TI ZigBee协议栈中终端设备的状态切换详解

本文主要介绍了TI ZigBee协议栈Z-Stack中，关于终端设备End Device工作过程中，不同状态之间切换的详细说明，并且通过分析空中交互的数据包进一步了解TI ZigBee协议栈Z-Stack的工作流程。

• 终端设备在协议栈中涉及到的状态

在Z-Stack Home 1.2.2a协议栈的C:\Texas Instruments\Z-Stack Home 1.2.2a.44539\Components\stack\zdo\ZDApp.h文件中有定义设备的不同状态，分别如下。

typedef enum
{DEV_HOLD,// Initialized - not started automaticallyDEV_INIT,// Initialized - not connected to anythingDEV_NWK_DISC,// Discovering PAN's to joinDEV_NWK_JOINING,// Joining a PANDEV_NWK_SEC_REJOIN_CURR_CHANNEL,// ReJoining a PAN in secure mode scanning in current channel, only for end devicesDEV_END_DEVICE_UNAUTH,// Joined but not yet authenticated by trust centerDEV_END_DEVICE,// Started as device after authenticationDEV_ROUTER,// Device joined, authenticated and is a routerDEV_COORD_STARTING,// Started as Zigbee CoordinatorDEV_ZB_COORD,// Started as Zigbee CoordinatorDEV_NWK_ORPHAN,// Device has lost information about its parent..DEV_NWK_KA,// Device is sending KeepAlive message to its parentDEV_NWK_BACKOFF,// Device is waiting before trying to rejoinDEV_NWK_SEC_REJOIN_ALL_CHANNEL,// ReJoining a PAN in secure mode scanning in all channels, only for end devicesDEV_NWK_TC_REJOIN_CURR_CHANNEL,// ReJoining a PAN in Trust center mode scanning in current channel, only for end devicesDEV_NWK_TC_REJOIN_ALL_CHANNEL// ReJoining a PAN in Trust center mode scanning in all channels, only for end devices
} devStates_t;

对于不同的设备类型会有不同的设备状态，那么对于终端设备来说可能使用到的设备如下。

DEV_HOLD,// Initialized - not started automaticallyDEV_INIT,// Initialized - not connected to anythingDEV_NWK_DISC,// Discovering PAN's to joinDEV_NWK_JOINING,// Joining a PANDEV_NWK_SEC_REJOIN_CURR_CHANNEL,// ReJoining a PAN in secure mode scanning in current channel, only for end devicesDEV_END_DEVICE_UNAUTH,// Joined but not yet authenticated by trust centerDEV_END_DEVICE,// Started as device after authenticationDEV_NWK_ORPHAN,// Device has lost information about its parent..DEV_NWK_BACKOFF,// Device is waiting before trying to rejoinDEV_NWK_SEC_REJOIN_ALL_CHANNEL,// ReJoining a PAN in secure mode scanning in all channels, only for end devicesDEV_NWK_TC_REJOIN_CURR_CHANNEL,// ReJoining a PAN in Trust center mode scanning in current channel, only for end devicesDEV_NWK_TC_REJOIN_ALL_CHANNEL// ReJoining a PAN in Trust center mode scanning in all channels, only for end devices

• 终端设备的状态机切换

// Start the device?if ( devState != DEV_HOLD ){ZDOInitDevice( 0 );}else{ZDOInitDevice( ZDO_INIT_HOLD_NWK_START );// Blink LED to indicate HOLD_STARTHalLedBlink ( HAL_LED_4, 0, 50, 500 );}

#if defined( HOLD_AUTO_START )devStates_t devState = DEV_HOLD;
#elsedevStates_t devState = DEV_INIT;
#endif

if ( events & ZDO_NETWORK_INIT ){// Initialize apps and start the networkZDApp_ChangeState( DEV_INIT );ZDO_StartDevice( (uint8)ZDO_Config_Node_Descriptor.LogicalType, devStartMode,DEFAULT_BEACON_ORDER, DEFAULT_SUPERFRAME_ORDER );// Return unprocessed eventsreturn (events ^ ZDO_NETWORK_INIT);}

if ( ZG_BUILD_JOINING_TYPE && (logicalType == NODETYPE_ROUTER || logicalType == NODETYPE_DEVICE) ){if ( (startMode == MODE_JOIN) || (startMode == MODE_REJOIN) ){ZDApp_ChangeState( DEV_NWK_DISC );

if ( ( (pChosenNwk = ZDApp_NwkDescListProcessing()) != NULL ) && (zdoDiscCounter > NUM_DISC_ATTEMPTS) )

