DATA state, there is not enough data to skip, so device 10 will wait until Tframe_abort.
For device 1, it’s a BACnet-Extended-Not-Expecting-Reply frame header, because it support extended frame, so it validate header by procedure described in Addendum 135-2012an. Because the data length is too short, so it abort the frame enter IDLE state again, then find another frame:
55 ff 00 01 08 00 00 bf
It’s a token frame passing token to device 1, so device 1 get token then sending Frame B just after Tturnaround:
As mentioned above, Device 10 still wait 1 byte to skip previous frame (because Tturnaround < Tframe_abort), so it miss this frame header. get wrong frame as:
BACnet MSTP datalink layer frame, it has at least 8 octet bytes, including: 2 preamble bytes of 0x55 and 0xff, frame_type, destination_mac, source_mac, 2 data_len bytes, crc, and omissible data portion. We call this type of frame as “MSTP frame”.
EIA-485 frame, it is consisted of bits, including start bit, data bit, parity bit, stop bit. BACnet MSTP using non-return to zero (NRZ) encoding with one start bit, eight data bits, no parity, and one stop bit. The start bit shall have a value of zero, while the stop bit shall have a value of one. The data bits shall be transmitted with the
least significant bit first. We call this type of frame as “byte frame”.
BACnet MSTP Receive Frame Finite State Machine (hereafter refer to RSM) distinguish starting of frame by preamble bytes. If there is no DataAvailable or ReceiveError within a frame for Tframe_abort (60 bits time, but Implementations may use larger values for this timeout, not to exceed 100 milliseconds) , the frame is aborted, RSM search for next frame again.
Because preamble bytes is allowed on other portions of MSTP frame (Extended frame introduced by Addendum 135-2012an is an exception, it use COBS encoding to avoid 0x55 existing in data portion), so RSM may parse MSTP frame beginning from data portion of previous MSTP frame.
The minimum time gap between MSTP frames is Tturnaround (40 bits time), it is less than Tframe_abort, so if RSM lost sychronization of MSTP frame, it may parse the wrong MSTP frame across actual MSTP frames.
There are several cause of losing synchronization:
Program defect on sending or receiving device. It could be eleminated by code review and test.
Timer precision. BACnet MSTP standard only requires a 1% precise timer with a resolution of 5 ms or less. So it is hard to check out Tframe_abort. Because there is only 5 ms of error space between delay and timeout (Tusage_delay to Tusage_timeout, Treply_delay to Treply_timeout), it is very likely causing collisions for slow responding devices.
Noise on bus line. Noise causes byte frame error and crc error, RSM will abort previous MSTP frame in both situations.
Some may argue that MSTP frame integrity is protected by header crc8 and data crc16. Even without considering malicious devices(Here is a attack example) and random data collision, there are still applications may send valid frame in data portion.
(Updated 25 June 2021) For example, There are some products that have implemented a packet capture function on MSTP bus, then the captured data may be transferred by BACnet service (PrivateTransfer or AtomicReadFile?). What would happen if there is electronic noise on the bus when the data is passing through a MSTP network?
It is not only possible to cause MSTP bus being blocked, but also device
malfunction if the wrong frame is a APDU or break whole BACnet
inter-network if the wrong frame is a I-Am-Router-To-Network.
Byte Frame Desynchronization
For the byte frame, losing synchronization usually is caused by noise, no termination or absence of biasing. The symptoms include regarding data bit of 1 as idle line, regarding data bit of 0 as start bit of new byte. In addition to data error, the losing synchronization of last byte in a MSTP frame will introduce measure error of idle time between MSTP frames.
The test criterion is: 115.2kbps, 80m cable. 1 router and 10 mstp master devices, max_master=127, no NPDU traffic on bus, define non used mac as fast device.
Modbus/FreeClient bug: “Runtime Info” may fail to get info from daemon.
Free Client: API get stabilized.
5.03 2024.03.20
Support dynamic IP.
Modbus module has a bug since 5.00 version: the Modbus address setting will not be saved when returning from point editor.
5.01 2024.01.23
v5.00 has a bug when upgrading from old version.
