IEC PAS 62948:2015

IEC PAS 62948 ®
Edition 1.0 2015-04
PUBLICLY AVAILABLE
SPECIFICATION
PRE-STANDARD
colour
inside
Industrial networks – Wireless communication network and communication
profiles – WIA-FA
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form
or by any means, electronic or mechanical, including photocopying and microfilm, without permission in writing from
either IEC or IEC's member National Committee in the country of the requester. If you have any questions about IEC
copyright or have an enquiry about obtaining additional rights to this publication, please contact the address below or
your local IEC member National Committee for further information.

IEC Central Office Tel.: +41 22 919 02 11
3, rue de Varembé Fax: +41 22 919 03 00
CH-1211 Geneva 20 info@iec.ch
Switzerland www.iec.ch
About the IEC
The International Electrotechnical Commission (IEC) is the leading global organization that prepares and publishes
International Standards for all electrical, electronic and related technologies.

About IEC publications
The technical content of IEC publications is kept under constant review by the IEC. Please make sure that you have the
latest edition, a corrigenda or an amendment might have been published.

IEC Catalogue - webstore.iec.ch/catalogue Electropedia - www.electropedia.org
The stand-alone application for consulting the entire The world's leading online dictionary of electronic and
bibliographical information on IEC International Standards, electrical terms containing more than 30 000 terms and
Technical Specifications, Technical Reports and other definitions in English and French, with equivalent terms in 15
documents. Available for PC, Mac OS, Android Tablets and additional languages. Also known as the International
iPad. Electrotechnical Vocabulary (IEV) online.

IEC publications search - www.iec.ch/searchpub IEC Glossary - std.iec.ch/glossary
The advanced search enables to find IEC publications by a More than 60 000 electrotechnical terminology entries in
variety of criteria (reference number, text, technical English and French extracted from the Terms and Definitions
committee,…). It also gives information on projects, replaced clause of IEC publications issued since 2002. Some entries
and withdrawn publications. have been collected from earlier publications of IEC TC 37,

77, 86 and CISPR.
IEC Just Published - webstore.iec.ch/justpublished

Stay up to date on all new IEC publications. Just Published IEC Customer Service Centre - webstore.iec.ch/csc
details all new publications released. Available online and If you wish to give us your feedback on this publication or
also once a month by email. need further assistance, please contact the Customer Service
Centre: csc@iec.ch.
IEC PAS 62948 ®
Edition 2.0 2015-04
PUBLICLY AVAILABLE
SPECIFICATION
PRE-STANDARD
colour
inside
Industrial networks – Wireless communication network and communication

profiles – WIA-FA
INTERNATIONAL
ELECTROTECHNICAL
COMMISSION
ICS 25.040.40; 35.100.01 ISBN 978-2-8322-2477-9

– 2 – IEC PAS 62948:2015 © IEC 2015
CONTENTS
FOREWORD . 12
1 Scope . 14
2 Normative references . 14
3 Terms, definitions, abbreviations, and conventions . 14
3.1 Terms and definitions . 14
3.2 Abbreviations . 17
3.3 Conventions . 19
4 Data coding . 20
4.1 Overview. 20
4.2 Basic data type coding . 21
4.2.1 Integer coding. 21
4.2.2 Unsigned coding . 21
4.2.3 Float coding . 22
4.2.4 Octetstring coding . 23
4.2.5 Bit Field coding . 23
4.2.6 TimeData coding . 23
4.2.7 KeyData coding . 23
4.3 Structured data type coding . 24
4.3.1 Structure type coding . 24
4.3.2 List type coding . 24
5 WIA-FA overview . 24
5.1 Device types . 24
5.1.1 Host computer . 24
5.1.2 Gateway device . 24
5.1.3 Access device . 24
5.1.4 Field device . 25
5.1.5 Handheld device . 25
5.2 Network topology . 25
5.3 Protocol architecture . 26
6 System management . 28
6.1 Overview. 28
6.2 Device Management Application Process . 28
6.2.1 Network manager . 31
6.2.2 Security manager . 31
6.2.3 Network management module . 31
6.2.4 Security management module . 31
6.2.5 DMAP state machines . 31
6.3 Addressing and address assignment . 42
6.4 Communication resource allocation . 42
6.4.1 General . 42
6.4.2 Communication resource allocation . 43
6.5 Joining and leave process of field device . 44
6.5.1 Joining process of a field device . 44
6.5.2 Communication resource allocation to field device . 45
6.5.3 Leaving process of a field device . 45
6.6 Network performance monitoring . 46

