BACnet

 

BACnet is a protocol designed specifically for building automation management systems. It is an open protocol, meaning that anyone can use it without requiring any kind of licence. However it can`t be regarded in the same light as open source, as the specification can only be purchased from ASHRAE - and it cannot be redistributed.

ASHRAE - American Society of Heating, Refrigerating and Air-Conditioning Engineers - were and are the developers of BACnet, and are responsible for updating it as required.

The specification for BACnet is around 600 pages in length, so I guess it is a fairly meaty publication.

The sort of building automation systems that BACnet was targeted at include

However it was designed in such a way that it can be used for other related systems as well. It is now an ISO standard, and I think a European standard as well. There are now many manufacturers making products that are BACnet compatible - both hardware and software. There are also various bits of open source software as well.

These products include hardware and software that can be used to convert other building related protocols to BACnet, so BACnet can be used as a "master" protocol, with the ability to send and receive data to systems using other protocols.

BACnet is basically a client/server protocol, and is designed around three building blocks -

 

Objects

BACnet uses objects as the way of organising all the data. Each device is represented by an object, and each piece of data is represented by an object.

Each type of object has a number of properties associated with it, that provide additional information about the device or the data.

Think objects and their attributes as in eDirectory or Active Directory !

BACnet originally defined 18 different object types, however more have been added - the highest number I have seen reference to so far is 30. Some of them are perhaps a bit obscure, however some of the more common ones include

Each device must be represented by an object. It depends on what the device does as to which other objects are associated with it.

So for example, if a controller had 10 thermometers and 10 thermostats associated with it, there would be 21 BACnet objects associated with the controller - 1 of device object, 10 of analogue output objects, and 10 of binary output objects.

If the thermostats are remotely configurable, then there may well be an additional 10 of analogue input objects as well.

The BACnet specification defines 128 different properties - different types of object will have different combinations of these properties. However there are three properties that every object must have associated with it -

Each object type will have a number of other properties which either MUST be attached to the object, or MAY be attached to the object.

So for example, a Device object has 32 properties defined for it, and the Analogue Input object has 25 properties defined for it.

Some properties are set during the installation of the device, some properties can be set dynamically during system operation, and some properties are preset by the manufacturer.

All properties can be read by the system.

The BACnet specification allows for manufacturers to add other types or property types - however that will of course lead to a non-standard system, and it will require the use of software that understands the new object or property type. So purchasers would be heading back into the old single-source trap, the avoidance of which was the original reason for developing BACnet.

 

Data types

The use of Objects and Properties in BACnet somewhat hides the actual data that is being generated and transferred. BACnet specifies 13 different primitive types of data -

The BACnet specification allows for a sequence of mixed data types to be built up into a Constructed Data Type.

It also allows for the creation of arrays of the same data type.

In January 2010, ASHRAE approved the use of XML as a mechanism for transferring data between applications - this is going to open up new ways of viewing and processing BACnet data.

 

Services

BACNET services are the means by which BACnet does things. Activities like transferring data, issuing commands, announcing events, are all done via the services that a server offers to the clients.

Services in BACnet are organised around messages - the specification of BACnet contains a suite of messages - typically they contain a request, and the request may require a response. The messages have defined parameters, made up from the defined BACnet data types.

The BACnet services are defined within five classes, which are

BACnet specifies 38 different services, so each class contains some of these services. There are too many to list here, but as an example, contained within the object access class are the following services -

A device doesn`t neccessarily have to understand all of these, and some of them are rarely used, however they are in the BACnet specification.

The Read Property service is a service that every device MUST understand and be able to respond to.

The Read Property service message will contain a message number the identification of the required property - ie, both the object type and the id -

The response from the client will contain all the above information, as well as the required value.

Other commonly used services include -

Since there can be quite a variety in the amount of Objects and Services that any particular device can support, each device should be supplied with a PICS - Protocol Implementation Conformance Statement. This is useful for designing systems, and choosing the appropriate devices.

Once a system is up and running, since every device must support the Read Property service, all the Objects supported by a device can be seen via the system.

 

Networks

BACnet was originally specified to work over 5 different types of connection - 1 serial, and 4 networks. They were

In subsequent years, ASHRAE added two forms of IP based networking -

Working down this list, PTP is fairly old hat nowadays - as far as remote users are concerned, it is more likely that a remote user will use a VPN to connect to the corporate network, and so get access to the BACnet system that way.

There is a lot of installed LonTalk systems out there in the outside world, so the abilty to interconnect BACnet and LonTalk is a useful facility.

 

BACnet over MS/TP

This actually leads to some quite interesting bits of technology. The specification for BACnet over MS/TP only defines a data-link layer for use over RS485 - it doesn`t specify in any way how the RS485 physical network should be installed. This means that there is quite a lot of dis-agreement around about how RS485 should be set up for use by BACnet.

In essence, RS485 was originally specified to use a two-core screened cable, with true differential signals on the two cores. However its use has expanded into different forms, and there are forums on the internet which show the diversity of opinion about how it should be used.