5.00 2024.01.05
Add Free Client Module to support Lua script driven versatile Gateway functionality for RS485 and TCP. API handbook is still on progress.
v4.34 introduced a bug in Modbus module that will be triggered when write to multi-state objects that mapped to partial register.
COV notify has a race condition bug for multi-state input object.
RS485 now have 2 none parity: none parity with 2 stop bits, and none parity with 1 stop bit. Usually none parity with 2 stop bits should works for most cases, no matter the stop bit setting on the other side, but for some weird Modbus device that don’t silent at least 3.5T before answering, for example TMS2000 thermostat from J***n Controls, set to none parity with 1 stop bit is the only way to work with them.
Network layer bugfix: Buffer overflow when caching un-routeable packet.
4.34 2023.09.04
135-2016br-2: Accept writes of NULL to non-commendable properties.
MSTP driver reports new packets to upper layer immediately instead of a 20ms period.
Modbus script: context add point name and point description.
Modbus supports multistate objects on 2 registers.
Modbus support analog objects on part of register.
Modbus support customized analog objects on up to 24 registers.
Modus add “Tolerate unmatch” option when mapping output object. When the read back value does not match last output value, “Reliability” property keeps unchanged, Output value will be re-written on “Offline update interval”.
Modbus driver remove some over-skill optimizations: merge multiple write requests on same register to single write; cache analog conversion from Modbus to BACnet.
4.3201 2023.03.30
Modbus bugs introduced by v4.23:
RTU/ASCII slow baud rate may fail.
TCP slave report server exception may cause segment fault.
4.31 2023.03.23
WebUI: On the Modbus slave setting page, users often incorrectly click “Edit” or “Copy” button. “Edit” button is removed, Point editing popup now could be fired by click object name or property.
4.3002 2023.03.20
A long time BACnet bug is found: Default writing priority is not set when priority is ignored in the APDU.
Modbus: BV/BO mapping to bit in holding register should refer to “Write register singly” instead of “Write coil singly” when choosing write function code.
Modbus: Extends TCP slave address(id) range from 1~247 to 0~255
Modbus bug introduced by v4.23: Offline device may increase fail-rate to online device.
WebUI: More detailed Modbus fail messages will be reported on “Read Test” and “Write Test”
WebUI: UI optimized for Modbus parameter editing.
WebUI bug introduced by v4.25: Modbus “Write Test” should not be enabled when mapping to read-only Modbus address, or BACnet object type is input.
WebUI: promote user to notice conflict of “Register write singly” setting when “Write Test” writing to multiple registers.
WebUI: enable drag&drop to move point in slave settings
WebUI: enable drag&drop to move state when editing multi-state object.
4.29 2023.03.14
WebUI: When exporting something to a file, popup a dialog to modify file name.
4.28 2023.03.11
WebUI bugfix: Modbus slave “Reset” button will not rollback modification of “Batch Data Address”.
WebUI: Modbus slave adds new “Reorder Instance” function to reorder object instance of points.
4.27 2023.03.09
Total limitation for capture buffer size is changed from 16M to 12M.
WebUI bugfix: Modbus slave’s “Batch Conversion” should skip customized data type.
WebUI: Exported Modbus master/slave configuration should carry referenced script. When importing configuration, script in it will be imported too.
4.26 2023.03.06
BIP udp port’s low limitation is lowered down to 1024.
Many bugfixs and improvements for script:
When there is a OOM, all scripts will be temporally unloaded one by one, memory reclaimed for each script will be logged. The maximum reclaimed one will be regards as leaking memory and be forcedly completely unloaded (even the byte code will be dropped), other scripts will be reloaded to run again.
WebUI adds “Runtime Info” for script to help finding memory leaking.
Script importing will go to edit mode.
New and imported script can replace old script with same name after confirmation.
4.25 2023.03.02
We always get reports from clients about weird Modbus devices which can not be linearly converted from Modbus value to float used by BACnet analog object. so we introduce Lua script to extend BACRouter’s ability to mapping such devices.
