Copyright © 2007 ZigBee TM Alliance. All Rights Reserved. Wireless Control That Simply Works ‘Under the Hood‘ of a ZigBee 2006 Network Ian Marsden Chairman.

Wireless Control That Simply Works

‘Under the Hood‘ of a ZigBee 2006 Network

Ian Marsden

Chairman ZigBee NWG

Director, Software Engineering, Integration Associates

ZigBee is built upon the foundations provided by the IEEE 802.15.4 standard.

ZigBee Stack

Physical (PHY) Layer

Security Service Provider

PD-SAP

APSSE-SAPNLSE-SAP

PLME-SAP

Medium Access Layer (MAC) Layer

MLME-SAPMCPS-SAP

Network (NWK) Layer

NLME-SAP

NLDE-SAP

Application Support (APS) Layer

APSDE-SAP APSDE-SAP APSDE-SAP

APSME-SAP

Application Framework

Application Object 240

[On Endpoint 240]

Application Object 1

[On Endpoint 1]

ZigBee Device Object (ZDO)

[On Endpoint 0]

ZigBee Devices Type Model

802.15.4Device Type

FFD – Full Function Device

RFD – Reduced Function Device

• Distinguishes the type of ZigBee hardware platform

ZigBee LogicalDevice Type

ZigBeeCoordinator

ZigBeeRouter

• Distinguishes the Logical Device Types deployed in a specific ZigBee network

ZigBeeEndDevice

ApplicationDevice Type

e.g.Light Sensor

e.g.LightingController

• Distinguishes the type of device from an end-user perspective

• ZigBee products are a combination of Application, ZigBee Logical, and ZigBee Physical device types• Profiles may define specific requirements for this combination, but can also leave this up to manufacturers

802.15.4 Architecture:

■ Defines basic network structure

■ Provides methods for locating networks

■ Provides methods for joining / rejoining networks

■ Defines direct / indirect data transmission

Architecture:Network Structure in 802.15.4

802.15.4 FFD

802.15.4 RFD

Network Association

MLME_SCAN: Locating Networks

MLME-SCAN.request ScanType = “Active Scan”

ScanChannels

ScanDuration

■ Active Scan

■ Asks on the requested channels for other PANs

■ Returns a list of PANDescriptors

MLME-SCAN.confirm status

ScanType

UnscannedChannels

ResultListSize

EnergyDetectList

PANDescriptorList

MLME_START: Initiating a Network

MLME-START.request PANId

LogicalChannel

BeaconOrder

SuperframeOrder

PANCoord

BatteryLifeExtension

Realignment

SecurityEnable

■ Starts the requested PAN

MLME-START.confirm status

MLME_ASSOCIATE: Joining a Network

MLME-ASSOCIATE.request LogicalChannel

CoordAddrMode

CoordPANId

CoordAddress

CapabilityInformation

SecurityEnable

■ Associates with the requested coordinator

MLME-ASSOCIATE.confirm AssocShortAddress

status

MLME_SCAN: Rejoining a Network

■ Orphan Scan

■ Asks on the requested channels for its former parent

MLME-SCAN.request ScanType = “Orphan Scan”

ScanChannels

ScanDuration

MLME-SCAN.confirm status

ScanType

UnscannedChannels

ResultListSize

EnergyDetectList

PANDescriptorList

Data Transmission:

Direct

■ The receiving device has its receiver on (RxOnIdle)

■ The data packet can be set unsolicited

■ The MAC schedules it for immediate delivery (using CSMA-CA)

In-Direct

■ The receiving device is asleep with its receiver off

■ The data packet has to be requested (Polled)

■ The MAC stores it for later retrieval by the RFD.

