Phone: 0 (552) 380 25 25  |  Weekdays 10:00–18:00 · Technical support 24/7

🇹🇷 TR

Digital Bridge Blog

IoT & Hardware

BACnet Protocol Explained: Objects, BACnet/IP, MS/TP and Secure Integration for Building Automation

What is the BACnet protocol and how does it work? Objects and services, BACnet/IP vs MS/TP, PICS and BTL checks, BACnet/SC security and integration steps.

9 min read  · Digital Bridge Engineering Team
BACnet Protocol Explained: Objects, BACnet/IP, MS/TP and Secure Integration for Building Automation

The BACnet protocol (Building Automation and Control Networks) is an open standard that lets building equipment such as chillers, air handlers, lighting controllers and energy meters exchange data regardless of manufacturer. Defined by ANSI/ASHRAE Standard 135 and published as ISO 16484-5, it describes every device as standard "objects", so one BMS can read and command many vendors' controllers.

Why the BACnet protocol matters to building owners

Most buildings accumulate equipment from different contractors over many years. The chiller comes from one maker, the air handling unit's control panel from another and the fan coil thermostats from a third. Each works perfectly well on its own screen, but a central system can only see them side by side if they share a language.

BACnet was designed for exactly that. ASHRAE's BACnet standard page says the protocol was built specifically for the communication needs of HVAC control, fire and life safety, energy management, lighting, physical access control and lift monitoring. The official BACnet Committee site lists ANSI/ASHRAE 135-2024 as the latest edition, so this is a living standard that is still being revised.

We cover what a building management system does and which systems it pulls together in our smart building BMS guide. This article goes one layer down: what "BACnet compatible" in a specification really means, and how to verify it before you sign off an integration.

The cost of getting the protocol wrong

Buildings are not a minor energy line. According to the IEA's Energy Efficiency 2025 report, buildings chapter, buildings account for around 30% of global energy demand. In Türkiye, the Ministry of Energy and Natural Resources' Second National Energy Efficiency Action Plan reports that buildings and services took 32.6% of final energy consumption in 2022.

Controlling that consumption starts with equipment that can share data. The value of control itself has been measured:

A 2017 study by the US Pacific Northwest National Laboratory (PNNL) found that widespread, correct use of controls could cut annual commercial building energy use by an average of 29%, yet only about 15% of US commercial buildings have building automation systems. (PNNL – commercial building controls study)

Protocol lock-in quietly blocks that potential. Buy a controller with a closed protocol and every future integration depends on the vendor's own software or an extra gateway. Security is a separate cost: Verizon's 2026 Data Breach Investigations Report found that exploitation of vulnerabilities was the most common initial access vector for breaches, at 31%. A building control network left reachable from the internet is precisely that kind of entry point.

How BACnet works: objects, properties and services

BACnet's strength is a vendor-neutral data model. Three ideas are enough to follow any integration meeting.

Objects. Every measurement or command point is a standard object type. A temperature sensor is an Analog Input, a valve command an Analog Output, a fan run status a Binary Input and a setpoint an Analog Value. Schedule, Calendar, Trend Log and Notification Class objects standardise timetables, logging and alarms, and every device carries a single Device object that identifies it.

Properties. Each object has properties such as Present_Value, Units and Status_Flags (fault, alarm, out of service). Commandable objects include a 16-level priority array, so a fire mode command can override a routine schedule command. How doors should behave when the fire alarm trips is covered in our access control and fire alarm integration guide.

Services. Devices use services to read and write those objects. Who-Is and I-Am discover devices on the network, while ReadProperty and WriteProperty read or change values. SubscribeCOV (change of value) sends updates only when a value changes, which is far lighter on the network than constant polling.

BACnet/IP, MS/TP and BACnet/SC: which transport goes where?

BACnet carries the same data model over different physical networks. These are the options you will meet most often on site:

TransportPhysical mediumTypical useWatch out for
BACnet/IPEthernet, UDP (default port 47808)Supervisory controllers, BMS server, chiller and AHU panelsBroadcasts do not cross subnets; a BBMD is needed between them
BACnet MS/TPRS-485 serial trunkFan coils, VAV boxes, thermostats and other field devicesBaud rate, termination, duplicate MAC addresses and cable length
BACnet/SCWebSocket over TLS with certificatesNew projects, cloud links, traffic between network segmentsCertificate management and hub design need planning; not all devices support it yet
Gateway (Modbus/KNX to BACnet)MixedLegacy equipment without native BACnetUndocumented point mapping makes maintenance painful

Classic BACnet/IP and MS/TP installations in the field run, in practice, without authentication or encryption: anyone on the network can read and write. BACnet Secure Connect (BACnet/SC) was developed to close that gap with TLS and certificates. We look at control-network risks and segmentation in more depth in OT security for SCADA.

BACnet rarely works alone. DALI and KNX are common for lighting, and Modbus RTU or TCP for energy analysers. If building data also has to reach production systems, understanding how OPC UA works helps you decide at which layer the two worlds should meet.

