Interactive Learning Tool for Building Automation and Control Networks over IP
BACnet/IP Protocol Overview
BACnet (Building Automation and Control Networks) is a communication protocol designed specifically for building automation and control systems. BACnet/IP extends this protocol to operate over IP networks using UDP transport.
Application Layer (APDU)
BACnet services, objects, and properties
Network Layer (NPDU)
Routing and addressing information
BACnet Virtual Link Layer (BVLL)
BACnet Virtual Link Control (BVLC) header
Transport Layer (UDP)
Port 47808 (0xBAC0)
Internet Protocol (IP)
IPv4/IPv6 addressing and routing
Ethernet
Physical network interface
Key Features
Interoperability: Vendor-independent communication
Object-Oriented: Standardized data representation
Scalable: Support for large networks
Reliable: UDP-based with error handling
Secure: IP-based security mechanisms
Protocol Standards
ANSI/ASHRAE 135-2024: Latest BACnet standard
ISO 16484-5: International standard
Port 47808: Default UDP port (0xBAC0)
IPv4/IPv6: Both supported
Broadcast/Unicast: Communication modes
BACnet/IP Header Structure
BACnet Virtual Link Control (BVLC) Header
The BVLC header is the first part of every BACnet/IP packet and contains control information for the virtual link layer.
BVLC Header Format (4 bytes)
Total length of BVLC message in bytes
81
0A
00
16
BVLC Header (4 bytes)
NPDU Structure
Network Protocol Control Information (NPCI):
Version (1 byte): 0x01
Control (1 byte): Message control flags
DNET (2 bytes): Destination network
DLEN (1 byte): Destination address length
DADR (0-255 bytes): Destination address
SNET (2 bytes): Source network
SLEN (1 byte): Source address length
SADR (0-255 bytes): Source address
Hop Count (1 byte): TTL for routing
APDU Structure
Application Protocol Data Unit:
PDU Type (4 bits): Service type
Segmented (1 bit): Message segmentation
More Follows (1 bit): Additional segments
Segmented Response (1 bit): Response type
Reserved (1 bit): Future use
Max Segments (3 bits): Maximum segments
Max APDU (4 bits): Maximum APDU size
Invoke ID (1 byte): Transaction ID
Service Choice (1 byte): BACnet service
Service Request: Actual data
Interactive Header Builder
Build your own BACnet/IP packet header and see the hex representation.
Configure BVLC Header
Configure NPDU
Configure APDU (Read Property Request)
Generated Packet
Packet Analysis
BACnet/IP Communication Process
Client Device
→
BACnet Network
→
Server Device
Device Discovery
Who-Is Service: Broadcast request to discover devices
Device Response
I-Am Service: Device announces its presence
Read Property
Read-Property Service: Request object property value
Write Property
Write-Property Service: Set object property value
Communication Flow Example: HVAC Temperature Control
Discovery: Building Management System broadcasts Who-Is request
Response: HVAC controllers respond with I-Am messages
Monitoring: BMS reads temperature values using Read-Property
Control: BMS adjusts setpoints using Write-Property
Alarms: Controllers send COV notifications for out-of-range values
BACnet Services
Alarm and Event Services: Notifications and acknowledgments