MCPS-DATA.request SrcAddrMode,

SrcAddr,

DstPANId,

msduLength,

msduHandle,

SrcPANId,

DstAddrMode,

DstAddr,

TxOptions

Architecture: NWK layer details

■ ZigBee Device Types

■ Stack Profile, Network Rules

■ Network Management and Addressing

■ Message Routing

■ Route Discovery and Maintenance

■ Security

Architecture:Network Structure in ZigBee

Architecture: Stack Profile

Sets the rules that the network adheres to: ■ nwkMaxDepth = 5■ nwkMaxChildren = 20■ nwkMaxRouters = 6■ nwkSecurityLevel = 5 (ENC-MIC-32)

And many more■ Minimum Table sizes (Neighbor, Routing)■ Timeouts (Broadcast)■ Route Cost Calculation Algorithm■ Disables features (Multicast, Aggregation routing)

Architecture: ZigBee Device Types

ZigBee Coordinator (ZC) ■ One and only one required for each ZigBee network.

► First one to the party

■ Initiates network formation.► Selects the time and place (Channel, PANId, Stack Profile)

■ Acts as IEEE 802.15.4 2003 PAN coordinator (FFD).■ Also performs as router once network is formed.■ Not necessarily a dedicated device can

perform an application too.

ZigBee Router (ZR)

■ Optional network component.

■ Discovers and associates with ZC or ZR.► Extends the network coverage

■ Acts as IEEE 802.15.4 2003 coordinator (FFD).

■ Manages local address allocation / de-allocation

■ Participates in multi-hop / mesh routing of messages.

■ Looks after its ZED’s when it comes to

broadcasting and routing messages

ZigBee End Device (ZED)

■ Optional network component.

■ Discovers and associates with ZC or ZR.

■ Acts as IEEE 802.15.4 2003 device (RFD).

■ Can be optimised for very low power operation

■ Relies on its parent to let it sleep

■ Shall not allow association.

■ Shall not participate in routing.