So the situation for BACnet is a little different from the use of RS485 for Profibus - another building management related protocol which specifies exactly how the RS485 physical network is to be installed -

So that is all quite tightly specified. Would the same type of installation work for BACnet over RS485 ?

 

BACnet over ARCnet

ARCnet is quite an old form of networking, it was developed by Datapoint Corporation a few years before Xerox,Intel, and Digital developed Ethernet.

ARCnet corresponds to the bottom two layers of the OSI 7 layer stack, ie, the data link layer and the physical layer.

Arcnet is a token bus based network system, and at the time, it was more technically competent than Ethernet. It allowed for the wiring to be arranged in a star formation, whilst Ethernet was trying to use a long piece of coax which wound its way around the building.

However Ethernet matured faster than ARCnet, and has now driven ARCnet into obscurity as far as building corporate networks. It has found some niche markets, and has been renamed as ARCNET. It has a data rate of 2.5Mbps. There have been not very successful attempts to use faster rates - technically okay, but commercially a failure.

ARCnet was specified for working over 3 times of network physical layer - coax, fibre, and .... RS485.

And now the vagaries of RS485 get worse - because ARCnet specified IBM type 3 cable - which is unscreened twisted pair with a characteristic impedance of 100 ohms. The ARCnet specification allows for an impedance range of 100 - 150 ohms. 120 ohms is the "ideal" impedance.

The specification calls for a single biassing resistor network, which can be anywhere on the cable.

The specification also calls for a signal common path - ie, it is looking for a 3 wire cable.

The specification does allow screened cable to be used.

IBM type 3 cable is very similar to Cat 3 UTP cable specified for Ethernet 10Base-T networks.

No wonder there is such a diversity of opinion about how RS485 should be cabled !

 

BACnet over Ethernet

BACnet is also specified to work over an Ethernet network layer.

Now let`s be clear about something - despite the best efforts of several websites to completely confuse the issue, BACnet over Ethernet is not the same as BACnet over IP. BACnet over Ethernet is a layer 2 mechanism, and it uses the 48 bit MAC addresses as the way to address the devices.

BACnet over IP is a layer 3 mechanism, and uses the 32 bit IP addresses as the way to address the devices.

In addition, the protocol stack used in BACnet over Ethernet is quite different from the protocol stack used in BACnet over IP.

However just to confuse the issue, BACnet over Ethernet and BACnet over IP can co-exist on the same physical network at the same time.

Unlike IBM token ring and ARCnet token bus network systems, Ethernet uses CSMA/CD - Collision Sense Multiple Access / Collision Detection. Every node on the network has an equal right to transmit on the network. If a node wants to transmit, it listens for any activity - if some other node is transmitting, then the node sits and waits until the network is quiet. Once the network is quiet, the node starts to transmit. As it transmits, it also listens. If all it hears is the same data that it transmitted, then it just carries on. However if it hears something different to what it is transmitting, then it means that some other node is also transmitting - so there is a conflict, and both transmissions will be corrupted, so both nodes stop transmitting. They wait some random interval of time, then restart if the network is quiet.

Ethernet has the advantage over token based networks in that each node doesn`t have to wait for a token, before it can start to transmit. The downside is that as network traffic builds up, there are more and more collisions, contention becomes an issue, and the network can slow down considerably - even halt all together in extreme cases - a characteristic that is deliberately used in some malicious attacks.

To overcome this contention issue, Ethernet networking technology has evolved with techniques like switches instead of hubs to physically divide up the network, quality of service tagging, and VLAN`s to logically divide up the network.

 

BACnet over IP

The BACnet specification defines two ways of carrying BACnet data over IP -

The net result is the same, both methods result in BACnet being carried over IP, but IP tunneling allows legacy non-IP aware devices to communicate over IP networks. The black boxes are often known as Annex H routers, as it is Annex H of the BACnet specification that describes them.

However that isn`t the end of the story - more on this below.

Some Annex H routers have one port, and some have two ports. The two port boxes are easy to understand - one port connects to the layer 2 Ethernet network system, and the other port connects to a separate IP network. This means that there are two physical networks in existence.

The one port boxes are a bit more curious in concept - there is only one physical network - a BACnet legacy Ethernet device talks to the router box via layer 2 Ethernet. The router converts the Ethernet frame to an IP packet, and sends it out back onto the same physical network. So the data actually flows across the network twice. There must be a time delay with this mechanism, because only one device can transmit onto a CSMA/CD network at one time. So the router must do a store and forward on the whole layer 2 frame.

BACnet over IP uses UDP/IP - I am afraid I don`t understand why ASHRAE decided to use UDP as opposed to TCP/IP - UDP is an open loop protocol - the device fires of a packet, and with any luck it gets to where it is supposed to be going.

Or maybe it doesn`t. UDP doesn`t care. However TCP does care, and it makes sure all the packets get to where they are going, and get there in the correct order.