else{if ( continueJoining ){
#if defined ( MANAGED_SCAN )ZDApp_NetworkInit( MANAGEDSCAN_DELAY_BETWEEN_SCANS );
#elsezdoDiscCounter++;ZDApp_NetworkInit( (uint16)(BEACON_REQUEST_DELAY+ ((uint16)(osal_rand()& BEACON_REQ_DELAY_MASK))) );
#endif}}

if ( ( (pChosenNwk = ZDApp_NwkDescListProcessing()) != NULL ) && (zdoDiscCounter > NUM_DISC_ATTEMPTS) ){if ( devStartMode == MODE_JOIN ){ZDApp_ChangeState( DEV_NWK_JOINING );ZDApp_NodeProfileSync( pChosenNwk->stackProfile);if ( NLME_JoinRequest( pChosenNwk->extendedPANID, pChosenNwk->panId,pChosenNwk->logicalChannel,ZDO_Config_Node_Descriptor.CapabilityFlags,pChosenNwk->chosenRouter, pChosenNwk->chosenRouterDepth ) != ZSuccess ){ZDApp_NetworkInit( (uint16)(NWK_START_DELAY+ ((uint16)(osal_rand()& EXTENDED_JOINING_RANDOM_MASK))) );}} // if ( devStartMode == MODE_JOIN )

终端设备在成功入网以后，状态成为了DEV_END_DEVICE。正常情况下该终端设备可以顺利的发送数据给父设备，也可以通过Data Request的方式向父设备获取发该子设备的数据。在实际应用层，可能出现终端设备移动，父设备掉电，因为干扰跟父设备通信多次失败，从而导致终端设备成为一个孤立的设备。如果连续发送数据没有收到父设备的MAC ACK，则触发设备进入孤立设备状态，调用到ZDO_SyncIndicationCB( uint8 type, uint16 shortAddr )函数，最后在ZDApp_ProcessOSALMsg( osal_event_hdr_t *msgPtr )触发下面的程序。

case ZDO_NWK_JOIN_REQ:if ( ZG_BUILD_JOINING_TYPE && ZG_DEVICE_JOINING_TYPE ){retryCnt = 0;devStartMode = MODE_RESUME;_tmpRejoinState = true;osal_cpyExtAddr( ZDO_UseExtendedPANID, _NIB.extendedPANID );zgDefaultStartingScanDuration = BEACON_ORDER_60_MSEC;ZDApp_NetworkInit( 0 );}break;

启动的状态已经是MODE_RESUME，程序有重新执行到ZDApp_event_loop( uint8 task_id, UINT16 events )中的下面代码，再次开启启动设备的过程。

if ( events & ZDO_NETWORK_INIT ){// Initialize apps and start the networkZDApp_ChangeState( DEV_INIT );ZDO_StartDevice( (uint8)ZDO_Config_Node_Descriptor.LogicalType, devStartMode,DEFAULT_BEACON_ORDER, DEFAULT_SUPERFRAME_ORDER );// Return unprocessed eventsreturn (events ^ ZDO_NETWORK_INIT);}

最后执行到ZDO_StartDevice中的下面代码

else if ( startMode == MODE_RESUME ){if ( logicalType == NODETYPE_ROUTER ){ZMacScanCnf_t scanCnf;ZDApp_ChangeState( DEV_NWK_ORPHAN );/* if router and nvram is available, fake successful orphan scan */scanCnf.hdr.Status = ZSUCCESS;scanCnf.ScanType = ZMAC_ORPHAN_SCAN;scanCnf.UnscannedChannels = 0;scanCnf.ResultListSize = 0;nwk_ScanJoiningOrphan(&scanCnf);ret = ZSuccess;}else{ZDApp_ChangeState( DEV_NWK_ORPHAN );//set timer for scan and rejoinosal_start_timerEx( ZDAppTaskID, ZDO_REJOIN_BACKOFF, zgDefaultRejoinScan );ret = NLME_OrphanJoinRequest( runtimeChannel,zgDefaultStartingScanDuration );}
}

此时设备已经把状态从DEV_END_DEVICE状态切换到DEV_END_ORPHAN状态。通过调用NLME_OrphanJoinRequest函数向信道发送Orphan Notification告诉网络里面的设备，声明自己已经是一个孤立设备，这个Orphan Notification会在定义的每个信道上发送一次。