General Frame Format

Bits: 0-1 2-5 6-7 8 9 10 11 12 13-15

Frame type Protocol version

Discover route

MCast Security Srce

Dest IEEE Addr

Srce IEEE Addr

Reserved

Octets: 2

2 2 1 1 0/8 0/8 0/1 Variable Variable

Dest Addr

Srce Addr

Radius Sequence Number

Dest IEEE Addr

Srce IEEE Addr

Multicast Control

Srce Route

Frame Payload Frame

Control

Routing Fields

NWK Header

NWK Payload

Bits: 0-1 2-4 5-7

Multicast Mode

Non Member Radius

MaxNon Member Radius

Network Initiation: ZC

■ Initiates a ZigBee network

■ Performs an Energy Detect Scan

■ Performs an Active Scan

■ Selects the “nicest” channel

■ Selects an unused PANId

■ Starts a network

NLME-NETWORK-FORMATION.request

ScanChannels

ScanDuration

BeaconOrder

SuperframeOrder

BatteryLifeExtension

NLME-NETWORK-FORMATION.confirm

status

Network Initiation: ZC

Network Discovery: ZR & ZED

■ Locates ZigBee Networks

■ Performs an Active Scan

■ Selects a compatible network

NLME-NETWORK-DISCOVERY.request

ScanChannels

ScanDuration

NLME-NETWORK-DISCOVERY.confirm

NetworkCount

NetworkDescriptor

status

Network Association: ZR & ZED

■ Join a ZigBee Network

■ Selects the highest acceptable router

■ Associates with the chosen router

■ Allocated an address on the network

■ Inform the NHL

NLME-JOIN.request ExtendedPANId

JoinAsRouter

RejoinNetwork = 0

ScanChannels

ScanDuration

PowerSource

RxOnWhenIdle

NLME-JOIN.confirm ShortAddress

HaveNetworkKey

Status

NLME-JOIN.indication ShortAddress

ExtendedAddress

SecureJoin

NLME-START-ROUTER.request

BeaconOrder

SuperframeOrder

BateryLifeExtension

NLME-START-ROUTER.confirm

Status

Commencing Router Function: ZR

■ Commence Router Function

■ Once authenticated on the network

■ Prepares addresses for its children

■ Starts up the router function

Addressing:Tree-structured Address Assignment

Depth 0

Depth 1

Depth 2

Depth 3

0x0Address 0xFFFF

■ CSkip based address assignment

■ Address determined from tree location

nwkMaxDepth

nwkMaxChildren

0x7FFF

Sending Data

NLDE-DATA.request DstAddrMode

DstAddr

NsduLength

NsduHandle

Radius

NonmemberRadius

DiscoverRoute

SecurityEnable

■ Used by the NHL for sending broadcasts and unicasts

■ DstAddr defines the target device

■ Radius limits the number of hops for the message to traverse, if appropriate

■ DiscoverRoute can inhibit discovery

NLDE-DATA.confirm NsduHandle

Status

Receiving Data

NLDE-DATA.indication DsrAddrMode

DstAddr

SrcAddr

NsduLength

LinkQuality

■ Created on reception of data for the local device

■ SrcAddr is the originator of the message

Tree Routing:

Depth 0

Depth 1

Depth 2

Depth 3

0x0Address 0xFFFF

■ The address tells you where the destination is

■ Simple equation gives ‘route up’ or ‘route down’

■ If LocalAddr < DestAddr < LocalAddr + CSkip(d-1) Route Down

■ Else Route Up

CSkip d= 1

0x7FFF

CSkip d= 2

Obviously not necessarily the most efficient route

Neighbour Routing:

Depth 0

Depth 1

Depth 2

Depth 3

0x0Address 0xFFFF

■ A ZC or ZR maintains a table of devices in its neighbourhood

■ If the target device is physically in range it can send the message directly.

0x7FFF

Devices Neighbourhood

But what happens if the destination is not in the local neighbourhood?

Mesh Routing:

Depth 0

Depth 1

Depth 2

Depth 3

0x0Address 0xFFFF

■ ZC or ZR maintains a routing table of next hop addresses

■ If the target device has a routing table entry then the message can be sent using this route.

0x7FFF

That’s great, but where do the routing table entries come from?

Routing: Route Discovery

■ A device wishing to discover a route issues a route request command frame which is broadcast throughout the network.

■ When the intended destination receives the route request command frame it responds with a route reply command frame.

■ Potential routes are evaluated with respect to a routing cost metric.

■ Best route is added to the routing tables of all devices on the route

Message Routing: The Basic Algorithm

1. See if the destination is in the Neighbour Table

2. Check for a Routing Table entry

3. Finally resort to Tree Routing

NB. ZRs store messages for sleeping ZED’s

Broadcast: The Basic Algorithm

■ Transmit broadcast message

■ Rebroadcast by local ZRs if it is new.

■ Time & radius limited.

■ ZRs store messages for sleeping ZED’s

■ ZRs issue broadcasts on behalf of sleeping ZEDs

NLME-PERMIT-JOINING

NLME-PERMIT-JOINING.confirm Status

NLME-PERMIT-JOINING.request PermitDuration■ Enable or Disable devices joining

■ Opens up a ZC or ZR for a possibly limited duration to new devices associating

■ Sets or clears the AssociationPermit status

■ PermitDuration in seconds 0 = Disable, 0xFF = Infinite

Network Orphaning: ZR & ZED

■ Rejoin a previous Parent

■ Performs an 802.15.4 Orphan Scan

■ Previous parent will respond

JoinAsRouter

RejoinNetwork = 1

ScanChannels

ScanDuration

PowerSource

RxOnWhenIdle

HaveNetworkKey

Status

ExtendedAddress

SecureJoin

Network Orphaning: ZR & ZED

Network Rejoining: ZR & ZED

■ Rejoin a network (New Parent)

■ Performs an Active scan to find out who is out there

■ Selects new parent with capacity

JoinAsRouter

RejoinNetwork = 2

ScanChannels

ScanDuration

PowerSource

RxOnWhenIdle

HaveNetworkKey

Status

ExtendedAddress

SecureJoin

Network Rejoining: ZR & ZED

NLME-DIRECT-JOIN

NLME-DIRECT-JOIN.confirm DeviceAddress

Status

NLME-DIRECT-JOIN.request DeviceAddress

CapabilityInformation■ Pre-join a device to a ZR

■ Enables the device to join later through orphaning

■ The CapabilityInformation is as the device would provide

NLME-LEAVE

NLME-LEAVE.confirm DeviceAddress

Status

NLME-LEAVE.request DeviceAddress

RemoveChildren

Rejoin

NLME-LEAVE.indication DeviceAddress

Rejoin

■ Controls the removal of devices from a network

■ Allows a device to leave itself (DeviceAddress = NULL)

