BACnet

What is BACnet?

BACnet (Building Automation and Control Networks) is an open, vendor-neutral communication protocol that lets devices in building management systems, such as climate controllers, lighting, access control and fire alarm systems, exchange data and command each other. It was developed by the American engineering society ASHRAE, published in 1995 as ANSI/ASHRAE 135 and is standardised worldwide as ISO 16484-5. BACnet is one of the most widely used standards for building automation and the BMS in offices, hospitals, data centres and airports. That makes the control network of a building a fully fledged OT network that deserves the same security attention as a factory.

🧠 What does BACnet do?

BACnet enables devices and systems from different manufacturers to communicate with each other without custom integration. Typical examples:

• Fire and climate - a fire alarm system that shuts down air handling and opens smoke vents when smoke is detected
• Occupancy and lighting - motion sensors and time schedules that switch lighting and ventilation per room
• Climate - control of temperature, airflow and ventilation per zone
• Access - card readers and access management that trigger lighting or camera recording through the BMS when a door alarm occurs, as part of wider access control
• Operation and supervision - temperature sensors and controllers that show their values in an HMI, a BMS or a SCADA system
• Energy management - energy meters and plant that report consumption and faults centrally for monitoring, optimisation and spreading peak loads

BACnet’s strength is that the standard defines not only the bits on the wire but also what devices exchange: a common object model and a fixed set of services. A BACnet fire panel from manufacturer A can therefore interoperate with an HVAC controller from manufacturer B, provided both support the required functions.

🔧 How does the BACnet object model work?

Every BACnet device is a collection of objects with properties. Each device has exactly one Device object with a device instance: a 22-bit number from 0 to 4,194,302 that must be unique across the entire BACnet internetwork. ANSI/ASHRAE 135-2020 defines 62 standard object types. Commonly used types are:

Devices use services to work with those objects:

• Who-Is / I-Am - devices discover each other via a broadcast; each device replies with its device instance and address
• ReadProperty / ReadPropertyMultiple - read values, for example by a BMS that polls periodically
• WriteProperty - change values, using a priority array of 16 levels so that, for example, a manual override or fire control takes precedence over a time schedule
• SubscribeCOV - Change of Value: the device itself reports when a value changes, which causes less network traffic than polling
• Alarm and event services - report, acknowledge and summarise alarms

Which objects and services a device supports is stated in its PICS (Protocol Implementation Conformance Statement). Annex L of the standard groups this into device profiles, such as B-BC (building controller), B-AAC (advanced application controller), B-ASC (application specific controller), B-SA and B-SS (simple actuators and sensors) and B-OWS (operator workstation). Each profile is a list of BIBBs (BACnet Interoperability Building Blocks).

🌐 Which networks does BACnet run on?

BACnet defines the application layer and its own network layer, and can run over several data link layers. BACnet routers connect those networks, each identified by a network number between 1 and 65,534.

The standard also lists less common options such as point-to-point over RS-232, ARCNET, LonTalk and Zigbee. Because routers do not forward broadcasts, you place a BBMD (BACnet Broadcast Management Device) in each IP subnet. It forwards Who-Is messages to the BBMDs in other subnets. An external laptop or server can register with a BBMD as a foreign device.

🔄 How does BACnet compare with other building protocols?

In most buildings BACnet works alongside other protocols. Broadly: BACnet at automation and management level, specialised buses in the room.

A BACnet network fits into the Purdue Model at levels 1 and 2: controllers and field buses at the bottom, the BMS workstation and server above them. The link to the office network and the cloud should run through a controlled DMZ.

🔐 How do you secure BACnet?

Classic BACnet was designed for openness, not security. BACnet/IP and MS/TP have no encryption and no meaningful authentication: anyone who reaches the network can discover devices, read values and change setpoints or commands with WriteProperty. A replay attack or abuse of exposed devices for DDoS amplification is also possible.

That risk is real. In 2022 the Dutch Institute for Vulnerability Disclosure (DIVD) found large numbers of BACnet devices directly reachable from the internet on port 47808. Owners were warned in two rounds, in February and April 2022, and advised to restrict access to the port or move to BACnet/SC, to route remote maintenance through a VPN and to stop a compromised controller from serving as a stepping stone into other networks. See also Internet-Exposed OT.

