Modbus to BACnet gateways: connecting Modbus devices to a BACnet BMS

How a Modbus to BACnet gateway maps registers to BACnet objects, when MS/TP is involved, and which ICP DAS gateway fits each direction.

Publisert 28. oktober 2026

Modbus to BACnet gateways: connecting Modbus devices to a BACnet BMS — Foto: Patrick Tomasso · CC0 · Wikimedia Commons

Most new building management systems (BMS) use BACnet/IP, while many devices in plant rooms still speak Modbus: energy meters, fan coil controllers, lighting modules, heat pumps and remote I/O. A Modbus to BACnet gateway closes that gap without a custom driver in the BMS. This article covers how the gateway works, register mapping, BACnet/IP versus MS/TP, and which ICP DAS gateways and BACnet/IP I/O modules fit which direction of data flow.

How a Modbus to BACnet gateway works

The gateway has two roles. Towards the BMS it is a BACnet server: one BACnet device with a list of objects that the BMS discovers and reads. Towards the field it is a Modbus master (RTU) or client (TCP) that polls the configured registers of each device in a cycle and stores the latest values in the matching objects. When the BMS writes to an output or setpoint object, the gateway passes the value on as a Modbus write.

Every point has to be configured in the gateway, and values are only as fresh as the polling cycle, so keep the point list on a slow RS-485 segment to what is actually used. Some projects need the opposite direction, where a Modbus-only SCADA system reads BACnet controllers. ICP DAS has gateways for both cases.

Mapping Modbus registers to BACnet objects

A consistent mapping keeps the BMS view readable:

Modbus data	Typical content	BACnet object
Discrete input (read-only bit)	Fault, door contact	Binary Input (BI)
Coil (read/write bit)	Pump or fan start	Binary Output (BO) or Binary Value (BV)
Input register (read-only word)	Temperature, power	Analog Input (AI)
Holding register (read/write word)	Setpoint, valve position	Analog Output (AO) or Analog Value (AV)
Holding register with enumerated values	Operating mode, fan speed	Multi-state Value (MSV), Input (MSI) or Output (MSO)

For each register, check:

Addressing: manuals mix 1-based notation (40001) and 0-based offsets. An off-by-one error gives plausible but wrong values.
Data type: signed or unsigned 16-bit, or 32-bit values over two registers with the correct word order.
Scaling and units: many devices send 215 for 21.5 °C. Decide where scaling happens and set the engineering unit on the object.
Names and instances: use object names the operator understands, and a unique BACnet device instance per gateway.

The GW-2492M and GW-2493M offer simple data translation between the protocols. Check that it covers the conversions your registers need.

BACnet/IP and BACnet MS/TP

BACnet/IP runs over Ethernet and UDP, by default on port 47808. Device discovery uses broadcasts, which stay inside one IP subnet. Across subnets, a BACnet Broadcast Management Device (BBMD) forwards them, and devices elsewhere can register with it as foreign devices.

BACnet MS/TP runs on an RS-485 twisted pair with token passing between masters. It is common for room and VAV controllers at field level: cheaper to wire than Ethernet, but much slower. All devices on a segment use the same baud rate, and both ends need termination.

When a Modbus TCP system has to reach MS/TP devices, the GW-2139M acts as MS/TP master on one side and Modbus TCP server on the other. It supports 9600, 19200, 38400 and 76800 baud and has a built-in 120 Ω terminating resistor enabled by jumper.

Worked example: one RS-485 segment in a plant room

A plant room has six SC-6104-W5 fan coil controllers, four LC-101H lighting control modules, two PM-3133 power meters (Modbus RTU version) and two M-7015P-G RTD input modules, all on one RS-485 segment. The BMS uses BACnet/IP, so one GW-2492M goes into the plant room panel.

Devices	Points used per device	BI	BO	AI
6 x SC-6104-W5	1 digital input, 4 relays	6	24	0
4 x LC-101H	1 AC input, 1 relay, 1 AC current	4	4	4
2 x PM-3133	8 selected measurements	0	0	16
2 x M-7015P-G	6 RTD inputs	0	0	12
Total	14 stations	10	28	32

The GW-2492M polls up to 32 Modbus RTU stations and transfers up to 180 points each of DI, DO, AI and AO, leaving room for additions. Set the same baud rate and data format on all 14 devices, give each a unique Modbus address, and check every object with a BACnet browser.

The BIBBs listed for the GW-2492M cover ReadProperty(Multiple) and WriteProperty(Multiple) but not change of value (DS-COV-B), so plan for the BMS to poll, preferably with ReadPropertyMultiple.

ICP DAS BACnet gateways and BACnet/IP I/O

Model	BACnet side	Modbus side	Capacity
GW-2492M	BACnet/IP server	Modbus RTU master	32 stations; 180 each of DI, DO, AI, AO
GW-2493M	BACnet/IP server	Modbus TCP client	32 stations; 180 each of DI, DO, AI, AO
GW-2139M	BACnet MS/TP master	Modbus TCP server	32 MS/TP connections
GW-2439M	BACnet/IP client	Modbus TCP server and RTU slave	10 BACnet/IP servers, 9,000 objects
BNET-2310M	BACnet/IP server	None (I/O module)	4 AI, 2 AO, 4 DI, 4 DO

All four gateways support the object types AI, AO, AV, BI, BO, BV, MSI, MSO and MSV, mount on a DIN rail, consume 5 W at 24 VDC and operate from -25 to +75 °C. The GW-2492M and GW-2493M are configured in a web browser, the GW-2139M with an ICP DAS utility.

The GW-2439M lets a Modbus master read and write object values in BACnet/IP controllers. It receives messages forwarded by a BBMD, and its utility scans for BACnet servers and generates the Modbus mapping table.

For new hardwired signals, the BNET-2310M connects directly to the BMS: analog inputs from ±1 V to ±10 V at 16-bit, analog outputs up to 0–10 V or ±10 V, dry-contact inputs and open-collector outputs. It can register with a BBMD as a foreign device, and its BIBB list includes DS-COV-B.

Checklist before you order

Direction: BMS reads Modbus devices (GW-2492M, GW-2493M), or a Modbus master reads BACnet devices (GW-2139M, GW-2439M)
Register list per device with data type, scaling and access
Stations per gateway and points per type
IP subnets and BBMD use

Send your device list and BMS requirements to our technical sales team for a gateway proposal.

Produkter for dette bruksområdet

ACS-10V-MF CR ACS-10V-MF RFID Access Control Card Reader with Voice, