The BACnet protocol is the most widely deployed communication standard in building automation, and pairing it with IoT platforms opens the way to remote monitoring of HVAC, lighting, meters and access control. For teams connecting building installations to the cloud, a working knowledge of BACnet is now every bit as important as MQTT or Modbus. In this guide we explain how the BACnet protocol works, how its transport variants differ and how to bridge building data safely into the IoT layer.
In short: the BACnet protocol (ISO 16484-5, ASHRAE 135) is an open building automation standard built on a model of objects and services. It exposes data from HVAC controllers, meters and central plant through the BACnet/IP, MS/TP and encrypted BACnet/SC variants, which an IoT gateway can readily connect to the cloud over MQTT or OPC UA.
What is the BACnet protocol?
The BACnet protocol (Building Automation and Control Networks) is an open communication standard for building automation systems, defined in ASHRAE 135 and the international ISO 16484-5. It was created in 1995 so that devices from different manufacturers — HVAC controllers, meters, sensors, lighting and fire systems — could exchange data without closed, proprietary gateways.
Unlike purely telemetric protocols, BACnet defines both the data format and its semantics: what a given device can do, which measurement points it holds and how they can be read or commanded. That makes it a cornerstone of interoperability in smart buildings and in industrial IoT wherever building infrastructure meets production.
How BACnet works: objects, services and layers
BACnet is built on an object-oriented data model: every element of an installation is represented as an object with a standardised type and set of properties. The standard defines more than 60 object types, among them Analog Input, Analog Output, Binary Value, Multi-state Value, Schedule and Trend Log.
Communication takes place through services executed on those objects. The most important ones are:
- ReadProperty / WriteProperty — reading and writing a single property, for example a temperature setpoint.
- Who-Is / I-Am — automatic device discovery on the network.
- SubscribeCOV — Change of Value notifications, that is data pushed only when a value actually changes, which keeps network traffic down.
- ReadPropertyMultiple — retrieving many properties in a single request, essential for efficient polling.
Every device carries a unique Device Instance Number (0–4194302), which allows it to be addressed unambiguously regardless of the transport layer beneath it.
BACnet/IP versus BACnet MS/TP: which variant to choose?
BACnet is an application layer protocol that runs over several data link layers — the choice between them determines the cost, reach and bandwidth of the installation. The two most common variants are BACnet MS/TP and BACnet/IP.
BACnet MS/TP (Master-Slave/Token-Passing) runs over an RS-485 bus: it is inexpensive, robust and ideal for field controllers, but slow — up to 76.8 kbps over a run of 1,200 m and a maximum of 127 master nodes per segment. BACnet/IP carries frames in UDP packets on port 47808 (0xBAC0) over Ethernet, offering full bandwidth and easy integration with IT infrastructure.
In practice, modern deployments mix the two: field controllers talk over MS/TP, while supervisory controllers aggregate the data and expose it as BACnet/IP. Routing between IP segments is handled by BBMD devices (BACnet Broadcast Management Device) together with Foreign Device registration, which lets broadcast messages traverse routers that do not forward broadcasts.
What is BACnet/SC and why does it matter for IoT?
BACnet/SC (Secure Connect) is a secure transport layer added to the standard in 2019 (Addendum 135-2016bj) and designed for present-day cybersecurity requirements. It replaces spoofing-prone broadcast messages with an encrypted WebSocket connection over TLS 1.3, with mutual device authentication based on X.509 certificates.
For IoT integration this is a breakthrough: BACnet/SC removes the need to open UDP ports and configure BBMDs, works correctly through NAT and firewalls and connects naturally to the cloud. Classic BACnet/IP has no built-in encryption, which is why bridging it to the internet should always follow IoT security best practices — network segmentation, TLS and authentication on both sides of the gateway.
How to connect BACnet to the cloud and an IoT platform?
Integrating BACnet with the cloud rests on an edge gateway that translates BACnet objects into a universal IoT telemetry model. The gateway polls the devices or subscribes to COV, normalises the values and publishes them onwards — most often over MQTT to platforms such as Azure IoT or AWS IoT.
The pattern is analogous to bridging legacy industrial protocols such as Modbus and works well alongside OPC UA at the IT/OT boundary. The key tasks of an IoT gateway in such a scenario are:
- Mapping Device Instance and object identifiers onto readable telemetry tags.
- Buffering and store-and-forward of data whenever the cloud link drops.
- Terminating BACnet/SC or isolating the BACnet/IP segment from the public network.
- Remote write-back control (WriteProperty) with access control and an audit trail in place.
Applications: hotels, industry and smart buildings
BACnet dominates wherever building infrastructure has to be managed: heating, ventilation, air conditioning, lighting, utility meters and safety systems. In commercial and industrial properties it forms the integration layer between dozens of subsystems.
In hospitality, the BACnet protocol links room climate and lighting control to the management platform, and once bridged to IoT it feeds energy-saving and stay-personalisation systems. It is a natural complement to PMS integration in smart hotels, where the room status held in the booking system drives the HVAC setpoints — an empty room drops into economy mode, while check-in restores comfort.
Frequently asked questions (FAQ)
How does BACnet differ from Modbus?
BACnet is an object-based protocol with built-in semantics: a device describes its own points and capabilities. Modbus transfers only raw registers with no context and requires manual mapping. BACnet is richer and self-describing, Modbus simpler and lighter — the two frequently coexist in the same industrial installation.
Is BACnet safe to connect to the internet?
Classic BACnet/IP has no encryption, so it must never be exposed directly to the internet. A secure deployment calls for the BACnet/SC variant (TLS 1.3 and X.509 certificates) or for network isolation and bridging through an edge gateway with an encrypted channel to the cloud.
Which port does BACnet/IP use?
BACnet/IP uses UDP port 47808 by default, written in hexadecimal as 0xBAC0. Communication between IP segments requires BBMD devices and Foreign Device registration so that broadcast messages are forwarded correctly across routers.
Summary and key takeaways
The BACnet protocol remains the backbone of building automation, and its BACnet/IP, MS/TP and above all encrypted BACnet/SC variants make it ready for the IoT era. A properly designed edge gateway lets you connect building data to the cloud while preserving security and full control over the installation.
FSS Technology designs the complete chain — hardware, firmware, gateways and cloud integrations — for industrial buildings and hotels. Take a look at our connected device services or explore what system integration can do to bridge BACnet into your IoT platform.