BACnet vs Modbus: 7 differences that matter for your BMS

When the ASHRAE SSPC 135 committee started in 1987, the brief was explicit: write a protocol that lets a Honeywell controller, a Johnson Controls air handler and a Siemens supervisor talk to each other without a custom driver per pair. Modbus was already on the table — Modicon had shipped it eight years earlier — and the committee looked at it and walked away. The reason was the data model.

A building is not a production line. You do not poll an air handler at 10 ms; you ask it to tell you when the supply air temperature drifts by more than 0.5 degF and otherwise leave it alone. You do not address a VAV box as "Unit ID 47, register 30002"; you address it as VAV-3-12.AI4.Present_Value with a human-readable Object_Name, an Engineering_Units of degrees-Fahrenheit, and an Out_Of_Service flag the technician can toggle from the supervisor.

BACnet bakes all of this into the spec. Every point is an object with a typed Object_Identifier (AI, AO, AV, BI, BO, BV, MSI, MSO, MSV) and a fixed set of properties — Present_Value, Object_Name, Description, Units, Status_Flags, Reliability, Out_Of_Service. Schedule and Calendar objects let you write occupied/unoccupied logic at the device, not the head end. Trend Log objects buffer historical data on the controller so the supervisor can pull it when the WAN is up. Notification Class objects route alarms to the right recipient list.

Modbus has none of this. A Modbus energy meter dumps kWh at register 4002 as a 32-bit IEEE-754 float across two holding registers, and the integrator writes a line in the supervisor's point list that says "register 4002, scale 1, units kWh, name MainMeter-kWh". Multiply by 400 points on a midsized building and the engineering hours add up fast. This is why BACnet wins at the supervisory layer and Modbus survives at the field layer — registers are fine when the device is a meter that ships with a one-page map.

On a 1,500-point BMS, the difference between Change-of-Value (COV) and polling is the difference between a quiet network and a saturated one.

A BACnet supervisor opens a SubscribeCOV request once per point, with a lifetime (typically 3600 seconds) and a COV_Increment (for analogs) or a state-change trigger (for binaries and multistates). The controller then pushes an UnconfirmedCOVNotification only when Present_Value changes by more than the increment. A VAV box reporting a 72.4 degF zone temperature might emit one packet every five minutes when the space is stable, and ten packets in a minute during an occupancy ramp. Network load tracks reality.

Modbus has no equivalent. The supervisor must poll. A typical Modbus RTU trunk at 19,200 baud with 30 slaves and 50 holding registers per slave runs a full scan in 8 to 15 seconds — fine for energy data, awful for control feedback. Modbus TCP removes the serial bottleneck but keeps the request/response burden: a head end polling 200 TCP devices at one-second cadence with FC03 reads of 100 registers each is doing 20,000 transactions per second, and every one of them traverses the building IP network.

The practical impact in a Honeywell Niagara or Siemens Desigo CC head end is twofold. First, CPU load on the supervisor: every COV subscription is a passive listen, every Modbus poll is an active call with a timeout and a retry. Second, alarm latency: a BACnet COV alarm on a freezestat surfaces in under a second; a Modbus polled alarm surfaces on the next scan cycle, which on a busy trunk can be 30 seconds or more. For life-safety interlocks, that gap matters.

The lesson is not "Modbus is slow." It is "Modbus was designed for a different rhythm."

Until 2020, BACnet was as exposed as Modbus: UDP 47808 broadcast, no authentication, anyone on the VLAN could WriteProperty to anything. The industry got away with it by air-gapping building networks — until building networks stopped being air-gapped, IT took over IP allocation, and the first ransomware crew encrypted a hospital's BMS.

BACnet Secure Connect (BACnet/SC), published as Addendum 135-2020 ck, is the response. It replaces UDP broadcast and BBMD routing with a hub-and-spoke WebSocket topology over TLS 1.3, mutual X.509 authentication on every node, and certificate-based device identity. No more broadcast storms across routed subnets, no more BBMD configuration nightmares for multi-building campuses, and — critically — a transport an IT department will actually approve on a corporate VLAN. Optigo Networks, Cimetrics and Chipkin have been pushing BACnet/SC adoption hard since 2022; Tridium added native BACnet/SC support to Niagara 4.13, and Siemens, Honeywell and Distech now ship BACnet/SC-capable controllers as a checkbox option.

Modbus, by contrast, has no native security and effectively never will. The Modbus Organization published a Modbus/TCP Security spec in 2018 (TLS-wrapped Modbus over port 802) and almost no vendor implemented it outside of niche industrial use. In a building, the only realistic mitigation is network segmentation: put every Modbus device in a dedicated OT VLAN, route to it only from the supervisor, never expose port 502 to a corporate network, and audit the firewall rules quarterly. Treat plaintext Modbus the way you treat plaintext SNMP v1: as a liability you compensate for at the network layer.

If your project is under ASHRAE Guideline 36, Title 24 reporting or any EU EPBD-driven retrofit with cyber strings attached, BACnet/SC is the specification an auditor will accept without a 20-page mitigation memo.

In every commercial building we have commissioned since 2015, the head end speaks BACnet and the field speaks a mix. The BACnet/Modbus gateway is the device that makes the architecture honest.

The vendors that matter: Chipkin Automation (CAS gateway family, custom drivers on request), Loytec (L-INX and L-GATE), AGILiCOM (BMG-400, popular on French and Middle East projects), Contemporary Controls (BASgatewayLX), FieldServer (now MSA Safety), and ProtoNode / ProtoCessor for OEM embedding. Pricing in 2026 runs roughly USD 600 to 2,400 per gateway depending on the point count and the protocol matrix.

The integration pattern is consistent. The gateway maintains a Modbus client on its RS-485 or TCP port, polls the field device on a configurable cadence (typically 5 to 30 seconds for energy data, 1 to 5 seconds for control), and exposes each polled register as a BACnet object with a configurable Object_Type, Object_Instance, Object_Name and Engineering_Units. The supervisor sees a normal BACnet device on Who-Is, subscribes COV on the objects it cares about, and never knows Modbus exists.

What to watch for in the design review: point-count licensing (most gateways tier at 50, 250, 500, 1500 points), COV-on-poll behaviour (the gateway fakes COV by triggering a notification when the polled value crosses the increment — latency is then bounded by the poll cycle), scaling and engineering-units transforms (do them in the gateway, not the supervisor, so every client sees clean data), and certificate management for BACnet/SC (the gateway terminates BACnet/SC northbound but still talks plaintext Modbus southbound — segment the Modbus trunk accordingly).

A well-configured gateway costs USD 1,500 and three hours of commissioning. A bespoke driver in the supervisor costs ten times that in maintenance over the building's life. Specify the gateway.