User could import/create/edit Lua script by the WebUI. Thanking to the WASM support in modern Web browsers, User could run and debug Lua script by the WebUI, even though the Modbus device is offline. The error will be caught and promoted to user, the Lua print function will output to web browser’s console.
As a result, BACRouter drops support for IE, but Edge will still work.
From v4.23, we abstract Modbus rs485 driver to support common rs485 devices in the future, but that may introduced bugs in Modbus Gateway function for serial devices (MSTP was not affected, because it’s different driver). This release fix some of them:
Offline devices may cause segment fault.
Device responding time for the WebUI raw test result is inaccurate.
4.23 2023.02.14
Bugfix: Buffer overflow when Modbus module maps Ananlog_Output to multiple registers.
Bugfix: Modbus TCP bug would be triggered when there are more than one slaves defined under a TCP master and the “Keepalive” is 0.
4.21 2022.11.13
WebUI removes support for IE10.
Historical data of runtime info could be reset.
MS/TP runtime info introduces colored mac table.
4.20 2022.07.25
Support for BACRouter-S (single ms/tp port router) is integrated.
4.19 2022.05.20
Modbus Gateway CSV file importing:
1. There is a bug ignoring Modbus data unit type from 2th point.
2. Mulltistate point without states defined need not to be forcedly disabled.
4.18 2022.02.07
From v3.00, we added a integrity check: A relayed NPDU with 255 hop count is regards as malformed and will be dropped. The log will show: [WARN]npdu_decode_pci: hop count should not be 255 for relayed npdu
Dropping such NPDU may causes interoperability problem with other routers. Though the hop count is incorrect here, BTL test does not completely cover it, So there are still BTL passed routers have such bug.
The solution is changing the hop count to 254 and accepting it. The log will show: [WARN]npdu_decode_pci: hop count should not be 255 for relayed npdu, change to 254
4.17 2022.01.10
More informative log
ReadPropertyMultiple: potential buffer overflow when generating large reply apdu.
Race condition when device instance is modified by BACnet service.
When processing write-bdt bvll request, if BDT is not changed, configuration saving will not be fired to save flash’s life.
Race condition when network number of VBUS is changed by initialize-routing-table request while processing confirmed request for virtual device.
MS/TP bug introduced by 4.10 may cause incorrect timing when receiving bad frame head.
Modbus: MultiState objects could be mapped from bit range in a register.
4.14 2021.8.25
There is a bug on rescue upgrade that old configuration is not deleted which may prevent WebUI from loading. If old version WebUI could not be loaded because of invalid configuration, please rescue upgrade to this version twice, first time it will upgrade firmware, the second time it will delete old configuration.
A bug on Modbus virtual device mode is fixed which cause malfunction when virtual devices are more than 5.
A WebUI bug when Modbus slave number overflowing limitation is fixed.
The limiations of Modbus master and slave are changed from 100 to 128.
A WebUI bug when disabling “Packet capture mapping” is fixed.
More name delimiter characters are added. Internal object names are modified to avoid collision with new name delimiter characters.
Modbus master: Batch Point, Batch Instance, Batch Import
Modbus slave: Import Point
Modbus master/slave: UI for copy and move up/down.
4.09 2021.7.02
Compatible to new hardware revision.
BTL compatibility: max_info_frames/max_master are writable from BACnet side.
4.08 2021.6.22
BTL 10.2.3.6 requires routers sending who-is-router-to-network to looking downstream router before reject messages.
Bugs which will be triggered when VBUS is enabled have been fixed.
4.07 2021.6.13
UI bug introduced in 4.05 may prevent user to access WebUI in certain situation. (Please note that http://IP/app/upgrade is a rescue entry to upgrade firmware)
Some minor UI bugfixs.
4.05 2021.6.7
Modbus object name remove top level “modbus_master”.
Object name delimiter “|” become configurable.
Value object is allowed to overlap with output object.
Some UI bugfixs.
4.04 2021.6.1
Lots of update on Modbus Gateway module: Multistate object, Value object, Binary text, Read group, Batch conversion, Import/Export CSV object definition.
