BACnet router joining Ethernet and MS/TP wiring

BACnet IP vs MS/TP: Avoid Canadian BAS RFQ and Security Gaps

/ Uncategorized / By

Use BACnet MS/TP for dense field-device trunks and BACnet/IP for backbone and multi-building integration. Both transports carry identical application-layer objects defined in ANSI/ASHRAE 135; the real difference lies in physical media, speed and network behavior. Most functioning projects use both, connected through BACnet routers at the point where the field layer meets the IP backbone.

TL;DR:

  • Keep MS/TP trunks near 20 to 30 devices, below the 32 device electrical limit, because token rotation slows polling as masters join.
  • BACnet/IP broadcasts stop at subnet boundaries, so document BBMD entries for every subnet; missing or duplicate entries can hide devices or trigger broadcast storms.
  • Standard BACnet/IP lacks encryption and authentication; isolate it on dedicated VLANs, restrict UDP port 47808, and use a VPN for remote access.
  • For areas above 30 terminal devices, specify an MS/TP trunk with a floor router, reserving IP for supervisory links and large data transfers.
Futuregenconsulting
Plan a More Reliable BAS Network
FutureGen provides mechanical and electrical engineering design for Ontario projects, including HVAC systems and complex electrical requirements.

Explore engineering services

Table of Contents

Quick comparison of BACnet/IP and MS/TP

Controls engineers evaluating a building automation network need a fast reference before committing to a topology. The table below lays out the practical differences that drive design decisions on most projects.

Attribute BACnet MS/TP BACnet/IP
Typical transport medium RS-485 twisted pair Ethernet (copper or fiber)
Typical speed 9.6 to 115.2 kbps 100 Mbps to 1 Gbps
Typical topology Daisy-chain / trunk Star / switched
Best-fit layer Field / terminal devices Backbone / supervisory
Common failure modes Termination errors, polarity faults, token timeout Duplicate IPs, blocked UDP ports, BBMD misconfiguration

Three patterns tend to hold across projects of every size:

  • MS/TP remains the pragmatic default where wiring runs to dozens of VAV boxes or terminal units at a lower material cost per device.
  • BACnet/IP is the pragmatic default wherever supervisory controllers, campus links or remote access are required.
  • A hybrid design, MS/TP trunks feeding an IP backbone through routers, is the typical outcome on anything beyond a single mechanical room.

How each transport actually works

BACnet/IP encapsulates BACnet messages inside UDP datagrams and rides on standard Ethernet and IP infrastructure, typically using UDP port 47808 by default. Because it inherits Ethernet’s switched topology, device addressing follows normal IP subnet rules, and broadcast traffic, which BACnet relies on heavily for discovery, stays confined to the local subnet unless specifically forwarded. That confinement is the source of most multi-subnet headaches, which we address later in this article.

MS/TP operates over an RS-485 physical layer using a token-passing scheme: each master device holds a token for a bounded period, performs its polling, then passes the token to the next master in numerical address order. This deterministic rotation is what gives MS/TP its predictable, collision-free behavior on a shared two-wire trunk, but it also means performance degrades as more masters join the rotation. According to BACnet’s governing standard, MS/TP baud rates commonly range from 9.6 to 115.2 kbps, a fraction of Ethernet throughput.

Wiring discipline matters more on MS/TP than on IP. A few points worth specifying in any design document:

  • Use a shielded, twisted pair rated for RS-485, and ground the shield at one end only to avoid ground loops.
  • Terminate both physical ends of the trunk with the resistor value the controller manufacturer specifies, never at every device.
  • Keep every device on the segment set to the same baud rate; mismatched baud settings produce intermittent, hard-to-diagnose comms failures.
  • Assign MAC addresses sequentially and avoid gaps that unnecessarily lengthen token rotation time.

ANSI/ASHRAE 135 guarantees application-layer parity: a BACnet object such as an analog-input or a schedule behaves identically whether it rides MS/TP or IP. The transport choice affects speed, wiring and scale, not what the data represents.

Performance and scaling differences that matter in practice

Raw throughput differences between the two transports are not subtle. MS/TP tops out at 115.2 kbps, while Ethernet backbones typically run at 100 Mbps to 1 Gbps, a gap of several orders of magnitude, as documented in ANSI/ASHRAE 135.

Throughput comparison of MS/TP and Ethernet

One architectural consequence follows directly from that gap: trend data uploads, graphics refreshes and firmware pushes that take seconds on an IP backbone can take minutes on a busy MS/TP trunk, which is why controller firmware updates and large historical trend exports are usually scheduled through the IP side of a network whenever a router is available.

Token rotation time grows with every master added to an MS/TP segment, since each device waits its turn before transmitting. Electrical segment limits documented in BACnet internetworking literature commonly cap a segment at 32 devices without repeaters, and in practice many integrators target closer to 20 to 30 devices per trunk to keep polling responsive, particularly where graphics pages need near-real-time values.

