BACnet/IP - Building Automation over Ethernet

BACnet/IP is the IP-network version of BACnet, the open protocol used in building automation systems. If Modbus is common around meters, drives, and factory devices, BACnet is common around HVAC controllers, chillers, air handling units, variable air volume boxes, lighting panels, access systems, fire interfaces, and building management systems.

BACnet does not start with registers. It starts with objects: analog inputs, binary outputs, schedules, calendars, trend logs, device objects, alarms, loops, and commandable values. That makes it more descriptive than a simple register map for building systems.

Learning Objectives

By the end of this lesson, you should be able to:

Explain why BACnet is object-oriented rather than register-oriented.
Identify where BACnet/IP sits in the communication stack.
Recognize common BACnet object types, properties, and services.
Understand discovery with Who-Is and I-Am.
Explain command priority arrays and relinquishing commands.
Troubleshoot BACnet/IP addressing, BBMD, unit, and priority problems.

Where BACnet/IP Fits

BACnet/IP carries BACnet messages over UDP/IP, normally on UDP port 47808, which is hexadecimal 0xBAC0.

flowchart TD B["BACnet application\nObjects, properties, alarms, schedules"] --> U["UDP\nUsually port 47808"] U --> I["IP\nSubnets and routing"] I --> E["Ethernet or WiFi\nBuilding network"]

BACnet/IP is not "Modbus with different register numbers." It has a richer application model and standardized object types.

BACnet Objects and Properties

Each BACnet device exposes objects. An object has a type, an instance number, and properties.

Object type	Example	Important properties
Analog Input	Supply air temperature	`presentValue`, `units`, `statusFlags`, `reliability`
Analog Output	Cooling valve command	`presentValue`, `priorityArray`, `relinquishDefault`
Binary Input	Filter pressure switch	`presentValue`, `activeText`, `inactiveText`
Binary Output	Exhaust fan command	`presentValue`, `priorityArray`
Multi-state Value	Occupancy mode	`stateText`, `presentValue`
Schedule	Office hours	weekly schedule, exception schedule
Trend Log	Temperature history	log buffer, interval, record count
Device	Controller identity	object name, vendor, protocol revision

Object addressing is commonly written like this:

Device 1201
  analogInput:3      Supply air temperature
  analogOutput:7     Cooling valve command
  binaryOutput:2     Fan enable

Do not trust a raw presentValue alone. Read units, statusFlags, and reliability when validating important points.

BACnet Services

Services are operations performed on objects.

Service	Purpose
`Who-Is`	Ask which BACnet devices are on the network
`I-Am`	Device replies with its device instance and address
`ReadProperty`	Read one property from one object
`ReadPropertyMultiple`	Efficiently read many properties
`WriteProperty`	Write a command or configuration value
`SubscribeCOV`	Subscribe to change-of-value updates
`ConfirmedEventNotification`	Send alarms and events
`TimeSynchronization`	Synchronize controller clocks

sequenceDiagram participant B as BMS Workstation participant A as AHU Controller participant V as VAV Controller B->>A: Who-Is B->>V: Who-Is A-->>B: I-Am device 1201 V-->>B: I-Am device 2304 B->>A: ReadProperty analogInput:3 presentValue A-->>B: 18.6 degC

Command Priority

BACnet commandable objects use a 16-level priority array. Lower numbers are stronger.

Priority	Typical use
1	Manual life safety
2	Automatic life safety
5	Critical equipment control
8	Manual operator command
10	Normal automatic control
15	Scheduling
16	Default command

If an operator writes a valve command at priority 8, a schedule at priority 15 cannot override it. To release the operator command, the system writes NULL at priority 8. The active value then falls back to the next occupied priority or to relinquishDefault.

BBMDs and Routed Networks

BACnet discovery often uses broadcasts. IP routers normally do not forward broadcasts between subnets. A BBMD, or BACnet Broadcast Management Device, forwards BACnet broadcasts in a controlled way so discovery can work across subnets.

flowchart LR subgraph A["Subnet A"] BMS["BMS workstation"] BB1["BBMD A"] end subgraph B["Subnet B"] BB2["BBMD B"] AHU["AHU controller"] end BMS -->|"Who-Is broadcast"| BB1 BB1 -->|"Forwarded broadcast"| BB2 BB2 --> AHU

Without correct BBMD configuration, devices may respond by direct IP address but fail to appear in automatic discovery.

Worked Example: Read a Supply Air Temperature

Suppose a BMS must read supply air temperature from AHU controller device 1201.

Discover the device using Who-Is or configure its IP address directly.
Read the device object name to confirm identity.
Read analogInput:3 presentValue.
Read analogInput:3 units, statusFlags, and reliability.

Example result:

Property	Value	Meaning
`presentValue`	`18.6`	Current measured value
`units`	`degreesCelsius`	Engineering unit
`statusFlags`	`inAlarm=false, fault=false`	Value is usable
`reliability`	`noFaultDetected`	Object has no declared sensor fault

Do not assume the numeric value is Celsius unless the units property confirms it.

BACnet/IP vs Modbus TCP

Feature	BACnet/IP	Modbus TCP
Data model	Objects and properties	Coils and registers
Discovery	Native `Who-Is` and `I-Am`	Usually manual
Typical domain	Building automation	Industrial devices, meters, drives
Transport	UDP/IP	TCP/IP
Events and alarms	Native	Vendor-specific or polled
Scheduling	Native object model	Usually application-specific
Command priority	Standard priority array	Application-specific
Security	BACnet/SC for secure deployments	Modbus Security or external VPN/TLS

BACnet/SC Note

Classic BACnet/IP does not provide modern authentication and encryption by itself. BACnet Secure Connect, usually called BACnet/SC, adds a secure WebSocket-based communication model using TLS certificates. New building networks should evaluate BACnet/SC or well-controlled segmentation instead of assuming a flat BACnet/IP LAN is safe.

Practical Checks

Confirm every BACnet device has a unique device instance number.
Check UDP port 47808 unless the site intentionally uses another port.
Verify BBMD settings when devices are on different IP subnets.
Read units, statusFlags, and reliability; do not trust presentValue alone.
Check the priority array when an output refuses to change.
Release commands by writing NULL at the priority that owns the point.
Keep BACnet/IP on a controlled building network segment.

Common Mistakes

Treating BACnet objects like fixed Modbus registers.
Reusing the same BACnet device instance in two controllers.
Forgetting that broadcasts do not cross routers without BBMD support.
Writing to an output at high priority and never releasing it.
Ignoring units, reliability, and status flags.
Assuming BACnet/IP is secure just because it uses Ethernet.

Summary

BACnet/IP is the dominant open protocol for building automation over IP networks. Its strength is the object model: devices describe temperatures, commands, alarms, schedules, trends, and priorities using standardized object types and services. Good BACnet integration depends on unique device IDs, correct discovery, BBMD configuration, careful priority handling, and attention to units, reliability, and status flags.

Mind Map

mindmap root((BACnet/IP)) Core concept Building automation Objects and properties UDP port 47808 Applications HVAC Chillers Lighting BMS alarms Key mechanisms Who-Is and I-Am ReadProperty COV subscriptions Priority array Design rules Unique device IDs BBMD across subnets Read units and status Release with NULL Practical checks Device discovery Object reliability Priority owner BACnet SC need Common mistakes Duplicate IDs Missing BBMD Stuck commands Trusting raw values