6.6.1 Device status report . 46
6.6.2 Channel condition report . 47
6.7 Management information base and services . 47
6.7.1 Management information base . 47
6.7.2 MIB services . 57
7 Physical layer . 61
7.1 General . 61
7.2 General requirements based on IEEE STD 802.11-2012 . 61
7.3 Additional requirements . 62
7.3.1 General . 62
7.3.2 Frequency band . 62
7.3.3 Channel bitmap . 62
7.3.4 Transmission power . 63
7.3.5 Data rate . 63
8 Data Link Layer . 64
8.1 General . 64
8.1.1 Protocol architecture . 64
8.1.2 WIA-FA superframe . 64
8.1.3 Communication based on multiple access devices . 67
8.1.4 Time synchronization . 68
8.1.5 Aggregation/Disaggregation . 69
8.1.6 Retransmission . 70
8.2 Data link sub-layer data services . 73
8.2.1 General . 73
8.2.2 DLDE-DATA.request primitive . 73
8.2.3 DLDE-DATA.indication primitive . 74
8.2.4 Time sequence of DLL data service . 75
8.3 Data link sub-layer management services . 76
8.3.1 General . 76
8.3.2 Network discovery services . 76
8.3.3 Time synchronization services . 78
8.3.4 Device joining services . 80
8.3.5 Device status report services . 83
8.3.6 Channel condition report services . 85
8.3.7 Remote attribute get services . 86
8.3.8 Remote attribute configuration services . 90
8.3.9 Device leaving services . 93
8.4 DLL frame formats . 94
8.4.1 General frame format . 94
8.4.2 Date frame format . 96
8.4.3 Aggregation frame format . 96
8.4.4 NACK frame format . 97
8.4.5 GACK frame format . 97
8.4.6 Beacon frame format . 97
8.4.7 Join request frame format . 98
8.4.8 Join response frame format . 98
8.4.9 Leave request frame format . 98
8.4.10 Device status report frame format . 99
8.4.11 Channel condition report frame format . 99

– 4 – IEC PAS 62948:2015 © IEC 2015
8.4.12 Time synchronization request frame format . 99
8.4.13 Time synchronization response frame format . 99
8.4.14 Remote attribute get request frame format . 100
8.4.15 Remote attribute get response frame format . 100
8.4.16 Remote attribute set request frame format . 101
8.4.17 Remote attribute set response frame format . 101
8.5 Data link layer state machines . 101
8.5.1 DLL state machine of access field . 101
8.5.2 DLL state machine of field device . 105
8.5.3 Functions used in DLL state transitions . 110
9 Wired specifications between GW and AD . 111
9.1 Overview. 111
9.2 Join process of access device . 111
9.3 Frame formats between GW and AD . 111
10 Application Layer . 113
10.1 Overview. 113
10.2 AL protocol stack . 114
10.3 AL functions . 114
10.3.1 Data function . 114
10.3.2 Management function . 114
10.3.3 Communication mode . 115
10.4 Application data . 115
10.4.1 General . 115
10.4.2 Process data . 116
10.4.3 Event data . 117
10.5 User application process . 118
10.5.1 General . 118
10.5.2 User application object . 119
10.5.3 IO data images on gateway device . 119
10.5.4 Alarm mechanism . 120
10.5.5 Application configuration process . 120
10.6 Application services . 126
10.6.1 Confirmed services and unconfirmed services . 126
10.6.2 READ service . 127
10.6.3 WRITE service . 128
10.6.4 PUBLISH Service . 129
10.6.5 REPORT Service . 130
10.6.6 REPORT ACK. 131
10.7 Application sublayer . 132
10.7.1 Overview . 132
10.7.2 ASL data service . 132
10.7.3 ASL packet format . 135
11 Security . 155
11.1 General . 155
11.1.1 Security management architecture . 155
11.1.2 Security functions . 156
11.1.3 Keys . 156
11.2 Security services . 157
11.2.1 General . 157

11.2.2 Key establish service . 158
11.2.3 Key update service . 160
11.2.4 Security alarm service . 162
11.3 Secure join . 164
11.3.1 General . 164
11.3.2 Secure join process of FD. 164
11.4 Key management . 165
11.4.1 General . 165
11.4.2 Key establish process . 165
11.4.3 Key update process . 166
11.5 DLL secure communication . 168
11.6 Security alarm . 169
11.7 Secure frame format . 169
11.7.1 General secure DLL frame format . 169
11.7.2 Secure aggregation frame format . 171
11.7.3 Key establish request frame format . 172
11.7.4 Key establish response frame format . 172
11.7.5 Key update request frame format . 172
11.7.6 Key update response frame format . 173
11.7.7 Security alarm request frame format . 173
Annex A (informative)  Security strategy for WIA-FA network . 174
A.1 Risk analysis for WIA-FA network . 174
A.2 Security principles for WIA-FA network . 174
A.3 Security objectives for WIA-FA network . 174
A.4 Security grade of WIA-FA network . 175
Annex B (informative) Regional modification for compliance with ETSI standards . 176
B.1 General . 176
B.2 Compliance with ETSI EN 300 440-2 V1.4.1 . 176
B.3 Compliance with ETSI EN 300 328 V1.8.1. 176
Bibliography . 180