BACnet/IP scaling introduces a different constraint: broadcasts, used for device discovery and certain object updates, do not cross IP subnet boundaries on their own. BACnet Broadcast Management Devices (BBMDs) exist to forward those broadcasts between subnets, and BBMD misconfiguration is one of the most frequent causes of device-visibility problems in larger deployments. A few scaling heuristics worth building into a design:

  • Budget for 20 to 30 devices per MS/TP trunk rather than pushing toward the 32-device electrical limit.
  • Treat every IP subnet boundary as a point requiring an explicit BBMD entry, documented at design time, not discovered during commissioning.
  • Reserve IP-side capacity for trend storage and firmware distribution rather than routing that traffic back through an MS/TP trunk.

When to choose each transport for your project

Project type and device density usually make the choice obvious once laid outside by side. VAV banks, fan-powered box runs and other dense terminal-device floors favor MS/TP because trunk wiring to dozens of small controllers is cheaper than home-running Ethernet to each one. Retrofit projects, where existing RS-485 trunks already serve a floor, often keep MS/TP for the same reason: rewiring an occupied building for Ethernet rarely pencils out.

BACnet/IP fits plant-level controllers, campus-wide integration and any project expecting remote commissioning or analytics access, since IT infrastructure, switches, VLANs and remote VPN access, already provides the path.

A simple sequence helps during design and RFQ development:

  1. Map device density per floor or mechanical room, and flag any area with more than 30 terminal devices as an MS/TP trunk with an on-floor router.
  2. Identify every point where supervisory controllers, plant equipment or multi-building links are required, and plan those segments as BACnet/IP from the outset.
  3. Confirm whether the owner’s IT department will be involved during commissioning; projects with active IT coordination generally handle BACnet/IP backbones more smoothly.
  4. Note any anticipated analytics, remote monitoring or fault-detection platform, since those typically pull data from the IP backbone rather than the field trunks directly.

Pro Tip: Specify router locations on the riser diagram during design, not during commissioning, so cable paths and panel space account for them from day one.

Interoperability and routing between MS/TP and IP

A BACnet router is not the same device as a protocol gateway. A router connects two BACnet LAN types, MS/TP and IP, for example, and forwards BACnet messages transparently, preserving the application-layer semantics that make an analog-input object the same object on either side. A gateway, by contrast, translates between BACnet and a non-BACnet protocol such as Modbus, which introduces mapping and potential data-loss points that a router does not have. For projects also integrating Modbus devices, our BACnet vs Modbus selection guide covers that translation layer in more detail.

Routers bridge different BACnet LAN types and forward messages between them without altering the application layer, which is why hybrid architectures, MS/TP at the edge, IP at the backbone, remain the practical default on most projects.

BBMDs solve a narrower problem: forwarding broadcast traffic across IP subnet boundaries. Two errors show up repeatedly in the field:

  • Duplicate BBMD entries pointing to the same subnet, which causes broadcast storms or duplicate discovery responses.
  • Missing BBMD entries for a newly added subnet, which leaves devices on that subnet invisible to the rest of the system until someone notices.

Device instance numbers must stay unique across the entire internetwork, not just within a single trunk, since Who-Is and I-Am discovery messages rely on that uniqueness to resolve addresses correctly. MS/TP slave-only devices add a further wrinkle: they cannot initiate dynamic binding on their own, so any design calling for dynamic discovery of slave devices needs a vendor-confirmed MS/TP Slave Proxy or equivalent binding support specified up front.

Installation and troubleshooting: the checks that solve most failures

Field experience across both transports points to a short list of checks that resolve the overwhelming majority of reported issues.

On MS/TP trunks, work through these in order:

  • Confirm termination resistors are present at both physical ends of the trunk and nowhere else.
  • Verify the shield is grounded at a single point and check for reversed polarity on the data pair.
  • Compare the Max Master setting against the actual highest device address in use; a mismatch silently wastes token rotation time.
  • Confirm every device on the trunk shares the same baud rate setting.

On BACnet/IP segments, check for:

  • Duplicate IP addresses, still one of the most common causes of intermittent device dropouts.
  • UDP port 47808 blocked by a firewall or VLAN access control list between subnets.
  • BBMD table entries that are missing, duplicated or pointing at a decommissioned subnet.
  • Duplicate device instance numbers introduced when equipment is replaced without updating the controller’s configured instance.

Packet captures with a tool like Wireshark, paired with a BACnet discovery utility, let a technician isolate a problem segment by segment rather than guessing, a process improved by using IoT Edge architectures for low delay principles. Staged isolation, disconnecting one trunk or subnet at a time and re-running discovery, remains the fastest way to localize a fault on a live system, a practice reflected in practitioner comparisons of MS/TP and IP deployments.

Pro Tip: Keep a baseline Wireshark capture from commissioning on file; comparing a fault-state capture against it cuts diagnostic time significantly.

