Modbus to BACnet gateways: connecting Modbus devices to a BACnet BMS

How a Modbus to BACnet gateway maps registers to BACnet objects, when MS/TP is involved, and which ICP DAS gateway fits each direction.

Udgivet 28. oktober 2026

Modbus to BACnet gateways: connecting Modbus devices to a BACnet BMS — Foto: Patrick Tomasso · CC0 · Wikimedia Commons

Most new building management systems (BMS) use BACnet/IP, while many devices in plant rooms still speak Modbus: energy meters, fan coil controllers, lighting modules, heat pumps and remote I/O. A Modbus to BACnet gateway closes that gap without a custom driver in the BMS. This article covers how the gateway works, register mapping, BACnet/IP versus MS/TP, and which ICP DAS gateways and BACnet/IP I/O modules fit which direction of data flow.

How a Modbus to BACnet gateway works

The gateway has two roles. Towards the BMS it is a BACnet server: one BACnet device with a list of objects that the BMS discovers and reads. Towards the field it is a Modbus master (RTU) or client (TCP) that polls the configured registers of each device in a cycle and stores the latest values in the matching objects. When the BMS writes to an output or setpoint object, the gateway passes the value on as a Modbus write.

Every point has to be configured in the gateway, and values are only as fresh as the polling cycle, so keep the point list on a slow RS-485 segment to what is actually used. Some projects need the opposite direction, where a Modbus-only SCADA system reads BACnet controllers. ICP DAS has gateways for both cases.

Mapping Modbus registers to BACnet objects

A consistent mapping keeps the BMS view readable:

Modbus data	Typical content	BACnet object
Discrete input (read-only bit)	Fault, door contact	Binary Input (BI)
Coil (read/write bit)	Pump or fan start	Binary Output (BO) or Binary Value (BV)
Input register (read-only word)	Temperature, power	Analog Input (AI)
Holding register (read/write word)	Setpoint, valve position	Analog Output (AO) or Analog Value (AV)
Holding register with enumerated values	Operating mode, fan speed	Multi-state Value (MSV), Input (MSI) or Output (MSO)

For each register, check:

Addressing: manuals mix 1-based notation (40001) and 0-based offsets. An off-by-one error gives plausible but wrong values.
Data type: signed or unsigned 16-bit, or 32-bit values over two registers with the correct word order.
Scaling and units: many devices send 215 for 21.5 °C. Decide where scaling happens and set the engineering unit on the object.
Names and instances: use object names the operator understands, and a unique BACnet device instance per gateway.

The GW-2492M and GW-2493M offer simple data translation between the protocols. Check that it covers the conversions your registers need.

BACnet/IP and BACnet MS/TP

BACnet/IP runs over Ethernet and UDP, by default on port 47808. Device discovery uses broadcasts, which stay inside one IP subnet. Across subnets, a BACnet Broadcast Management Device (BBMD) forwards them, and devices elsewhere can register with it as foreign devices.

BACnet MS/TP runs on an RS-485 twisted pair with token passing between masters. It is common for room and VAV controllers at field level: cheaper to wire than Ethernet, but much slower. All devices on a segment use the same baud rate, and both ends need termination.

When a Modbus TCP system has to reach MS/TP devices, the GW-2139M acts as MS/TP master on one side and Modbus TCP server on the other. It supports 9600, 19200, 38400 and 76800 baud and has a built-in 120 Ω terminating resistor enabled by jumper.

Worked example: one RS-485 segment in a plant room

A plant room has six SC-6104-W5 fan coil controllers, four LC-101H lighting control modules, two PM-3133 power meters (Modbus RTU version) and two M-7015P-G RTD input modules, all on one RS-485 segment. The BMS uses BACnet/IP, so one GW-2492M goes into the plant room panel.

Devices	Points used per device	BI	BO	AI
6 x SC-6104-W5	1 digital input, 4 relays	6	24	0
4 x LC-101H	1 AC input, 1 relay, 1 AC current	4	4	4
2 x PM-3133	8 selected measurements	0	0	16
2 x M-7015P-G	6 RTD inputs	0	0	12
Total	14 stations	10	28	32

The GW-2492M polls up to 32 Modbus RTU stations and transfers up to 180 points each of DI, DO, AI and AO, leaving room for additions. Set the same baud rate and data format on all 14 devices, give each a unique Modbus address, and check every object with a BACnet browser.

The BIBBs listed for the GW-2492M cover ReadProperty(Multiple) and WriteProperty(Multiple) but not change of value (DS-COV-B), so plan for the BMS to poll, preferably with ReadPropertyMultiple.

ICP DAS BACnet gateways and BACnet/IP I/O

Model	BACnet side	Modbus side	Capacity
GW-2492M	BACnet/IP server	Modbus RTU master	32 stations; 180 each of DI, DO, AI, AO
GW-2493M	BACnet/IP server	Modbus TCP client	32 stations; 180 each of DI, DO, AI, AO
GW-2139M	BACnet MS/TP master	Modbus TCP server	32 MS/TP connections
GW-2439M	BACnet/IP client	Modbus TCP server and RTU slave	10 BACnet/IP servers, 9,000 objects
BNET-2310M	BACnet/IP server	None (I/O module)	4 AI, 2 AO, 4 DI, 4 DO

All four gateways support the object types AI, AO, AV, BI, BO, BV, MSI, MSO and MSV, mount on a DIN rail, consume 5 W at 24 VDC and operate from -25 to +75 °C. The GW-2492M and GW-2493M are configured in a web browser, the GW-2139M with an ICP DAS utility.