• DEV_END_ORPHAN状态到DEV_END_DEVICE状态（6）

节点在发出Orphan Notification以后，节点的状态从DEV_END_ORPHAN切换到了NWK_JOINING_ORPHAN状态，在这个状态下节点会在之前定义的信道上发送Orphan Notification消息，如果有原来的父设备回复了Coord Realignment，节点认为原先的父设备重新找到了，则会调用到ZDO_JoinConfirmCB( PanId, Status );再调用到ZDApp_ProcessOSALMsg( osal_event_hdr_t *msgPtr )中的

case ZDO_NWK_JOIN_IND:if ( ZG_BUILD_JOINING_TYPE && ZG_DEVICE_JOINING_TYPE ){ZDApp_ProcessNetworkJoin();}break;

然后再次到调用到ZDApp_AnnounceNewAddress();告诉网络里面的其他设备，再次加网成功了。这个时候节点的状态又切换到了DEV_END_DEVICE状态。

• DEV_END_ORPHAN状态到DEV_INIT状态（12）

节点从End Device状态到Orphan状态，并不是每次都能通过Orphan Scan的方式，重新找到原先的父设备。比方说父设备断电，被移动走，或因为网内其他数据干扰导致父设备回复的Coord Realignment没有收到。 

在这种情况下，节点开始重新搜索网络，而不是仅仅只找自己原先的父设备了。 如果在Orphan状态下，join失败的，也会调用到void ZDO_JoinConfirmCB( uint16 PanId, ZStatus_t Status )这个call back函数。再调用到ZDApp_ProcessOSALMsg( osal_event_hdr_t *msgPtr )

只不过这个时候的status变成了失败的状态。进入下面的代码。

void ZDApp_ProcessNetworkJoin( void )
......
else if ( devState == DEV_NWK_ORPHAN ||devState == DEV_NWK_SEC_REJOIN_CURR_CHANNEL ||devState == DEV_NWK_TC_REJOIN_CURR_CHANNEL ||devState == DEV_NWK_TC_REJOIN_ALL_CHANNEL ||devState == DEV_NWK_SEC_REJOIN_ALL_CHANNEL )
......

else{ if ( devStartMode == MODE_RESUME ){if ( ++retryCnt <= MAX_RESUME_RETRY ){if ( _NIB.nwkPanId == 0xFFFF )devStartMode = MODE_JOIN;else{ devStartMode = MODE_REJOIN;_tmpRejoinState = true;prevDevState = DEV_NWK_SEC_REJOIN_CURR_CHANNEL;}}// Do a normal join to the network after certain times of rejoin retrieselse if( AIB_apsUseInsecureJoin == true ){devStartMode = MODE_JOIN;}}else if(devStartMode == MODE_REJOIN)

此时设备的状态devState=DEV_NWK_ORPHAN，并且devStartMode=MODE_RESUME，所以程序会运行到devStartMode = MODE_REJOIN。

最后在ZDApp_ProcessNetworkJoin里面运行到下面代码，开始重新搜索网络了。

ZDApp_NetworkInit( (uint16)(NWK_START_DELAY+ (osal_rand()& EXTENDED_JOINING_RANDOM_MASK)) );

程序再次执行到ZDApp_event_loop( uint8 task_id, UINT16 events )下面代码，此时的状态就变成了DEV_INIT状态。

if ( events & ZDO_NETWORK_INIT ){// Initialize apps and start the networkZDApp_ChangeState( DEV_INIT );ZDO_StartDevice( (uint8)ZDO_Config_Node_Descriptor.LogicalType, devStartMode,DEFAULT_BEACON_ORDER, DEFAULT_SUPERFRAME_ORDER );// Return unprocessed eventsreturn (events ^ ZDO_NETWORK_INIT);}

• DEV_INIT状态到DEV_NWK_DISC（1）

在进入DEV_INIT状态以后，进入ZDO_StartDevice()函数，因为设备的startmode是MODE_REJOIN，所以按照下面的代码，进入discover状态

if ( ZG_BUILD_JOINING_TYPE && (logicalType == NODETYPE_ROUTER ||logicalType == NODETYPE_DEVICE) ){if ( (startMode == MODE_JOIN) || (startMode == MODE_REJOIN) ){ZDApp_ChangeState( DEV_NWK_DISC );#if defined( MANAGED_SCAN )ZDOManagedScan_Next();ret = NLME_NetworkDiscoveryRequest( managedScanChannelMask, BEACON_ORDER_15_MSEC );
#elseret =NLME_NetworkDiscoveryRequest( runtimeChannel, zgDefaultStartingScanDuration );
#if defined ( ZIGBEE_FREQ_AGILITY )if ( !( ZDO_Config_Node_Descriptor.CapabilityFlags & CAPINFO_RCVR_ON_IDLE ) &&( ret == ZSuccess ) && ( ++discRetries == 4 ) ){// For devices with RxOnWhenIdle equals to FALSE, any network channel// change will not be recieved. On these devices or routers that have// lost the network, an active scan shall be conducted on the Default// Channel list using the extended PANID to find the network. If the// extended PANID isn't found using the Default Channel list, an scan// should be completed using all channels.runtimeChannel = MAX_CHANNELS_24GHZ;}#endif // ZIGBEE_FREQ_AGILITY