Figure 1 – Conventions used for state machines . 19
Figure 2 – Integer coding . 21
Figure 3 – Unsigned coding . 21
Figure 4 – Single float coding . 22
Figure 5 – Double float coding . 22
Figure 6 – WIA-FA enhanced star topology . 25
Figure 7 – OSI basic reference model mapped to WIA-FA . 26
Figure 8 – Protocol architecture of WIA-FA . 27
Figure 9 – Data flow over WIA-FA network . 27
Figure 10 – System management scheme . 28
Figure 11 – DMAP of management system. 29
Figure 12 – DMAP state machine of gateway device . 32
Figure 13 – DMAP state machine of gateway device for each field device . 33
Figure 14 – DMAP state machine of a field device . 37
Figure 15 – Long address structure of device . 42

– 6 – IEC PAS 62948:2015 © IEC 2015
Figure 16 – Joining process of field device . 44
Figure 17 – Communication resource allocation process for a field device . 45
Figure 18 – Passive leave process of a field device . 46
Figure 19 – Device status report process of field device . 46
Figure 20 – Channel condition report process of field device . 47
Figure 21 – BitMap format . 62
Figure 22 – WIA-FA DLL protocol architecture . 64
Figure 23 – The template of timeslot structure . 65
Figure 24 – WIA-FA default superframe . 66
Figure 25 – WIA-FA superframe . 66
Figure 26 – The example of WIA-FA devices multi-channel communication. 66
Figure 27 – An example of beacon communication based on multiple ADs . 67
Figure 28 – Process of one-way time synchronization . 68
Figure 29 – Process of two-way time synchronization . 69
Figure 30 – Aggregation frame payload format . 70
Figure 31 – Example of retransmission mode based on NACK . 71
Figure 32 – Example of multi-unicast retransmission mode . 72
Figure 33 – Example of multi-broadcast retransmission mode . 72
Figure 34 – Example of GACK-based timeslot backoff mode . 73
Figure 35 – Time sequence of period data service from FD to GW . 75
Figure 36 – Time sequence of other data service from FD to GW . 75
Figure 37 – Time sequence of data service from GW to FD . 76
Figure 38 – Network discovery process . 78
Figure 39 – Time synchronization process . 80
Figure 40 – Device join process . 83
Figure 41 – Device status report process . 84
Figure 42 – Channel condition report process . 86
Figure 43 – Remote attribute get process . 89
Figure 44 – Remote attribute set process . 93
Figure 45 – Device leave process . 94
Figure 46 – General frame format . 95
Figure 47 – DLL frame header . 95
Figure 48 – DLL frame control format . 95
Figure 49 – DLL Date frame format . 96
Figure 50 – DLL Aggregation frame format . 97
Figure 51 – NACK frame format . 97
Figure 52 – GACK frame format . 97
Figure 53 – GACK information . 97
Figure 54 – DLL Beacon frame format . 97
Figure 55 – Shared timeslot count . 98
Figure 56 – DLL join request frame format . 98
Figure 57 – DLL join request frame format . 98
Figure 58 – DLL leave request frame format . 99

Figure 59 – DLL Device status report frame format . 99
Figure 60 – DLL Channel condition report frame format . 99
Figure 61 – DLL time synchronization request frame format . 99
Figure 62 – DLL time synchronization response frame format . 99
Figure 63 – DLL Remote attribute get request frame format . 100
Figure 64 – DLL remote attribute get response frame format . 100
Figure 65 – DLL Remote attribute set request frame format . 101
Figure 66 – DLL remote attribute set response frame format . 101
Figure 67 – DLL state machine of access device. 102
Figure 68 – DLL state machine of field device . 106
Figure 69 – General frame format between GW and AD . 111
Figure 70 – AL portions within WIA-FA protocol stack . 114
Figure 71 – The relationships between UAPs and DAPs . 118
Figure 72 – User application objects . 119
Figure 73 – Implementation example of IO data images on the gateway device . 120
Figure 74 – C/S VCR relationships between GW and FDs . 122
Figure 75 – P/S VCR relationships between GW and FDs . 123
Figure 76 – P/S VCR relationships between FDs and GW . 123
Figure 77 – R/S VCR relationships between FDs and GW . 124
Figure 78 – Configuration process for a field device . 125
Figure 79 – UAO aggregation and disaggregation process . 126
Figure 80 – READ request message format . 127
Figure 81 – READ response(+) message format . 127
Figure 82 – READ response(-) message format . 127
Figure 83 – READ Service process . 128
Figure 84 – WRITE request message format . 128
Figure 85 – WRITE response(-) message format . 128
Figure 86 – WRITE Service process . 129
Figure 87 – PUBLISH request message format . 129
Figure 88 – PUBLISH Procedure from Field Device to Gateway Device . 130
Figure 89 – PUBLISH Procedure from Gateway Device to Field Device . 130
Figure 90 – REPORT request message format . 130
Figure 91 – REPORT Service process . 131
Figure 92 – REPORT ACK request message format . 131
Figure 93 – REPORT ACK response(+) message format . 131
Figure 94 – REPORT ACK response(-) message format . 131
Figure 95 – REPORT ACK Service process . 132
Figure 96 – ASL general packet format . 135
Figure 97 – Format of packet control field . 135
Figure 98 –Confirmed service primitives exchanged between layers . 137
Figure 99 – Unconfirmed service primitives exchanged between layers . 138
Figure 100 – Primitives invoking for read/ write MIB between layers . 139
Figure 101 – State transition diagram of AMCL . 140

