How does BACnet protocol work | BACnet Analyzer for BACnet protocol analysis

This BACnet tutorial page covers how BACnet protocol works. It covers BACnet objects, BACnet services and headers added by link layer(BVLCI), network layer(NPCI) to APDU of application layer. This BACnet protocol analysis is useful in BACnet protocol analyzer.

The BACnet protocol layers consists of physical layer, link layer, network layer and application layer. Refer BACnet protocol stack which explains basic functions of BACnet protocol layers as mentioned.

As mentioned earlier BACnet stands for Data Communication Protocol for Building Automation and Control Networks. Earlier days proprietary systems were not interoperating, due to which effective control of commercial building was difficult. BACnet has been implemented to make proprietary systems from different vendors to interoperate. The provision has also been incorporated in latest standards so that BACnet networks can interoperate with other technologies such as Zigbee, KNX etc.

BACnet also supports legacy LAN protocols such as Ethernet, ARCNET, MS/TP and LonTalk. The standard is maintained and managed by ASHRAE(American Society of Heating, Refrigerating and Air-Conditioning Engineers)

BACnet Standards

-BACnet standardization began in 1987 (During meeting of ASHRAE)
-BACnet became ISO standard in 2003 (ISO 16 484-5)
-BACnet managed from 2006 by BACnet international to provide conformance testing services as well as promotes adoption and development of the standard.
-In USA, BACnet became standard in 1995 (ASHRAE/ANSI standard 135), Conformance testing is standardized in BSR/ASHRAE standard 135.1 in 2003
-In Europe, it was adopted in 2003 by CEN Technical Committee 247 for automation and management level.

BACnet protocol layer header

BVLCI-BACnet Virtual Link Control Information

Link layer in BACnet defines PTP for RS232 and MS/TP for RS485. The standard defines BACnet Virtual Link Layer(BVLL) which formalizes all the services required from link layer in BACnet device (e.g. broadcast).

In BACnet device, control informations are encapsulated using IP BVLL. This was not available in normal IP layer. The informations are added in BVLCI header. Using this header BACnet devices can communicate directly without the need of router. BBMD (BACnet Broadcast Management Device) concept in BACnet takes care of broadcast features of BACnet for particular link layer.


Similar BACnet segments are connected by bridges and dissimilar by routers. BACnet addresses are of two types viz. network identifier and address identifier. NPCI is the short form of BACnet network header, which includes following information elements.

NPCI = {
• 2 byte source network (SNet), variable lengt source address(SAddr, SLen),
For ethernet, ARCNet and MS/TP native protocol address format is used.
For LonTalk concatenation of subnetID and nodeID(2 bytes)
OR concatenation of subnetID and Neuron ID(7 bytes) is used.

• 2 byte destination network(DNet), variable length destination address (Daddr, Dlen)
For broadcast messages DNet identifies network on which a broadcast is required or needed and Dlen = 0

• 4 byte network priority indicator

• 1 byte message type: 9 message types are used by BACnet routing mechanisms
For example, "Who-is-router-to-network" to discover a router to a specific networkID
Vendors can define specific extension message types.

• 2 byte vendor ID

BACnet Objects

The device basic function is designated as objects. Each device is decomposed into collection of standardized objects. The properties of object are as follows:

• Physical Input
• Physical Output
• Name, type and configuration parameters

Each object is identified using unique identifier within the device. The identifier is designated as Object_Identifier. BACnet supports about 30 object types for which standard properties and expected behavior has been defined.

Following are the standard object types:

• Analoginput
• AnalogOutput
• AnalogValue
• BinaryInput
• NotificationCLass
• Program
• Schedule
• BinaryOutput
• BinaryValue
• Calender
• Command
• Device • 
• MutistateValue
• TrendLog
• EventEnrolment
• File
• Group
• Loop
• MultistateInput
• MultistateOutput
• LifeSafetyPoint
• LifeSafetyZone
• Accumulator
• PulseConverter

All the BACnet devices are needed to implement device object. Object_identifier should be unique across the entire BACnet network.

BACnet Services

BACnet protocol considers that all the objects act as servers which provide the services in the network. The five class of services are defined in the standard ANSI/ASHRAE 135 clause 13 to 17.

Each service uses set of messages based on communication needs in the network. ANSI/ASHRAE 135 clause 21 defines these messages. These messages are exchanged using remote operation primitives such as REQUEST, INDICATION, RESPONSE and CONFIRM.

The list of standard BACnet service primitives have been mentioned in the standard. For example, "Who-Is"/"I-AM" primitives are used to discover devices on a BACnet network.

BACnet Over Web Services Interface

XML group has introduced Addendum-C to BACnet 2004 specifications which specifies web services interface to building automation and control systems.

This BACnet protocol analysis will help one understand how BACnet protocol works.

IoT Wireless Technologies

THREAD    ➤EnOcean    ➤LoRa    ➤SIGFOX    ➤WHDI    ➤NFC   ➤Lonworks   ➤CEBus   ➤UPB  

RF Wireless Tutorials