Security considerations and BACnet Secure Connect

Standard BACnet/IP carries no built-in encryption or authentication, which means traffic on an unprotected network segment is readable and spoofable by anyone with access to that segment, a gap confirmed in BACnet security analysis. Practical mitigations we specify routinely include:

  • Isolating BAS traffic on dedicated VLANs separate from general office or tenant networks.
  • Restricting UDP 47808 traffic at the firewall to only the subnets and devices that need it.
  • Routing remote access through a VPN rather than exposing controllers directly.
  • Applying deep packet inspection rules where the network already supports them, to flag anomalous BACnet traffic.

BACnet Secure Connect (BACnet/SC) addresses the gap at the protocol level rather than relying solely on network perimeter controls. BACnet/SC adds TLS 1.3 encryption and X.509 certificate-based authentication and can coexist with existing BACnet/IP and MS/TP segments through standard routing, so a phased migration does not require ripping out working infrastructure.

Projects adopting BACnet/SC should plan for certificate issuance and renewal as an ongoing operational task, coordinate with the building’s IT department on network zoning early, and document which conduits carry secure versus legacy traffic as part of the commissioning package.

Practical design checklist for specifying BACnet transport

A design document or RFQ that leaves transport details vague invites inconsistent bids and rework during commissioning. The following items belong in any BAS specification:

  1. State the transport required at each network layer explicitly: MS/TP for field trunks, BACnet/IP for backbone and supervisory segments.
  2. List the required BIBBs (BACnet Interoperability Building Blocks) for each device class so vendors bid comparable functionality.
  3. Specify Max Master and supported baud rates for every MS/TP trunk, along with termination and shielding standards.
  4. Require a written vendor statement confirming BACnet router features, BBMD support count, and whether a web-based diagnostic export is available.
  5. Where enterprise security is a project requirement, require a statement of BACnet/SC readiness and certificate-management approach.
  6. Include commissioning deliverables: a device discovery test report, a baseline packet capture, a firmware-update plan, and a documented handover checklist for the owner’s IT department.

A commissioning checklist covering phases, testing and sign-off can supplement these items with the broader mechanical commissioning sequence. All design documentation should reference the applicable Canadian electrical and building codes governing low-voltage control wiring and equipment rooms, since inspectors will expect that cross-reference in the permit set.

Pro Tip: Attach the BBMD table and router map as an appendix to the commissioning report; it saves hours on the next service call.

A practitioner’s perspective on the MS/TP to IP shift

The shift from air-gapped MS/TP trunks to IP-connected backbones has changed more than wiring diagrams. It has changed who needs to be in the room during design. A decade ago, a controls contractor could commission an MS/TP system with little input from a building’s IT department. That is no longer true once BACnet/IP, VLANs and BBMDs enter the picture, and projects that treat IT coordination as an afterthought tend to lose time during commissioning rather than during design. In our engineering practice, we have found that the projects that go smoothly are the ones where IP addressing, firewall rules and BBMD topology get documented before equipment ships, not after it fails to show up on a graphics page.

— Sanjay

Work with an MEP engineering team on your BAS network design

Getting the transport split right on paper is one thing; getting it permitted, coordinated with power distribution, and commissioned correctly is another. We provide HVAC System Design Services that include the control network architecture decisions covered in this article, alongside the mechanical systems those controls operate.

Futuregenconsulting

Our engineering team helps with:

  • IP addressing strategy and BBMD topology planning before equipment is ordered.
  • RFQ wording that specifies BIBBs, Max Master settings and router requirements so vendor bids are comparable.
  • Coordination between controls, power distribution and construction review so network cabling and panel space are accounted for in the drawing set.

Reach out through our HVAC System Design Services page to discuss a project that needs a BACnet network designed, specified or reviewed for Canadian code compliance.

FAQ

How can I convert BACnet IP to BACnet MSTP?

There is no direct protocol conversion between the two; instead, a BACnet router physically bridges an MS/TP trunk to an IP backbone, forwarding BACnet messages between the two transports without altering the application-layer objects. Most building automation controllers that support both transports include router functionality as a built-in feature rather than requiring separate hardware.

Is BACnet Ethernet the same as BACnet IP?

No, they are related but distinct data link options within the BACnet standard. BACnet/IP encapsulates BACnet messages in UDP/IP packets and runs over standard Ethernet infrastructure, while the older BACnet Ethernet option uses Ethernet frames directly without the IP and UDP layers, which limits it to a single local network segment.

Does BACnet use MSTP?

Yes, MS/TP (Master-Slave/Token Passing) is one of the data link layer options defined within ANSI/ASHRAE 135, designed specifically for low-cost RS-485 wiring to field devices. It carries the same BACnet application objects as BACnet/IP, just over slower, daisy-chained wiring.

What are the downsides of using BACnet?

BACnet/IP traffic has no built-in encryption or authentication by default, which requires network-level protections such as VLANs, firewalls and VPNs, or adoption of BACnet/SC for native security. MS/TP trunks are limited in speed and device count per segment, so projects with dense device counts or heavy trend and analytics needs typically require a BACnet/IP backbone alongside any MS/TP field trunks. Before committing to an architecture, it is worth confirming device BIBB support, router capability and BBMD requirements with each vendor.

Sources