– 8 – IEC PAS 62948:2015 © IEC 2015
Figure 102 – State transition diagram of AMSV . 142
Figure 103 – State transition diagram of AMPB . 146
Figure 104 – State transition diagram of AMSB . 149
Figure 105 – State transition diagram of AMRS . 152
Figure 106 – State transition diagram of AMRK . 152
Figure 107 – Security management architecture . 155
Figure 108 – Life cycle of keys . 157
Figure 109 – Format of NONCE . 158
Figure 110 – Time sequence of key establishment . 160
Figure 111 – Time sequence of key updating . 162
Figure 112 – SecAlarmt_Struct structure . 163
Figure 113 – Time sequence of security alarm . 163
Figure 114 – Secure join process of field device . 165
Figure 115 – Key establish process for field device . 166
Figure 116 – Key update state machine for FD . 167
Figure 117 – General secure DLL frame format . 170
Figure 118 – Secure aggregation frame format . 171
Figure 119 – Key establish request frame format . 172
Figure 120 – Key establish response frame format . 172
Figure 121 – Key update request frame format . 172
Figure 122 – Key update response frame format . 173
Figure 123 – Security alarm request frame format . 173
Figure B.1 – Timeslot timing template . 177

Table 1 – Conventions used for state transitions . 20
Table 2 – Definition of integer data type . 21
Table 3 – Unsigned16 coding . 21
Table 4 – Octetstring coding . 23
Table 5 – Coding of Bit Field data with one octet . 23
Table 6 – Coding of Bit Field data with two octets . 23
Table 7 – Coding of Bit Field data with three octet . 23
Table 8 – Network management functions . 30
Table 9 – Security management functions . 30
Table 10 – DMAP state transition of gateway device . 32
Table 11 – DMAP state transition of gateway device for each field device . 34
Table 12 – DMAP state transition of a field device . 38
Table 13 – Functions used in DMAP state transition . 41
Table 14 – Unstructured attributes . 48
Table 15 – Structured attributes . 50
Table 16 – Superframe_Struct structure . 50
Table 17 – Link_Struct structure . 51
Table 18 – ChanCon_Struct structure . 51
Table 19 – Device_Struct . 52

Table 20 – Key_Struct structure . 53
Table 21 – VcrEP_Struct definition . 54
Table 22 – UAOClassDesc_Struct definition . 55
Table 23 – ProDataDesc_Struct definition . 56
Table 24 – UAOInstDesc_Struct definition . 57
Table 25 – DMAP-MIB-GET.request parameters . 58
Table 26 – DMAP-MIB-GET.confirm parameters . 59
Table 27 – DMAP-MIB-SET.request parameters . 60
Table 28 – DMAP-MIB-SET.confirm parameters . 60
Table 29 – PHY protocol selection . 61
Table 30 – Coding of Modulation modes . 62
Table 31 – Channel indices . 63
Table 32 – Data rate . 63
Table 33 – Parameters of timeslot template . 65
Table 34 – DLDE-DATA.request primitive parameters . 74
Table 35 – DLDE-DATA.indication primitive parameters . 74
Table 36 – Management services . 76
Table 37 – DLME-DISCOVERY.request parameters . 77
Table 38 – DLME-DISCOVERY.confirm parameters . 77
Table 39 – BeaconDescription_Struct parameters . 77
Table 40 – DLME-TIME-SYN.indication parameters . 78
Table 41 – DLME-TIME-SYN.response parameters . 79
Table 42 – DLME-TIME-SYN.confirm parameters . 79
Table 43 – DLME-JOIN.request parameters . 81
Table 44 – DLME-JOIN.indication parameters . 81
Table 45 – DLME-JOIN.response parameters . 82
Table 46 – DLME-JOIN.confi
...