• DEV_NWK_DISC状态到DEV_NWK_REJOIN（8）

跟之前的状态2中，进入discovery状态以后做的事情一样，去信道上扫描原先的网络。但是这个时候不会去所有信道扫描了，只在刚才网络的信道扫描，因为默认认为网络的信道时不会改变的。

在扫描过程结束以后，程序同样执行到了NLME_NetworkDiscoveryConfirm(uint8 status)-> ZDO_NetworkDiscoveryConfirmCB(status)-> ZDApp_SendMsg( ZDAppTaskID, ZDO_NWK_DISC_CNF, sizeof(osal_event_hdr_t), (uint8 *)&msg );-> ZDApp_ProcessOSALMsg( osal_event_hdr_t *msgPtr )下面的case ZDO_NWK_DISC_CNF:

case ZDO_NWK_DISC_CNF:if (devState != DEV_NWK_DISC)break;if ( ZG_BUILD_JOINING_TYPE && ZG_DEVICE_JOINING_TYPE ){// Process the network discovery scan results and choose a parent// device to join/rejoin itselfnetworkDesc_t *pChosenNwk;if ( ( (pChosenNwk = ZDApp_NwkDescListProcessing()) != NULL ) && (zdoDiscCounter > NUM_DISC_ATTEMPTS) ){
.....................else if ( devStartMode == MODE_REJOIN ){ZStatus_t rejoinStatus;// Transition state machine to correct rejoin state based on previous state before network discoveryif ( ZDApp_RestoreNwkKey( FALSE )== TRUE )
............................
// Perform Secure or Unsecure Rejoin depending on available configurationif ( ZG_SECURE_ENABLED && ( ZDApp_RestoreNwkKey( TRUE ) == TRUE ) ){rejoinStatus = NLME_ReJoinRequest( ZDO_UseExtendedPANID, pChosenNwk->logicalChannel);}else{rejoinStatus = NLME_ReJoinRequestUnsecure( ZDO_UseExtendedPANID, pChosenNwk->logicalChannel);}if ( rejoinStatus != ZSuccess ){ZDApp_NetworkInit( (uint16)(NWK_START_DELAY+ ((uint16)(osal_rand()& EXTENDED_JOINING_RANDOM_MASK))) );}

由于此次扫描前start mode的状态，会开始进入rejoin状态，通过调用NLME_ReJoinRequest( ZDO_UseExtendedPANID, pChosenNwk->logicalChannel);来发送Rejoin Request消息。

• DEV_NWK_REJOIN状态到DEV_END_DEVICE（15）

else if ( devState == DEV_NWK_ORPHAN ||devState == DEV_NWK_SEC_REJOIN_CURR_CHANNEL ||devState == DEV_NWK_TC_REJOIN_CURR_CHANNEL ||devState == DEV_NWK_TC_REJOIN_ALL_CHANNEL ||devState == DEV_NWK_SEC_REJOIN_ALL_CHANNEL ){
......................
 // results of an orphaning attempt by this device// results of an orphaning attempt by this device if (nwkStatus == ZSuccess){//When the device has successfully rejoined then reset retryCntretryCnt = 0;// Verify NWK key is available before sending Device_annceif ( ZG_SECURE_ENABLED && ( ZDApp_RestoreNwkKey( TRUE ) == false ) ){// wait for auth from trust centerZDApp_ChangeState( DEV_END_DEVICE_UNAUTH );// Start the reset timer for MAX UNAUTH timeZDApp_ResetTimerStart( MAX_DEVICE_UNAUTH_TIMEOUT );}else{ ZDApp_ChangeState( DEV_END_DEVICE );osal_stop_timerEx( ZDAppTaskID, ZDO_REJOIN_BACKOFF );// setup Power Manager Device
#if defined ( POWER_SAVING )osal_pwrmgr_device( PWRMGR_BATTERY );
#endif// The receiver is on, turn network layer polling off.if ( ZDO_Config_Node_Descriptor.CapabilityFlags & CAPINFO_RCVR_ON_IDLE ){// if Child Table Management process is not enabledif ( zgChildAgingEnable == FALSE ){NLME_SetPollRate( 0 );NLME_SetQueuedPollRate( 0 );NLME_SetResponseRate( 0 );}}if ( ZSTACK_ROUTER_BUILD ){// NOTE: first two parameters are not used, see NLMEDE.h for detailsif ( ZDO_Config_Node_Descriptor.LogicalType != NODETYPE_DEVICE ){NLME_StartRouterRequest( 0, 0, false );}} ZDApp_AnnounceNewAddress();if ( ( (ZDO_Config_Node_Descriptor.CapabilityFlags & CAPINFO_RCVR_ON_IDLE) == 0 )|| ( (ZDO_Config_Node_Descriptor.CapabilityFlags & CAPINFO_RCVR_ON_IDLE)&& (zgChildAgingEnable == TRUE) ) ){NLME_SetPollRate( ZDApp_SavedPollRate );}}}