BACnet Secure Connect (BACnet/SC) is ASHRAE’s answer. It was introduced with addendum 135-2016bj and has been part of the standard since ANSI/ASHRAE 135-2020. BACnet/SC carries BACnet messages over WebSockets inside TLS 1.3. Both ends authenticate with X.509 certificates. Nodes make outbound connections to a hub, so broadcasts and BBMDs are no longer needed and the traffic is easy to control with a firewall. BACnet/SC does, however, require certificate management throughout the life of the installation. The current edition, ANSI/ASHRAE 135-2024 (published at the end of December 2024), incorporates 17 addenda to the 2020 edition, including a certificate authority file format, configuration and certificate management for BACnet/SC, and a framework for authentication and authorisation.

Measures that belong in every BACnet network:

• Segmentation - separate building management from office and production networks with VLANs and firewalls, following the zones and conduits model from IEC 62443
• No direct internet access - remote maintenance only through secure remote access with MFA
• Protocol filtering - allow only known BACnet services and addresses; block WriteProperty from zones that only need to read
• Visibility - keep an inventory of all device instances and use passive monitoring; Wireshark decodes BACnet out of the box
• Defense in Depth - combine network measures with passwords on controllers, hardening and patch management

🏭 How do you approach a BACnet project in the Netherlands?

Since 1 January 2026, existing non-residential buildings in the Netherlands with a heating or air-conditioning system above 290 kW must have a building automation and control system (GACS) under the Buildings Decree (Besluit bouwwerken leefomgeving, Bbl). From 2030 the threshold drops to 70 kW. The requirement is functional and does not prescribe a protocol, but it does require systems to work together regardless of brand. In practice this often makes BACnet the backbone. For operators of critical buildings, such as hospitals and data centres, the Dutch Cybersecurity Act, which transposes NIS2, may also apply.

A practical approach:

1. Specify requirements in the tender - ask for BTL-certified devices (BACnet Testing Laboratories, run by BACnet International), a PICS per device and preferably support for BACnet/SC.
2. Create an addressing plan - reserve device instances and network numbers per building or floor so that duplicates never occur.
3. Design the MS/TP buses - use consecutive addresses without gaps, set Max Master to the highest master address in use and choose one baud rate per segment, usually 38,400 or 76,800 bit/s.
4. Limit broadcasts - at most one BBMD per subnet and no unnecessary foreign devices.
5. Segment and document - record zones and conduits and define the firewall rules per conduit.
6. Test at handover - check with a BACnet explorer or Wireshark that all objects, alarms and trend logs work as specified in the tender.

❓ Frequently asked questions

What does BACnet stand for?

BACnet stands for Building Automation and Control Networks. It is an open communication protocol from ASHRAE for building automation, standardised internationally as ISO 16484-5. BACnet allows devices from different manufacturers to exchange data.

Which port does BACnet/IP use?

BACnet/IP uses UDP port 47808 by default, which is 0xBAC0 in hexadecimal. That port should never be reachable from the internet, because classic BACnet has no authentication. BACnet/SC uses TLS-encrypted WebSocket connections instead.

What is the difference between BACnet/IP and BACnet MS/TP?

BACnet/IP runs over Ethernet and IP and is usually the backbone between building controllers and the BMS. BACnet MS/TP runs over an RS-485 two-wire bus with token passing and connects lower-cost field controllers over distances of up to about 1,200 metres. A BACnet router connects the two networks.

Is BACnet secure?

Classic BACnet, both BACnet/IP and MS/TP, has no encryption and no strong authentication. A BACnet network must therefore be segmented and shielded from the internet. BACnet Secure Connect adds TLS 1.3 and certificates and has been part of the standard since ANSI/ASHRAE 135-2020.

What does BTL certification mean for BACnet?

BTL certification means a BACnet product has been independently tested by the BACnet Testing Laboratories against the test standard ASHRAE 135.1. Certified products appear in a public listing maintained by BACnet International. Requiring BTL certification in the tender reduces the risk of integration problems between brands.

What is a BACnet device instance?

A BACnet device instance is the unique number of a device within the entire BACnet internetwork, with a value between 0 and 4,194,302. Duplicate device instances cause unpredictable communication faults. An addressing plan per building prevents them.

📌 In summary

BACnet is the open ISO standard that lets HVAC, lighting, access control and fire alarm systems from different brands work together in one building management system. Its object model, services and the BACnet/IP and MS/TP variants make integration straightforward. Because classic BACnet has no security, segmentation, shielding from the internet and, for new projects, BACnet/SC are always part of the design.