Modbus over IP and DNP3 over IP both use TCP, not UDP.

Profinet is defined so that devices must be capable of using UDP, the use of TCP is optional. So there does seem to be some difference of opinion about TCP v UDP within the SCADA protocols.

IANA has reserved port 47808 on both TCP and UDP for use with BACnet/IP.

 

More on IP tunneling

Some time after ASHRAE produced Annex H, they produced Annex J. Annex H described the method of tunneling BACnet over Ethernet on IP networks. Annex J described the method of carrying BACnet directly over IP, with the intermediate BVLL layer, it is known as BACnet/IP.

As described above, Annex H routers are used to encapsulate the data produced by BACnet over layer 2 Ethernet, and to package it in UDP/IP packets instead. An Annex H router takes the Ethernet frame, extracts the LSDU - Link Layer Service Data Unit - wraps it up in a UDP/IP packet, and the IP protocol stack wraps the UDP/IP packet in another Ethernet frame.

So the final Ethernet frame contains a UDP/IP packet - which contains the LSDU - which contains the BACnet data.

On the other hand, in BACnet/IP, the BACnet data is modified by the BVLL layer, then wrapped up into a UDP/IP packet, which is wrapped up into an Ethernet frame. So the final Ethernet frame contains a UDP/IP packet - which contains the modified BACnet data.

In other words, both methods produce valid UDP/IP packets carried in the Ethernet frames, but the contents of the UDP/IP packets are different, and so the two are not compatible - they can`t communicate with each other.

There is another problem with Annex H routers - each Annex H router has to know the IP address of every other Annex H router, or else it doesn`t know where to forward the packets to. So each Annex H router has to contain a list of IP addresses of all the other Annex H routers. When an Annex H router is added to, or removed from, the overall IP network, each Annex H router has to have its list of IP addresses updated. So that is quite a time consuming task.

I believe there is another problem, in that Annex H routers have a limit on the number of IP addresses the router can have in its list - 31 is one figure that I have seen - which would result in a maximum of 32 Annex H routers across the whole IP network. An enterprise sized IP network can easily have well over a hundred sub-nets, so this could be quite a limitation.

There is a way of creating a BACnet virtual super net equivalent by combining multiple virtual BACnet networks, however it is getting somewhat messy.

In more formal terms, an Annex H router is properly known as "BACnet/Internet Protocol Packet-Assembler-Disassembler", or PADs for short.

 

Broadcast messages over IP

One of the problems that the designers of BACnet met was the transmission of broadcast messages - it was sometimes the case that the BACnet system covered several IP sub-networks, so the transmission of broadcast messages across the whole BACnet system was prevented.

Annex J therefore introduced the idea of BBMD`s - BACnet/IP Broadcast Management Device- this is another type of black box - there is one on each subnet, and they talk to each other and maintain a table of other BBMD`s.

When a device wants to send a broadcast message across the whole system, the device sends the message to the BBMD on that subnet, the BBMD forwards it to the other BBMD`s around the IP network, and each one then retransmits the broadcast message on their respective subnet.

There is also some few references on some websites to using multicasting as an alternative, but the general opinion seems to be against its use.

BBMD`s have a second use, in that they allow non-BACnet devices to register with a BBMD, and then they will receive the BACnet broadcast messages, which they otherwise would not be able to receive.

 

BACnet protocol stacks

BACnet itself corresponds to the upper layers of the OSI 7 layer model. Each of the network mechanisms shown above have their own protocol stacks corresponding to the lower layers of the OSI 7 layer model.

BACnet over PTP and BACnet over MS/TP are fairly straightforward - 


           BACnet application layer

             BACnet network layer

            MS/TP    |    PTP            
                     |
            RS485    |   RS232

BACnet over LonTalk is even simpler - 


           BACnet application layer

             BACnet network layer

                 LonTalk

BACnet over ARCnet uses one of the IEEE 802 data link layers - 


           BACnet application layer

             BACnet network layer

                 IEEE 802.2            

                   ARCnet

            coax    fibre    RS485

BACnet over Ethernet uses the two IEEE data link layers - IEEE 802.2, which is the Logical Link Control layer, and IEEE 802.3, which is the Media Access Control layer - 


           BACnet application layer

             BACnet network layer

                IEEE 802.2             

                IEEE 802.3

             UTP  fibre  etc

Finally, BACnet over IP introduces an intermediate BACnet-specific data link layer in-between the BACnet network layer and the UDP layer, known as BVLL. And as far as I know, although historically it didn`t, the IP stack now uses the same data link layers that are shown above for Ethernet. 


           BACnet application layer

             BACnet network layer

                    BVLL

                    UDP

                    IP

                IEEE 802.2             

                IEEE 802.3

             UTP  fibre  etc

So there you go - that was a very short summary of BACnet !

 

 

 

 

 

website design by ron-t

 

website hosting by freevirtualservers.com

 

© 2024   Ron Turner

 

+                                   +  

 

Link to the W3C website.   Link to the W3C website.