Bugfix for BACnet mapping module for capture control feature. The bug may cause daemon restart if capture is restarted from BACnet side.
Bugfix for max_apdu_length_accepted for outgoing request on ms/tp if extended frame feature not enabled.
More infos including “total/free memory”/”Booting time” are added into “System Settings” page on WebUI.
3.21 2021.2.22
Bugfixs for mstp slave proxy: daemon segfault&restart when binding removing. Incorrect hop count when send I-Am reply on other ports.
Reply APDU and network reject messages should respect busy status of destination net too.
3.20 2021.1.26
Limitation of creating network port is removed, only total network port rule applies now. It’s more easy for user to adjust and switch configuration of port.
If root password has not been set yet, the button to set root password on “System Settings” page will has red color to remind user.
3.19 2021.1.20
Soc bug that prevent MS/TP from startup will occasionally be triggered on 3.18
Reject-Message-To-Network should be unicasted to compliant to BTL.
TTL of registered foreign device should plus 30 seconds to compliant to BTL.
Confirmed service sent to broadcast address should be dropped on application layer to compliant to BTL
BBMD should drop unicasted forwarded npdu from local subnet with same udp port.
Bug on multiple BBMD detection when checking existence of entry in BDT with different udp port is fixed.
3.17 2021.1.13
WebUI adds network settings page, which will show routing table.
A bug on slave proxy is fixed: when there is a unicasted who-is send to slave device, the device instance range carried by the service should be respected, same as broadcasted one.
3.15 2020.10.26
MS/TP duplicate detection algorithm which is learned from duplicating of JCI FEC2611 and IOM3731 is added.
3.14 2020.10.23
MS/TP duplicated MAC detection is implemented. Duplicated MAC will be shown by Red color in “Recently active other devices”. Because of complexity of behavior on duplicating situation, the detection is inaccurate and for reference only.
A potential bug introduced from 3.0 in the low level MS/TP state machine is fixed.
3.13 2020.10.5
Based testing and clients’ feedback, many(maybe most) devices does not obey the MS/TP receive frame finite state machine described in BACnet standard when they encounter error. Our proprietary “Timeout Interrupt” feature will cause trouble or degrade performance in this situation. So “Timeout Interrupt” feature is removed.
More statistics is added to MS/TP runtime information page.
WebUI bug on BIP’s Foreign Device Mode introduced from 3.08 is fixed.
3.11 2020.7.14
Fix mstp calculation bug on time used for invalid packet.
Fix bug on mstp slave proxy introduced by 3.08
Some minor WebUI improvements.
3.10 2020.7.1
The config file format is changed much between 2.x and 3.x, so from 3.00 to 3.09, when upgrade firmware, the upgrading script will install new config file. This version add a “Keep config” option when upgrade firmware. If config file have something wrong, the WebUI will popup a warning when it is opened.
3.09 2020.6.30
Fixs bug introduced in 3.08 when fetch mstp runtime info.
Some minor WebUi improvements.
3.08 2020.6.28
Bugfix: 1 hop broadcast distribution is optional for BBMD, From version 3.00, BACRouter force other BBMDs to use 1 hop distribution if cross-network broadcast support is enabled. It’s incorrect behavior and fixed in this version.
BDT editing UI is improved. When submitting, BDT entries will be checked to detect possible misconfigure. The checking is also taken when receiving Write_BDT BVLL message.
If multiple BBMD support is not enabled, when receiving forwarded npdu from BBMD not present in local BDT, the npdu will be dropped and logged. It will help distinguishing configure problem of BBMD on most situation. “Report multiple BBMD” function in last verion is covered by this function, so it’s removed.
The filename of downloaded config is set as IP_Version.json, for example: 192.168.100.1_3.08.json
Config uploaded from file will be edited in WebUI before saving to eliminate any potential incompatibility.
3.06 2020.5.22
Ethernet is disabled by default. If BIP and Ethernet are enabled at the same time, a warning of possible circular route will be promoted.
The default capture size increases to 4M.