最后终端发出ZDApp_AnnounceNewAddress();再次广播网络里面的设备，节点Rejoin加网成功了，并且状态又重新迁移到DEV_END_DEVICE 状态。

else if ( devStartMode == MODE_REJOIN ){ZStatus_t rejoinStatus;// Transition state machine to correct rejoin state based on previous state before network discoveryif ( ZDApp_RestoreNwkKey( FALSE )== TRUE )
............................
// Perform Secure or Unsecure Rejoin depending on available configurationif ( ZG_SECURE_ENABLED && (ZDApp_RestoreNwkKey( TRUE ) == TRUE ) ){rejoinStatus = NLME_ReJoinRequest( ZDO_UseExtendedPANID, pChosenNwk->logicalChannel);}else{rejoinStatus =NLME_ReJoinRequestUnsecure( ZDO_UseExtendedPANID, pChosenNwk->logicalChannel);}if ( rejoinStatus != ZSuccess ){ZDApp_NetworkInit( (uint16)(NWK_START_DELAY+ ((uint16)(osal_rand()& EXTENDED_JOINING_RANDOM_MASK))) );}

if ( ZG_SECURE_ENABLED && ( ZDApp_RestoreNwkKey( TRUE ) == false ) ){// wait for auth from trust center ZDApp_ChangeState( DEV_END_DEVICE_UNAUTH );// Start the reset timer for MAX UNAUTH timeZDApp_ResetTimerStart( MAX_DEVICE_UNAUTH_TIMEOUT );}else{

• DEV_END_DEVICE_UNAUTH状态到DEV_NWK_ORPHAN（14）

未完待续

user4566561：

Mark!!~~

zhongwei xu1：

非常清晰，重新温习下，感谢V神！

xiaoming huang1：

回复 zhongwei xu1:

Mark

Susan Yang：

谢谢分享@！

huang shangjian：

回复 Susan Yang:

很详细，谢谢分享！

xiaohui bu：

必须顶！

user4381970：

相当赞的分析，感谢@VV

之前掉线总连不上的问题基本解决了，感觉是bug

参见http://www.kaleidscope.cn:1020/archives/992

现在依然有问题，掉线后始终找不到网络时候，有个别情况就重新发现网络了。难道nv读取错误，概率很低吧，还是下面更改了启动状态

DEV_END_ORPHAN状态到DEV_INIT状态（12）

Do a normal join to the network after certain times of rejoin retries

这是什么意思呢

这篇文章也问了这个问题http://blog.csdn.net/m12m12m1/article/details/46661593

user4566561：

在使用znp协议栈时，感觉有一个bug

在使能security后，当终端在入网过程中会有认证超时的情况，当认证超时后，协议栈会对2530进行reset。

也就说如果一个终端设备入网一旦出现认证不过，就会一直不能入网了，除非host重新对2530进行startnetwork。

chengzi chen：

回复 user4381970:

您好！ 我们做的设备这两天也遇到了同样的问题了，一个协调器组网带了20个end device，过了一个晚上后发现有15个终端设备处于失去父节点状态，一直不能重新入网，其余的5个设备连接状态正常，搜索了相关问题资料，如 http://www.kaleidscope.cn:1020/archives/992   做了修改测试，还是不行，也是要协调器端开启permitjoin才能重新入网。

那个连接中的方法不起作用，你的设备这种方法可行么？

jinghuan hao：

Mark!!~~