First, a warning: BACnet devices often control real plant: chillers, fans, pumps, fire dampers. Do not poke at a building you do not own or have written permission to work on. Start read-only, and do not write to any point on a live system until you understand exactly what it controls.
Transports
- BACnet/IP: UDP, port 47808 (0xBAC0) by default. Most common on modern gear. Discovery relies on broadcasts, so it stays within a subnet unless you use a BBMD (below).
- BACnet MS/TP: RS-485 serial, typically for field controllers. Usually reached through a router or the controller's IP side.
- BACnet/SC: the newer secure version using TLS over WebSockets. Not yet on much existing equipment, but it is where security is heading. The YABE explorer mentions support for it.
The model in 60 seconds
- A device has a unique device instance number (0 to 4194302) that must not clash with any other device on the whole BACnet internetwork.
- A device contains objects, each with an object type and instance: Analog Input (sensor), Analog Output, Analog Value, Binary Input/Output/Value, Multi-state, Schedule, Trend Log and so on.
- Each object has properties: Present_Value, Object_Name, Description, Units, Status_Flags, Out_Of_Service and more.
- Services you will meet: Who-Is / I-Am (discovery), ReadProperty / ReadPropertyMultiple, WriteProperty, and SubscribeCOV (change-of-value notifications instead of polling).
- Writable (commandable) outputs use a Priority Array with 16 levels, where 1 is the highest priority and 16 the lowest. Priority 1 and 2 are for life-safety, and level 8 is conventionally the manual operator. Each writer commands at a priority; the highest-priority non-null value wins. Writing a value and then not relinquishing (writing Null) leaves a command stuck at that priority, which is a classic way to leave a plant running manually.
- Out_Of_Service lets a point's Present_Value be overridden for testing. Setting it and forgetting is another classic mistake.
Who-Is broadcasts do not cross routers. A BBMD (BACnet Broadcast Management Device) forwards broadcasts between subnets. A client on a different subnet can register as a foreign device with a BBMD, with a time-to-live, to receive broadcasts and reach everything. If your discovery finds nothing from another VLAN, it is probably this.
Tools to start with
- YABE (Yet Another BACnet Explorer): a free Windows GUI explorer (MIT licence, hosted on SourceForge). It lists devices, browses objects and properties, and reads and writes values. Its page mentions IPv4/IPv6, MS/TP, BBMD and BACnet/SC support.
- bacpypes3: a Python library with a command-line console for scripting Who-Is, reads and writes. PyPI shows version 0.0.110 as I write.
- Home Assistant: a community custom integration (HACS) adds BACnet/IP devices to Home Assistant, and another community project does the reverse by publishing HA entities as BACnet objects. See the project post in this forum.
- Vendor tools and the site's own front end are often the better first stop for finding point lists and documentation.
- Get permission and a point list (or Protocol Implementation Conformance Statement, PICS) from the integrator.
- Choose an unused device instance for any tool you run, and tell the site owner. A duplicate instance can confuse a whole network.
- Read before you write. Prefer COV subscriptions over fast polling, and keep poll rates polite. Some older controllers fall over under heavy load.
- If you must write, use a low priority (16) and relinquish when done. Never use priority 1 to 7 unless you know why.
- Do not touch life-safety, fire or security systems.
- Keep notes of what you changed.
Question for the group: what kind of BACnet equipment are you working with (home, light commercial, plant rooms), and what is the first thing you wish you had known before connecting to a live BMS?