The GW-2439M lets a Modbus master read and write object values in BACnet/IP controllers. It receives messages forwarded by a BBMD, and its utility scans for BACnet servers and generates the Modbus mapping table.

For new hardwired signals, the BNET-2310M connects directly to the BMS: analog inputs from ±1 V to ±10 V at 16-bit, analog outputs up to 0–10 V or ±10 V, dry-contact inputs and open-collector outputs. It can register with a BBMD as a foreign device, and its BIBB list includes DS-COV-B.

Checklist before you order

Direction: BMS reads Modbus devices (GW-2492M, GW-2493M), or a Modbus master reads BACnet devices (GW-2139M, GW-2439M)
Register list per device with data type, scaling and access
Stations per gateway and points per type
IP subnets and BBMD use

Send your device list and BMS requirements to our technical sales team for a gateway proposal.

Produkter til denne anvendelse

ACS-11-MF CR ACS-11-MF Proximity Card Reader with Keypad for Access Control

The ACS-11-MF is a proximity card reader with a built-in keypad, designed for access control installations where credentials are presented by card, by code or by both. It reads ISO 14443 A cards including Mifare Classic, Ultralight and DESFire, and gives spoken feedback through its built-in voice message function.Beyond credential reading, the unit controls an electric door lock, monitors door position and supports elevator floor control of up to 32 floors. It stores up to 8192 cards and keeps access records. An anti-sabotage micro switch and a choice of Ethernet, RS-485 or CAN communication suit it to engineers building networked access control systems.The reader is wall mounted and rated for an operating temperature of -20 ~ +60 °C. Its 2.0 W consumption and reverse polarity protection simplify integration into existing low-voltage access control wiring.ApplicationsCommunity door accessElevator floor controlAccess control systems

1.225,77 kr. pr. stk. · mængderabat fra 10 stk.

Detaljer

ACS-11-MF-TC CR ACS-11-MF-TC Proximity Card Reader with Keypad for Access Control

The ACS-11-MF-TC CR is an access control reader that accepts both keypad entry and ISO 14443 A RFID cards, covering Mifare Classic, Ultralight and DESFire card types. It combines door access control, voice guidance and elevator floor control in a single unit, making it suited to community door access and lift control schemes.Door hardware can be driven directly through two Form C relay outputs, while four digital inputs and a door position detection function report door status. A built-in micro switch provides anti-sabotage detection, and the reader stores access records with a capacity of 8192 cards.Communication is available over a 10/100Base-T(X) Ethernet port, an RS-485 port and a CAN bus interface, with a built-in RTC and WDT. The unit is wall mounted and measures 83 x 120 x 28 mm (W x L x H), with an operating range of -20 ℃ to +60 ℃.ApplicationsCommunity door access controlElevator floor controlAccess control systems

1.225,77 kr. pr. stk. · mængderabat fra 10 stk.

Detaljer

ACS-11P-MF CR ACS-11P-MF Proximity Card Reader with Keypad, RS-485 and Ethernet PoE

ACS-11P-MF CR is a keypad and RFID proximity card reader for access control systems. It combines door access control, voice guidance and elevator floor control in one unit, which suits community door access and lift control installations.The reader accepts ISO 14443 A cards, including Mifare Classic, Ultralight and DESFire, and offers electric door lock control with door position detection. An anti-sabotage micro switch, access records and built-in RTC and WDT help protect the installation and support day-to-day management. Communication is available over Ethernet with PoE or over RS-485, and the unit is powered from PoE (IEEE 802.3af, Class 1).Engineers will find the following points useful when specifying this reader:Keypad and RFID induction control for access decisionsTwo digital inputs and two Form C relay outputs for door and floor controlEthernet 10/100Base-T(X) with PoE, plus a single RS-485 port (9600 baud, N, 8, 1)Wall mounting, with the outlet box fitting noted in the source data for the United StatesApplicationsCommunity door access controlElevator floor controlAccess control systems for managed buildings

1.285,56 kr. pr. stk. · mængderabat fra 10 stk.

Detaljer

BNET-2310M CR BNET-2310M BACnet/IP I/O Module, 4-ch AI, 2-ch AO, 4-ch DI, 4-ch DO

The BNET-2310M CR is a remote I/O module that brings 4 analogue inputs, 2 analogue outputs, 4 digital inputs and 4 digital outputs onto a BACnet/IP network. A BMS or BACnet/IP client can read field sensor signals directly over Ethernet and command connected analogue or digital output devices, without a separate gateway.The module operates as a BACnet/IP Server and also supports Foreign Device functionality. It can register with a specified BBMD to receive BACnet/IP messages forwarded across different IP subnets, which suits multi-floor buildings, multi-building facilities, industrial sites and larger BEMS installations.Configuration is handled through a built-in web server, so the module can be set up from a standard web browser. Configuration files can be imported and exported for backup and repeat deployments. The CR ordering code is the RoHS-marked variant.ApplicationsHVAC control and monitoring in building automationLighting and energy managementBMS and BEMS integration via BACnet/IPMulti-floor buildings and multi-building facilitiesIndustrial sites with BACnet/IP field I/O

2.025,51 kr. pr. stk. · mængderabat fra 10 stk.

Detaljer