■ Allows a device to request a child to leave

■ RemoveChildren defines if the children below the leaving device should also leave

■ Rejoin defines if the leave is a transient effect and the device should attempt to rejoin

NLME-SYNC

NLME-SYNC.indication

NLME-SYNC.request Track

NLME-SYNC.confirm Status

■ Controls the receiving of data on a ZED

■ Requests a ZED to issue an MLME-POLL.request to its parent

NLME-RESET

NLME-RESET.request

NLME-RESET.confirm Status

■ Returns the stack to a known state

■ In turn calls a MLME-RESET.request

NLME-GET & NLME-SET

NLME-GET.request NIBAttribute

NLME-GET.confirm Status

NIBAttribute

NIBAttributeLength

NIBAttributeValue

NLME-SET.request NIBAttribute

NIBAttributeLength

NIBAttributeValue

NLME-SET.confirm Status

NIBAttribute

■ Requests the value of configuration parameters from within the NIB

■ Updates the value of configuration parameters within the NIB

NLME-ROUTE-ERROR

NLME-ROUTE-ERROR.indication

ShortAddr

Status■ Informs the NHL of some

break down in communications

■ Used if Route Discovery fails

■ Used if Tree links break

■ Used if a packet cannot be delivered

■ Etc.

Security: NWK Layer

■ The Stack Profile defines the security level in use.

■ Uses Network Key unless Link Key has been applied.

■ Tool box offers both authentication and encryption facilities.

■ Auxiliary Header and

Message Integrity Code add

overhead to the packet.

nibSecurityLevel Security Suite

0 NONE

1 MIC-32

2 MIC-64

3 MIC-128

5 ENC-MIC-32

6 ENC-MIC-64

7 ENC-MIN-128

To summarise the ZigBee network layer:

■ Has 3 device types; ZC, ZR and ZED.

■ Performs network discovery and formation

■ Performs address allocation

■ Performs message routing

■ Configured by the stack profile

■ Provides network wide security

■ Allows low power devices to maximize

their battery life

ZigBee turns 802.15.4 into a low power multi-hop mesh network.

Contact Details:

Ian Marsden

Integration UK Ltd

Director, Software Engineering

mailto:imarsden@integration.com

DDI: +44 (0) 1737 227721

Cell: +44 (0) 7920 105537

Tel: +44 (0) 1737 227722

Fax: +44 (0) 1737 227744

16 - 18 West Street, Reigate, Surrey, RH2 9BS, United Kingdom

http://www.integration.com

Copyright © 2007 ZigBee TM Alliance. All Rights Reserved. Wireless Control That Simply Works ‘Under the Hood‘ of a ZigBee 2006 Network Ian Marsden Chairman.

zigbee tm alliance copyright

zigbee products

wireless control

type of device

zigbee devices type

zpui zigbee device object

network mlmeassociate

networks mlmescan

Documents

Marsden Tromba Vectores

Collisions - Marsden

ZigBee-Steuermodul 030 ZigBee-Steuermodul 031 ZigBee ... ·....

TOBIAS ZILLNER ZIGBEE EXPLOITED - itsecx.fhstp.ac.at · 3.....

ZigBee-2007 Layer PICS and Stack...

MARSDEN PARK PRECINCT · The Marsden Park Precinct sits to....

ZigBee 802.15.4 and the ZigBee Alliance Motorola...

Ami Marsden

ZigBee RF4CE Stack User Guide - NXP Semiconductors ·...

MODUL 2 Zigbee to Zigbee communication.docx

MARSDEN PARK - Aventus...

Jane Marsden

Marsden #Regulatingcode MIT

marsden solution

ZigBee / IEEE 802.15.4 ZigBee Alliance: IEEE 802.15.4: .

Zigbee - s.bega.com · ZigBee control module 030 ZigBee...