Solution to MSTP frame desynchronization

Updated on 2021.7.13

We had discussed BACnet MSTP weakness to frame desynchronization in below:

BACnet MSTP frame lost synchronization

Attack BACnet MSTP by frame desynchronization

But what is BACRouter’s solution to this problem, let’s look for the clues from the standard.

9.5.2 Variables

SilenceTimer: A timer with nominal 5 millisecond resolution used to measure and generate silence on the medium between octets. It is incremented by a timer process and is cleared by the Receive State Machine when activity is detected and by the SendFrame procedure as each octet is transmitted.

9.5.3 Parameters:

Tframe_gap: The maximum idle time a sending node may allow to elapse between octets of a frame the node is transmitting: 20 bits times.

Tturnaround: The minimum time after the end of the stop bit of the final octet of a received frame before a node may enable its EIA-485 driver: 40 bits time.

Tpostdrive: The maximum time after the end of the stop bit of the final octet of a transmitted frame before a node must disable its EIA-485 driver: 15 bit times.

9.5.5 The SendFrame Procedure

If SilenceTimer is less than Tturnaround, wait (Tturnaround – SilenceTimer).

9.2.3 Timing

Transmitter disable: The node shall disable its EIA-485 driver within Tpostdrive after the beginning of the stop bit of the final octet of a frame in order that it not interfere with any subsequent frame transmitted by another node. This specification allows, but does not encourage, the use of a “padding” octet after the final octet of a frame in order to facilitate the use of common UART transmit interrupts for driver disable control. If a “padding” octet is used, its value shall be X’FF’. The “padding” octet is not considered part of the frame, that is, it shall be included within Tpostdrive.

(It’s unclear that whether the Tturnaround include “padding” octet, but in 135.1 testing standard, chapter 12.1.3.4 “Verify T turnaround”: If the reference master employs a “padding” octet of X’FF’ as the last octet of every frame, then the time shall be measured starting from the trailing edge of the stop bit of the octet that precedes the X’FF’ “pad” octet in the frame transmitted by the reference master)

So in a valid frame,  the maximum bus idle is Tframe_gap plus tailing bit “1” in the previous octet. it’s 29 bits time (assuming previous octet is X’FF’)

Considering “padding” octet, the minimum bus idle between 2 frames is Tturnaround – Tpostdrive + 9 (tailing bit “1” in the “padding” octet), it’s 34 bits time.

BACRouter use a revised RSM to implement previous logic:

  1. When the time between receiving 2 sequential bytes is longer than 20 bits time, the receiving frame is aborted.
  2. Idle time on the bus greater than or equal to 33 bits time means there is a new frame.
  3. To be compatible with devices not respecting to Tturnaround, any data following valid frame will be regarded as new frame.

In 115200bps, one bit time is only 8.7us. To precisely measure duration of idle line, the timer granularity of BACRouter is set to only 5us. It help to resist to frame desynchronization, and reach 98.8% bandwidth utilization on 115.2kbps because BACRouter no more waste time when 40 bits Tturnaround is over.