3.05 2020.5.15
Capture control function is mapped to BACnet. Each datalink port has its “Capture buf_size” and “Capture command” Multi_State_Value. “Capture buf_size” could be set between “64K” to “16M”. “Capture command” could be set between “Stop&Clean”, “Start”, “Stop”.
3.04 2020.4.28
Password for root could be modified from WebUI now.
3.03 2020.4.23
BACRouter verifies other router’s live by query its routing table with Initialize-Routing-Table message. But addendum 135-2012AL removed the enforced supporting of Initialize-Routing-Table from router. So in this version BACRouter also monitors Reject-Message-To-Network message that could only be sent by router.
BIP BVLL header of forwarded npdu is 6 bytes larger than other npdu, so there was potential bug on packet length verification that is fixed on this release.
3.02 2020.3.26
Minor bugfixs for UI
3.01 2020.3.17
“Download config” and “Upload config” are added to “System setting”
3.00 2020.3.10
Add Packet capture feature：
Supported on all ports(Ethernet, BIP, MSTP).
Because Wireshark could not decode MSTP extended frames, MSTP extended frames are converted to traditional data frames. Fortunately, Wireshark doesn’t complain about overflowed data length.
MSTP packet could be downloaded as “Interval format”. it could be used to show exact idle time before packet by selecting “Seconds Since Previous Captured Pakcet” as “Time Display Format” in Wireshark. It is very helpful to analyze timing and performance problem.
MSTP support real time analysis for max master and show it on run time info, if the value is not matched to the setting, “unmatched” is showed after it.
MSTP support sniffer mode. it could analyze and record data without interfering the bus.
The WebUI of MSTP port add options for basic mode and extend mode.
The timeout settings for MSTP are changed from Integer to Float.
MSTP port’s slave proxy is only support broadcasted Who-Is in previous version. Now it support unicast too.
MSTP port’s slave proxy send unicasted I-AM instead of broadcasted one in previous version.
There is a bug in previous version that Who-Is packet readed by MSTP slave proxy module bypass source address routing verify. it’s fixed this time.
BBMD module add option to log error when multiple BBMDs are found in local lan.
Modify feature introduced by version 2.17. “Accept unmatched destination IP” option is provided, if it is selected, only warning message will be logged, else error message will be be logged and the packet will be dropped.
Process 0 in unconfirmed COV notification service is reserved for unsubscribed notificationCOV. Not longer reports error when can not find matched process for 0.
2.17 2019.4.2
In previous version, when BACRouter receive Original-broadcast BVLL from unicast address or Original-unicast BVLL from broadcast address, it would print error message then drop it. A customer reported that Johnson Controls’ CCT sends Original-broadcast BVLL to unicast address, so now we only print warning message.
2.16 2019.2.25
From version 2.0.8, only proprietary network layer messages would be relayed. Now all unknown network layer messages will be relayed.
2.15 2017.10.19
Redirect URL from “/” to “/?” to support Edge web browser (avoid keep asking authorization)
MSTP: Fix bug in standard state machine which would cause passing token to self when duplicated token is found.
MSTP: With standard state machine device in sole master mode would send max_info_frames * Npoll frames after polling one master. A more reasonable behavior is implemented that device send max_info_frames * Npoll frames after finish polling all masters.
2.14 2017.10.13
Fixed bug introduced from 2.0, it should not wait reply when it send expecting reply request to mac address 255 on MSTP.
2.13 2017.9.19
Potential bug (barely) may be triggered if MSTP auto mac and baudrate forcing are enabled together.
2.12 2017.7.10
Optimizing route entry protection: Deletion from route hop will bypass protection.
Support devices utilizing 6.5.3 methods 1 and 4 for establishing the address of a BACnet router for a particular DNET.
2.11 2017.6.16
This update help building up routing table quickly in large BACnet inter-network.
When BACRouter startups, it broadcasts out Who_Is_Router_To_Network without network number specified to learn routing info from other routers.
When Who_Is_Router_To_Network/Router_Busy_To_Network/Router_Available_To_Network without network number specified is received, BACRouter reports network number up to 1120 instead of 112 in previous version.