Six steps to verify a BACnet integration

"BACnet compatible" on a datasheet is not enough. A device may expose a few readable objects yet refuse writes, alarms or schedules. Working through this sequence moves the surprises from commissioning to the tender stage:

  1. Ask for the PICS. The Protocol Implementation Conformance Statement declares which object types, services and transports the device supports. Without a PICS, a BACnet claim cannot be checked.
  2. Check the device profile. The standard defines profiles such as B-BC (building controller), B-AAC (advanced application controller) and B-ASC (application specific controller). A fan coil may only need B-ASC, whereas a supervisory controller running schedules and alarms should be a B-BC.
  3. Look at the BTL listing. Products that pass testing by BACnet Testing Laboratories (BTL), run under BACnet International, are listed. Listing is not mandatory, but it is a strong signal of interoperability.
  4. Build the points list. For each device, record which object maps to which physical point, its units and whether it is writable. Confirm that device instance numbers are unique across the whole site.
  5. Draw the network. Produce a diagram showing BACnet/IP subnets, BBMDs, MS/TP trunks and routers. Separate the BMS network from the corporate LAN and never expose UDP 47808 to the internet.
  6. Test on site. Run a Who-Is discovery with a BACnet explorer, read and write a handful of critical points, and check COV subscriptions and alarm delivery. Attach the results to the commissioning report.

The same checklist is useful when choosing a remote monitoring platform: ask which BACnet services its driver actually supports.

Turning BACnet data into decisions

Reading BACnet points is only half the job. The value appears when data is stored and analysed: which air handler runs outside working hours, which valve sits at 100% open, which zone has its setpoint overridden by hand every afternoon. Moving that data to the cloud or a central platform often involves a lightweight messaging layer such as MQTT. Answering those questions also needs the right storage, and we compare the options in our guide to time-series databases for sensor data.

Where buildings and production share a site, BACnet building data can sit alongside process data in a SCADA system. In critical buildings such as hospitals, deciding what to optimise and what to leave untouched matters even more; we cover that in hospital building energy management.

How Digital Bridge delivers BACnet integration

Our smart building BMS projects work with Modbus, BACnet, KNX and DALI. The approach runs in clear stages:

  • Discovery and requirements analysis. We survey the site, collect the equipment inventory, any existing PICS documents and the network layout. Where legacy equipment has no BACnet interface, we define the gateway or extra hardware at this stage.
  • Pilot. Rather than connecting the whole building at once, we bring one air handler or one floor online with its points list, alarms and trend logs. The pilot data sets the priorities for the next phase.
  • Integration. We combine BACnet points with energy monitoring and management, and bring separate systems such as fire panels, IP cameras and access control with our own SmartPass product into one panel through our system integrations work. For dispersed estates we add a remote monitoring layer. Because SmartPass lists who is inside each zone at any moment, it gives emergency teams information that complements BMS alarms.
  • Security. Network separation, strong authentication for remote access and a path to BACnet/SC are planned as part of our cyber security consultancy.
  • Software and hardware from one team. When a device has no usable protocol support, we can design the control board and firmware ourselves; the process is described in our IoT device development process article.

We do not sell off-the-shelf packages. After the requirements analysis we issue a written proposal setting out scope, phases and price, and the site assessment for Industry 4.0 projects is free of charge. We work across Türkiye, on site and remotely.

Next step

The quickest way into a BACnet project is knowing what your equipment already speaks. Send us your equipment list, any PICS documents and the building plans, and we will work out together which devices connect natively and which need a gateway. You can reach us through our contact page.

For more guides on sensors, connectivity and field hardware, browse all our IoT and hardware articles.

Let us look at your case

Tell us about your process; after a needs analysis we send a written proposal with scope, phases and cost.

Request a Quote +90 552 380 25 25
Questions we hear most often

Frequently Asked Questions

What is the difference between BACnet and Modbus?

Modbus is a simple protocol that reads and writes numbered registers; you learn what each register means from the device manual. BACnet presents every point as a standard object with its name, units, status and alarm information, and it defines scheduling and alarm services as well. That is why BACnet is more common in building automation, while Modbus is more common in energy analysers and simple field devices.

How do I choose between BACnet/IP and BACnet MS/TP?

The choice is usually made per device. Supervisory controllers and the BMS server connect over Ethernet using BACnet/IP, while large numbers of small field devices such as fan coils and thermostats sit on RS-485 trunks using MS/TP. MS/TP cabling is inexpensive, but bandwidth is limited and response times grow as more devices share a trunk.

Is BACnet a secure protocol?

Classic BACnet/IP and MS/TP installations in practice run without authentication or encryption, so anyone with network access can read values and send commands. The BMS network should therefore be separated from the corporate LAN, remote access protected with strong authentication, and the BACnet port never exposed to the internet. New projects can adopt BACnet/SC, which uses TLS and certificates.

What if older equipment does not support BACnet?

If the equipment offers Modbus, KNX or a vendor-specific interface, a gateway can translate those points into BACnet objects. If there is no communication interface at all, data can be collected with additional sensors or a control board. The right method is decided per device during the site survey, and the point mapping should always be documented.

What drives the cost of a BACnet integration?

The main cost drivers are the number of devices and points to connect, whether existing equipment speaks BACnet natively, how many gateways and routers are needed, the condition of the MS/TP cabling, the licensing model of the BMS software and the commissioning tests. Security requirements such as BACnet/SC or network separation also shape the scope. A realistic budget can only be written after the survey produces a points list and the PICS documents have been reviewed.

Why does a PICS document matter?

The PICS is the formal statement of which parts of BACnet a device actually implements. It tells you which object types can be read or written and whether alarm, scheduling and change-of-value services are available. Requesting it at tender stage lets you spot incompatibilities before they surface during commissioning, when they are far more disruptive to fix.

Have a different question? Ask Us

Talk to an Engineer

Tell us what you need to solve. We'll come back with a written proposal.