BACnet Explained: Objects, Services and BACnet/IP vs MS/TP

BACnet is the open communication standard for building automation. It was developed under ASHRAE, is also published as an ISO standard, and lets controllers, sensors, workstations and gateways from different manufacturers exchange data about HVAC, lighting and other building systems. Where Modbus gives you a list of numbered registers, BACnet gives you named objects with properties, so a device can describe what it is and what it measures.

If you come from PLCs, the quickest mental model is this: every point in a BACnet device (a zone temperature, a damper command, a schedule) is an object with an identifier, and you read or write that object's properties over a network using a small set of standard services. This guide explains the object model, the services, the two data links you will meet most often (BACnet/IP and MS/TP), a worked VAV example, and a checklist for the problems that actually come up during commissioning.

What BACnet Is and Where You Meet It

BACnet stands for Building Automation and Control Networks. The standard is maintained by ASHRAE (it is ASHRAE/ANSI Standard 135) and is also adopted internationally as ISO 16484-5. Confirm the edition you need in the standard itself; a device's actual behaviour is described in its own documentation.

You will typically meet BACnet in three places:

• Field controllers on VAV boxes, fan coil units, rooftop units and air handlers, usually speaking BACnet MS/TP over an RS-485 trunk.
• Building controllers and routers that collect those trunks onto an IP network using BACnet/IP.
• Supervisory software and gateways: a building management workstation, a trending server, or a gateway that exposes a plant PLC to the building system.

Each device publishes a Protocol Implementation Conformance Statement (PICS) listing which objects, services and data links it supports. Before you promise that two products will talk, read both PICS documents. BACnet also moves data, not control logic: the sequence of operation still lives in the controller program, covered in our HVAC PLC programming guide.

The Object Model: Objects and Properties

Every piece of data in a BACnet device is an object. Each object has a type, an instance number, and a set of properties. The pair of object type and instance, such as Analog Input 3, forms the object identifier, and it is unique within the device.

The object types you will use daily:

A few properties appear on nearly every object and are worth memorising:

• Object_Identifier and Object_Name: the numeric identity and the human-readable name. Object_Name must be unique within the device.
• Present_Value: the live value. For an input it is what the device measured; for an output it is what the device is currently driving.
• Status_Flags: four flags (in alarm, fault, overridden, out of service) that tell you whether to trust the value.
• Out_Of_Service: when true, the real input is disconnected from Present_Value so a technician can write a test value. For an input this is a useful simulation tool; forgetting to clear it is a classic cause of a point that "never changes".
• Units on analog objects, and Active_Text/Inactive_Text on binary objects.

Services: How Devices Talk

BACnet defines a set of services, which are the requests devices send each other. You do not need all of them. These are the ones that matter in the field:

• Who-Is / I-Am: discovery. A workstation broadcasts Who-Is, optionally with a range of device instances, and each matching device answers I-Am with its device instance and network address. When a tool "scans the network", this is what it does.
• ReadProperty and ReadPropertyMultiple: read one or several properties. Workstation graphics poll with these.
• WriteProperty: write a property, for example the Present_Value of a commandable output or a setpoint.
• SubscribeCOV: subscribe to change of value. Instead of polling every few seconds, the supervisor asks to be told when a value changes by more than an increment, which reduces traffic on a slow MS/TP trunk.

Commandable Objects and the Priority Array

Outputs and many values are commandable. A write to a commandable Present_Value does not simply overwrite it. The write carries a priority from 1 to 16, and the object keeps a 16-slot Priority_Array. The object's value is whichever non-empty slot has the lowest priority number, and if every slot is empty it falls back to Relinquish_Default.

This lets several clients share one point safely. A manual override at a strong priority beats a scheduled command at a weaker one until someone relinquishes it by writing NULL at that priority.

A damper that will not follow its program may be held by a forgotten manual write: read the Priority_Array before you suspect the controller.

Data Links: BACnet/IP, MS/TP and BBMDs

The application layer rides on several data links. Two dominate.

BACnet/IP uses UDP, with 47808 as the default port, which is 0xBAC0 in hexadecimal. Devices can be configured to use other ports, and when they do, everything that must talk to them has to match.

MS/TP (Master-Slave/Token-Passing) shares one RS-485 pair among many devices. Master devices pass a token to take turns transmitting. All devices on the trunk must use the same baud rate, each needs a unique MAC address, and the Max_Master setting tells masters how far up the address range to look for the next master. Setting Max_Master far higher than the highest real MAC wastes time polling for devices that do not exist. The electrical side is ordinary RS-485: twisted pair cable, one daisy-chain, termination at the two ends only, and biasing in one place. Our RS-485 wiring guide covers that in detail and applies equally here.

BBMDs and Foreign Devices

BACnet discovery depends on broadcasts, and IP routers do not forward broadcasts between subnets. A BACnet Broadcast Management Device (BBMD) solves this. One BBMD sits on each subnet and holds a Broadcast Distribution Table listing the others. When a device broadcasts, its local BBMD forwards the message to the other BBMDs, which rebroadcast locally.

A device that cannot sit on a subnet with a BBMD, such as a laptop on a different network, can register as a foreign device with a BBMD.

If Who-Is works on one subnet but finds nothing across the router, a missing or misconfigured BBMD table is the first suspect.

BACnet also defines BACnet/SC (Secure Connect), a newer data link that uses TLS-secured WebSocket connections through a hub. It is intended to make secure deployments easier on IT networks. Ask vendors about support rather than assuming it.

Device Instance and Network Numbers

Every device has a Device object with a device instance number. It must be unique across the whole BACnet internetwork, not just on one trunk. Duplicates are a common cause of baffling behaviour: two devices answer for the same instance and a workstation shows one device with mixed-up points.

