BACnet basics: objects, properties, discovery and how a BACnet network is built

BACnet stands for Building Automation and Control Networks. It is a data communication protocol standardised as ASHRAE 135 and ISO 16484-5, designed so that devices from different manufacturers, such as controllers, sensors, drives and the building front end, can exchange information in a common way. Before open protocols, a building tended to be locked to one vendor for life. BACnet is the main reason that is no longer true.

It is worth being clear about what BACnet is not. It does not control anything by itself. The control logic lives in the controllers. BACnet is the language the controllers and the front end use to publish readings, accept commands and report alarms.

BACnet describes everything as objects. A device, such as a VAV controller, contains a number of objects, and each object represents one thing: a temperature, a damper command, a schedule. Each object has properties, which are the pieces of information about it.

The object types you meet first are analog input, analog output and analog value, and binary input, binary output and binary value. Beyond those are multi-state objects, schedules, calendars, trend logs and notification classes for alarms. Every object has an identifier made of its type and an instance number, such as analog input 3, and a name that is meant to be readable.

The property you read most is Present_Value, the current value. Others you will use constantly are the object name, the units, the status flags that report alarm, fault, overridden and out-of-service conditions, and Out_Of_Service, which when true means the value is being supplied by hand and not by the real input. Commandable objects, such as analog outputs, also have a priority array, which we come back to under troubleshooting.

Objects and properties describe the data. Services are the requests you make about it. A few do most of the work.

• Who-Is and I-Am: a device or tool broadcasts Who-Is to ask which devices exist, and each device answers with I-Am, giving its device identifier. This is how a front end or a commissioning tool discovers a network.
• ReadProperty: ask one device for one property of one object, for example the Present_Value of analog input 1.
• ReadPropertyMultiple: ask for several properties in one request, which is far more efficient for a front end polling many points.
• WriteProperty: set a property, for example command an analog output.
• Change of value subscription: ask a device to send an update only when a value changes by a set amount, instead of being polled all the time.

Suppose you have connected a laptop tool to a BACnet network and need the zone temperature from a VAV controller you have never seen.

The steps, discover, list, read, then check the flags, are the same on any BACnet device from any maker. That repeatability is the point of the standard.

BACnet can run over several kinds of network, and a building often uses more than one. BACnet/IP carries messages over ordinary Ethernet and IP networks, typically using UDP port 47808. It is the usual choice between supervisory controllers and the front end. BACnet MS/TP runs over RS-485 twisted pair using a token-passing scheme, and is common for the lower-cost field controllers on a floor, because the wiring is cheap and simple. A newer variant, BACnet/SC, adds secure connections for networks that need them.

Routers join different BACnet networks. Because discovery uses broadcast messages and IP routers do not forward broadcasts, a BACnet/IP system that spans more than one subnet needs a device called a BBMD, a BACnet Broadcast Management Device, to carry the broadcasts across. A missing or misconfigured BBMD is one of the classic reasons that devices on another subnet cannot be seen.

Addressing needs care. Each device on the whole internetwork needs a unique device instance number. On MS/TP each device also needs a unique MAC address on its own segment. Duplicate numbers cause intermittent and baffling behaviour.

Both are common in buildings and plant, and they are often connected through a gateway. They are built on different ideas.

The Modbus simulator on this site lets you practise register addressing and exception codes. If you can read a Modbus register map, you will find BACnet friendlier, because the points carry their own names and units.

If a device does not appear after a Who-Is, work from the bottom up. For MS/TP, check wiring polarity, termination, the baud rate and that no two devices share a MAC address. For BACnet/IP, check that the device and the tool are on a reachable network, that UDP port 47808 is not blocked by a firewall, and whether a BBMD is needed between subnets. Check for a duplicate device instance, which can make one device appear to vanish.

If you can see the device but a command does not take effect, think about the priority array. Commandable objects accept writes at a priority level from 1 to 16, and the value in force is the one at the highest priority that is not empty. If another system or an operator has written a value at a higher priority, your write at a lower priority is accepted and stored but is not the value the object uses. Releasing the override at the right level, not forcing a higher one, is usually the fix.

Security deserves a sentence. Classic BACnet/IP has no strong authentication, so it should live on a segmented building network and should not be exposed to the internet. Treat any change to a live building system as work for an authorised person following the owner's procedures.

This page is an explainer. The simulator on this site runs PLC logic, HMI, Modbus and other labs, and does not implement a BACnet stack, so there is no BACnet lab to run. What transfers is the surrounding skill: reading a point list, scaling analog values, understanding networks, and tracing a fault from the symptom to the device.

The Industrial Networks and SCADA track covers the plant-floor network stack, RS-485 versus Ethernet, Modbus, EtherNet/IP, PROFINET, OPC UA and more, and its first units are free with a free account. The building automation training page covers the control-sequence side.