What Is BACnet? The Building Automation Protocol Explained

Office towers, hospitals, malls, and many plants with office blocks run a BMS (building management system) that controls chillers, AHUs, fan coils, pumps, and lighting. The data exists, but it often sits on one computer in the plant room. As soon as management wants to combine it with energy meters or room occupancy, the first question is whether the BMS speaks BACnet.

BACnet is an open data communication protocol for building automation and control networks, which is where the name comes from. It was developed by an ASHRAE committee, published as ANSI/ASHRAE Standard 135 in 1995, and is still revised (the latest edition is 135-2024). It has also been adopted internationally as ISO 16484-5. This guide explains how it works in plain terms, then how to bring its data into an IoT platform.

What is BACnet, and why do buildings use it?

Before a shared standard existed, each controller maker used its own protocol, which made mixing brands or changing contractors painful. BACnet defines a common language, so controllers, sensors, and workstations from different makers can exchange data on one network.

Systems that commonly use BACnet include HVAC (chillers, AHUs, fan coils, VAV boxes), pumps and boilers, lighting, and energy meters. Not every "BACnet" device is equal, though. What a device supports is described in its PICS (Protocol Implementation Conformance Statement), and some products are tested and certified by BACnet Testing Laboratories (BTL). A summary of the standard's history and editions is on Wikipedia.

Objects: how BACnet describes a device

Every BACnet device holds a set of objects. Each object represents one data point or function and has properties such as its current value (Present_Value), units, name, and alarm state.

Object type	Building example
Device	The device's identity, with an instance number unique on the network
Analog Input	Room temperature, chilled water supply temperature, pressure
Analog Output	Valve position, fan speed
Analog Value	Temperature setpoint
Binary Input	Fan running or stopped, dirty filter alarm
Binary Output	Pump on or off command
Multi-state Value	Operating mode: auto, manual, or off
Schedule and Trend Log	AHU operating schedule and value history stored in the controller

Each point is addressed by device number, object type, and object number, for example "Analog Input 3 on device 1201". Commandable objects such as outputs carry a priority array with 16 levels. A higher-priority command, such as a technician's manual override, beats a lower one such as a schedule. This matters for integration: writing values from outside the BMS can clash with the logic already in place.

Services: how devices talk to each other

• Who-Is and I-Am discover devices on the network by broadcast.
• ReadProperty and ReadPropertyMultiple read values, such as the current room temperature.
• WriteProperty writes values, such as a new setpoint at a given priority.
• SubscribeCOV (change of value) asks a device to report whenever a value changes by more than a set increment, so you do not have to keep asking.
• Alarm and event notifications are sent by controllers when alarm conditions are met.

Polling is simple and suits trend data. COV is more efficient for states that rarely change but need to be known quickly.

BACnet/IP versus BACnet MS/TP

Aspect	BACnet/IP	BACnet MS/TP
Medium	Ethernet or any IP network	Two-wire RS-485 serial cable, daisy-chained
How it works	UDP messages, default port 47808	Token passing: master devices take turns holding the token to transmit
Speed	That of the IP network	Much slower, limited by the serial baud rate
Used for	Main controllers, supervisors, workstations	Field controllers such as VAV boxes, fan coils, and room sensors
Common problems	Broadcasts do not cross routers, so a BBMD is needed	Duplicate addresses, termination, and wiring polarity

Many buildings use both: MS/TP field controllers connect through a router to a BACnet/IP backbone, and a BBMD (BACnet Broadcast Management Device) lets device discovery cross subnets. The serial versus IP pattern is much like the one in our article on Modbus RTU vs Modbus TCP.

How to bridge BACnet data to an IoT platform

IoT platforms usually accept data over MQTT or HTTP, not BACnet. So you need a translator: a protocol gateway or software on a local server that speaks BACnet towards the building and MQTT or HTTP towards the platform. The steps:

1. Inventory the points. Ask the BMS contractor for the point list, or run device discovery and read each device's object list. Keep only points you will use, such as AHU status and setpoints, chilled water temperatures, kWh per panel, and key alarms.
2. Clean up names and units. BMS object names are often cryptic abbreviations. Give them names users understand and consistent units.
3. Choose how to read. Poll every few minutes for energy trends and use COV for states that need a fast response. Do not flood a slow MS/TP trunk with tight polling.
4. Start read-only. Writing setpoints from outside the BMS needs agreement with the BMS owner, a clear priority level, and testing.
5. Secure the path. Most BACnet/IP and MS/TP installations run without authentication, so never expose BACnet ports to the internet. The translator should only send data outward over an encrypted connection. BACnet Secure Connect (BACnet/SC), added to the standard in 2019, brings TLS-encrypted connections, but many installed devices do not support it yet. Network separation is covered in our article on industrial IoT cybersecurity.
6. Test end to end. Compare the value on the BMS screen with the value in the platform for every point.

Things to keep in mind

• BMS contracts. Some contractors restrict third-party access during warranty or maintenance periods. Agree on it early.
• Integration does not replace the BMS. The BMS keeps running control. The IoT platform adds cross-system analysis, reports, and alarms that reach management.
• Controller history is limited. Trend Logs in controllers usually hold a limited amount of data, so long-term history belongs in the platform.
• Not everything is in the BMS. Room occupancy, CO2, or kWh per zone are often unmeasured and need extra sensors or meters.

Frequently asked questions

How is BACnet different from Modbus?

Modbus reads numbered registers whose meaning you look up in the device manual. BACnet uses objects that carry names, units, and alarm states, and it has services for discovering devices. Modbus is common in power meters and industrial equipment, BACnet in building HVAC. Many buildings use both.

Can an older BMS be connected?

If its controllers are BACnet, either IP or MS/TP, the data can usually be read through a protocol translator. If it uses a proprietary protocol, the options need checking with the BMS contractor during the survey.

Do we need to replace the BMS to get a building energy dashboard?

No. BMS data can be read and combined with energy meter data while the BMS carries on controlling the building as before.

BACnet integration with INCLUDE

To be clear: the INCLUDE platform accepts data over MQTT and HTTP, and IncludeGateways reads Modbus RTU devices. Neither speaks BACnet natively. BMS data is brought in through a protocol translator designed and installed by our system integration and industrial automation services: point survey, architecture design, phased integration, then commissioning until values in the platform match the BMS.

Once in, BMS data can be charted, given alarm thresholds, and forwarded to Telegram, on the same platform as InBuilding. InBuilding monitors occupancy, CO2, temperature, and energy per room, and finds air conditioning running in empty rooms. If savings are the goal, the next steps are covered in our article on cutting office AC energy.