BACnet also gives every network, whether an MS/TP trunk or an IP segment, a network number, so routers can forward messages. Those numbers must be unique per network and consistent on both sides of a router.

BACnet vs Modbus

Both are used to read values from controllers, and many sites run both, often through a gateway. The core difference is the data model.

Modbus is simpler and very easy to implement, which is why it is everywhere in drives, meters and sensors. BACnet carries more context per point, which is useful when hundreds of points need to appear on one supervisory screen with consistent names and units. If you need the Modbus side, see our Modbus RTU tutorial and the wider PLC communication protocols guide.

WORKED EXAMPLE: Reading a VAV Zone and Commanding the Damper

Suppose a VAV box controller sits on an MS/TP trunk behind a BACnet/IP router. You are standing at a laptop with a BACnet tool on the IP side, and the zone is reported too warm.

Step 1: Find the device. Send a Who-Is. The VAV controller answers I-Am with, say, device instance 2301 and its network number and MAC. If nothing answers, jump to the checklist below; do not guess at points yet.

Step 2: Read the Device object's Object_Name to confirm you have the right box. A name such as VAV-2-14 is far more trustworthy than an instance number you copied from a drawing.

Step 3: Read the zone temperature. The controller exposes Analog Input 1, named ZN-T. ReadProperty on Present_Value returns 24.6, and Units says degrees Celsius. Check Status_Flags: all four false means the value is in good standing. If Out_Of_Service is true, the number is a test value and not a measurement.

Step 4: Read the setpoint. Analog Value 4, ZN-T-CLG-SP, reads 22.0. The zone is 2.6 degrees above setpoint, so the damper should be opening.

Step 5: Read the damper command. Analog Output 1, DMPR-CMD, reads 20 percent. That is low for a warm zone. Read its Priority_Array. Slot 8 holds 20 and the other slots are empty, so a manual operator command at priority 8 has been left in place. The program's own writes are at a weaker priority and are being outranked.

Step 6: Decide. Confirm with whoever owns the system that the override is not deliberate, then write NULL to priority 8 to relinquish it. The controller's program now controls the output again, and Present_Value should climb as the loop responds. Re-read after a minute to verify.

Commissioning and Troubleshooting Checklist

Work from the bottom of the stack upward, and change one thing at a time.

1. Device does not answer Who-Is. Confirm power and that the controller is actually running. Check that the tool uses the right UDP port (47808 unless the site changed it) and the right network adapter on a laptop with several.
2. Works on one subnet, nothing across the router. Check the BBMD on each subnet, its Broadcast Distribution Table, and whether the laptop needs foreign device registration.
3. Two devices behave like one. Look for a duplicate device instance. Scan the whole internetwork and sort by instance number.
4. MS/TP trunk flaky or silent. Verify one baud rate on every device, a unique MAC on every device, and a sensible Max_Master. Then check the wiring: continuous daisy-chain, no stubs or stars, termination at both ends only, one biasing point, and shield grounded at one end per the manufacturer.
5. Point never changes. Read Out_Of_Service and Status_Flags. Look for a stuck Overridden flag or a manual priority-array entry.
6. Writes accepted but ignored. Inspect the Priority_Array; a stronger priority may be holding the output.

Limits and Security

BACnet was designed for trusted building networks, and classic BACnet/IP offers no encryption or authentication on its own. Security depends on how it is deployed: separate VLANs, firewalls that only allow the required UDP traffic, restricted routing between building and corporate networks, and no direct exposure to the internet. BACnet/SC adds transport security, but only where both ends and the surrounding infrastructure support it. Do not assume a BACnet network is secure because it is "just building controls"; plan the network like any other operational technology network.

Training material. Follow your site procedures, local electrical code and the manufacturer's instructions.

Frequently Asked Questions

What is BACnet?

BACnet is an open communication standard for building automation, developed under ASHRAE and also published as ISO 16484-5. It defines how controllers, sensors and supervisory systems exchange data about HVAC, lighting and similar systems using objects with properties and a set of standard services.

What is the difference between BACnet and Modbus?

BACnet uses typed objects with names, units and status flags, supports device discovery and change-of-value subscriptions, and has a priority scheme for writes. Modbus exposes flat tables of coils and registers with no self-description, so you need a register map to know what each address means.

BACnet/IP vs BACnet MS/TP?

BACnet/IP runs over Ethernet using UDP and suits backbones between controllers and workstations. MS/TP runs over an RS-485 twisted pair with token passing and suits field trunks to VAV and unitary controllers. Many buildings use both, joined by a router.

What port does BACnet use?

BACnet/IP uses UDP port 47808 by default, which is 0xBAC0 in hexadecimal. A site can configure devices to use a different port, so if discovery fails, confirm the port in the device configuration and make sure firewalls allow it.

What is a BBMD?

A BACnet Broadcast Management Device forwards BACnet broadcast messages between IP subnets, because routers normally do not. Each subnet gets a BBMD configured with a table of the others, and devices that cannot join a BBMD's subnet can register with it as foreign devices.

What is a BACnet device instance?

The device instance is the number in a device's Device object that identifies it on the BACnet internetwork. It must be unique across all connected networks, and duplicate instances are a frequent cause of confusing behaviour during commissioning.

Is BACnet secure?

Classic BACnet/IP does not provide encryption or authentication by itself, so its security depends on network design such as segmentation, firewalls and restricted routing. BACnet/SC adds TLS-based security, but you need support from the devices and infrastructure to use it.

Can a PLC talk BACnet?

Some PLCs and many gateways support BACnet directly or through an add-on module, and others reach BACnet systems through a protocol gateway, often using Modbus on the PLC side. Check the controller's documentation and its PICS to see which objects and services are supported before you design around it.