BACnet Networks: 4 Costly Design Mistakes to Avoid

BACnet exists in several flavors at the network layer. The choice you make at design time affects everything that comes after. So let’s go through the options.

BACnet MS/TP

Master-Slave/Token-Passing over RS-485 twisted pair. The traditional field-controller protocol. Cheap to run — just two wires plus a shield. It’s been reliable and the standard physical medium for VAV controllers, terminal unit controllers, and other field devices for 25 years.

Limitations: maximum 64 nodes per segment without a repeater. Maximum 4,000 feet per segment. Bandwidth is constrained — typically 38.4 kbps, occasionally 76.8 kbps. For terminal unit control with infrequent point updates, this is plenty. However, for graphics-heavy supervisory communication, it isn’t.

BACnet/IP

BACnet packets carried over standard Ethernet IP networks. The standard for supervisory communication and increasingly for higher-end field controllers.

Vastly higher bandwidth. Integrates cleanly with corporate IT infrastructure. Supports network-based device discovery using BBMDs (BACnet Broadcast Management Devices) when crossing IP subnets.

The downside historically has been cybersecurity. BACnet/IP has no native encryption or authentication. As a result, “flat” BACnet/IP networks with everything on one subnet are unfortunately common.

BACnet over Ethernet (ISO 8802-3)

Less common today. BACnet packets directly on Ethernet without IP. Sometimes used in mission-critical applications that want minimum protocol overhead. However, it’s largely superseded by BACnet/IP.

BACnet/SC (Secure Connect)

The forward-looking option. WebSocket-and-TLS-based transport replacing the data link layer for cybersecurity-sensitive applications. We cover it in detail in our BACnet/SC post. The smart specification for new installations: spec controllers that support BACnet/SC even if you don’t activate it on day one.

Common architectural mistakes

Flat networks

Every BACnet device — JACEs, field controllers, supervisors, web interfaces — on a single broadcast domain with no segmentation. Performance degrades as the network grows. Broadcast storms become possible. From a cybersecurity standpoint, a single compromise reaches everything.

Oversized MS/TP trunks

“It said up to 128 nodes with repeaters, so we put 96 nodes on one trunk.” The trunk crawls. Polls take seconds. Operators complain that the BAS “feels slow.” Rule of thumb: 30–50 nodes per MS/TP trunk is the practical sweet spot.

BBMDs everywhere or BBMDs nowhere

BACnet Broadcast Management Devices forward broadcast traffic across IP subnets. They’re necessary in segmented networks. Misconfigured BBMDs create routing loops or fail to propagate broadcasts at all. Get this design right early; it’s painful to fix later.

No IT involvement until commissioning

The controls integrator builds the network the way it was 15 years ago. The IT team finds out at startup that they’ve been bypassed. As a result, the project enters a multi-week renegotiation of network architecture. So bring IT into the design conversation at schematic design, not at startup.

The right shape for a modern BAS network

Layered architecture. Field controllers on dedicated MS/TP trunks talking to JACEs. JACEs on a dedicated BAS VLAN talking to a Niagara Supervisor. Supervisor on a separate VLAN with explicitly controlled access to the corporate network through a firewall. BACnet/SC enabled wherever the controller stack supports it.

Plus: documented network topology, documented IP plan, documented firewall rules, and a documented vendor remote-access procedure with MFA. This is the architecture facility teams should be specifying in 2026. It’s what passes both Title 24 acceptance testing and the cybersecurity due diligence that increasingly precedes major capital projects.

Talk to Signet Controls. Planning a BAS install, retrofit, integration, or service contract in California? We work across Los Angeles, Orange County, the Inland Empire, the Central Coast, and Kern County. Reach our team at info@signetcontrols.com or call (877) 874-4638.