2.10 2017.6.13
Bugfix: ReadRange on property_list should not return object_identifier; object_name; object_type.
Delay 1 second for sending Network_Number_Is when router startup, because if router is a BIP foreign device, the foreign device registering have not completed yet.
2.09 2017.6.10
Protect route entry 60 seconds from last activity. Avoid broadcast storm in circular routing path.
2.08 2017.6.7
Bugfix: Vendor proprietary network message should be correctly relayed.
When relay Reject-Message-To-Network with reason 4(Too long), use unicast address instead of broadcast address.
Relax daemon’s max_apdu_retries to 10, in accord with WebUI.
2.07 2017.6.5
Compliant to BACnet Router and BBMD device profile.
Try to purge invalid route entry if no reply is received for Who_Is_Router_To_Network or Initializing_Routing_Table. This feature helps to rescue from mess network configuration.
Avoid sending too many I_Am_Router_To_Network with circular routing path.
Reduce memory consumption in complicated inter-network.
2.06 2017.6.1
Avoid BBMD broadcast storm. If Forwarded-NPDU is received from broadcast address, do not re-broadcast it.
When relay Reject-Message-To-Network with reason 1/2/4, use broadcast address.
Discard Reject-Message-To-Network with incorrect route info.
Check source net of incoming NPDU.(Trickily handle Initializing-Routing-Table)
2.05 2017.5.23
Bug: global broadcasted initializing-routing-table should be executed.
Bug: WebUI BIP mode select should not be applied without submiting.
Limit number of route entry in runtime info page to avoid request failure in very large internetwork.
2.04 2017.5.11
Fix WebUI Bug for verifying BDT.
Save configuration and restart when receive reinitialize-device service request.
2.03 2017.5.7
BIP BBMD NAT mode support udp port modifying.
BIP BBMD NAT mode do not listen to local net broadcast address and not send broadcast to local net.
BIP foreign device mode do not listen to local net broadcast address.
2.02 2017.5.5
Regards device sent Who-Is-Router-To-Network has no route to that network.(Delete that route entry from route table)
When Initializing-Routing-Table request modify network number of route port, I-Am-Route-To-Network is sent to report new network number.
Fix bug introduced by ver2.0 for saving new BDT modified by BVLL Write-Broadcast-Distribution-Table message.
2.01 2017.5.3
Add upgrade entry “http://ip/app/upgrade for rescue.
A common problem of BACnet MSTP is low bandwidth utilization. Some researches disclose that more than 50% traffic on MSTP bus is token frame.
Unfortunately, many poor implement of MSTP make it worse. For example, in standard, the Tturnaroud is 40 bits, that is said, on 115200bps, node only need to wait 0.35 millisecond to send frame when it receive token. But in practice, there are a lot of devices wait at lease several milliseconds.
Our implement of MSTP try best to improve bandwidth. In previous laboratory test, we achieve 98.8% bandwidth utilization on our BACnet router. The test criterion is:
115200bps, 4 node with mac address from 0 to 3, max_master set to 3, no NPDU. in theory, the max token relay rate is 960 per seconds. we get 948 per second.
In another test, we send a read property request (23 bytes frame) each second, then get a Reply_Postponed frame, then a read property response (29 bytes frame). we still get token relay rate of 943 per second.
Update Feb, 2017,We make a stress test for ReadProperty service on above configuration, set max_info_frames to 10 in all devices, 2 devices request, the other 2 devices reply. The result is 153~154 ReadProperty requests are served each second.
Update March,2017.Thank to our detailed runtime info, user could get token pass rate easily. 9 months after we release first firmware, We perform above test again, then get 956.6 per second, 99.6% bandwidth utilization.
When there is a device with forced baudrate mode, the baudrate on the bus will be forced to predefined value. Devices with auto baudrate mode will automatically synchronize to predefined baudrate. Devices with fixed baudrate mode but baudrate setting different with predefined value will not be seen on bus (It’s easy to check out in “Recent active devices” field from BACRouter’s runtime info). Devices with starting detection type may run on wrong baudrate, they will not be seen on bus too, but powering off/on them one by one will synchronize them to forced value.