BACnet/IP vs MS/TP

A typical commercial BMS runs two BACnet networks: BACnet/IP between supervisory controllers and central plant, and BACnet MS/TP (master-slave/token-passing) on an RS-485 twisted pair to the terminal unit controllers on each floor. A point read from a fan coil unit crosses both, and each has its own limits on message size, speed and addressing.

Side by side

The device instance, object identifiers and properties do not change with the network. The discovery guide explains the difference between a device instance and a network address.

The APDU limit does matter when a client on BACnet/IP reads through a router. Each device states its limit in Max_APDU_Length_Accepted, and it announces it in its I-Am. A client that builds a request or expects a reply larger than that limit needs segmentation, and many small MS/TP controllers do not support it. The request is then aborted or rejected. A ReadPropertyMultiple reply carries about 16 octets per Present_Value, so about 29 values fit in one 480-octet reply. Some small controllers accept only 50 or 128 octets, which allows far fewer. Size ReadPropertyMultiple requests to the smallest limit on the path.

How MS/TP works

At power-up each master waits for a time slot based on its MAC address, from 0 to 127, and then looks for the next master. When a master receives the token, it can send up to Max_Info_Frames frames. It then passes the token to the next master. Every 50 token passes (Npoll), a master sends Poll For Master frames to the addresses between itself and the next master it knows, to find devices that have joined.

A master that sends a Poll For Master to an empty address waits for a reply for Tusage_timeout: at least 20 ms by the standard, and 75 ms on the Johnson Controls router's lenient setting. Each empty address that a master probes adds that silence to the bus.

Slave devices, with MAC addresses up to 254, never hold the token. They answer only when a master asks them. They cannot answer a Who-Is broadcast on their own, so a slave proxy (added in Addendum 135-2001a) answers with an I-Am for them.

Two settings on every master affect the whole bus:

• Max_Master is the highest master address that the device will poll. A device that cannot change it uses 127. Set it on every master to the highest master MAC address in use. With 20 masters at addresses 1 to 20 and Max_Master left at 127, the master at address 20 probes 108 empty addresses: 21 to 127, and 0.
• Max_Info_Frames is the number of frames a master may send each time it holds the token. A device that cannot change it uses 1, which suits a room controller. A router forwards traffic for every client on the IP side, so it needs more. Router defaults of 100 are common, and the Johnson Controls router guide recommends a value above 20.

Speed

Standard 135 requires every MS/TP device to support 9,600 and 38,400 bit/s. Addendum 135-2008ab made 38,400 bit/s mandatory and added 57,600 and 115,200 bit/s. 19,200, 57,600, 76,800 and 115,200 bit/s are optional, so check that every device supports the rate before you choose one. All devices on one bus must use the same rate. The RS-485 cable length limit is 1,200 m at the standard rates and 1,000 m at 115,200 bit/s. These figures assume good-quality twisted pair. High-capacitance cable and long stubs shorten them.

Bus capacity: a worked example

MS/TP sends each octet as 10 bits: 1 start bit, 8 data bits and 1 stop bit, with no parity. A frame has an 8-octet header, then the data and a 2-octet CRC. At 38,400 bit/s one octet takes 0.26 ms, so a token frame takes 2.1 ms.

Take a client on BACnet/IP that reads one analogue Present_Value from an MS/TP controller through a router:

200 points read one at a time therefore cost about 17 s of bus time at 9,600 bit/s, 5 s at 38,400 bit/s and 3 s at 76,800 bit/s. Once a minute, at 38,400 bit/s, that is about 9% of the bus. Every 5 s at 9,600 bit/s it is impossible: the reads need more time than the interval. Above 38,400 bit/s the controller's response time is a large share of each read, so a faster baud rate gives less than it seems.

ReadPropertyMultiple cuts the overhead. One request for 10 Present_Values on one controller is about 115 octets, and the reply is about 185 octets. That is about 85 ms at 38,400 bit/s, against 256 ms for 10 single reads.

The token adds waiting time. The router can send only while it holds the token, and it sends at most Max_Info_Frames requests each time. If each master takes about 3 ms to start sending, an idle ring of 20 masters rotates in about 100 ms at 38,400 bit/s. Each frame that another master sends makes the rotation longer. A controller that postpones its reply until it next holds the token adds a full rotation to every read.

Set the client's APDU timeout above the worst case: the token rotation, plus the queue at the router, plus the reply. A timeout shorter than this causes retries. The retries load the bus further, and the client then shows devices as offline when they are only slow.

Common MS/TP faults

The RS-485 wiring guide covers termination and bias in detail.

Wiring

MS/TP uses the same RS-485 rules as Modbus RTU: a daisy-chained trunk, short stubs, termination at the two physical ends, bias at one point and a signal reference. Addendum 135-2008y (2010) added wiring diagrams and rules for isolation, grounding and the reference conductor. A bus that runs between buildings needs 1,500 V isolation.

MS/TP and Modbus RTU cannot share one bus. Their frames are different, and a Modbus master would disrupt the token.

Routing MS/TP to BACnet/IP

A BACnet router joins an MS/TP bus to a BACnet/IP network. The router is often built into the BMS supervisory controller. Every BACnet network on a site, IP or MS/TP, needs a network number from 1 to 65,534 that no other network on the site uses. Two networks with the same number send messages to the wrong bus, and devices seem to change identity.

An IP client reaches an MS/TP device through the router, by the MS/TP network number and the device's MAC address. A client that discovers devices by instance number does not need to know these values: the router forwards the Who-Is to the bus and returns the I-Am replies with the source network and address. To list the networks behind a router, send Who-Is-Router-To-Network. The router replies with I-Am-Router-To-Network and the network numbers it serves. The routing and BBMD guide explains how broadcasts cross IP subnets.

Choosing in a retrofit

BACnet with Edge

Edge, on the ZGW-20 Gateway, is a BACnet/IP client. It reads MS/TP controllers through a BACnet router on the site. It does not connect to the MS/TP bus directly. It polls Present_Value on a minute-aligned interval, such as 60 or 300 s, or once a minute in live-stream mode. It does not use COV subscriptions. To size the bus, count each point as one read per interval in the worked example above. The BACnet vs Modbus guide describes what Edge reads and writes, and the COV and polling guide compares the two methods.

This guide is part of the BACnet and building protocols series.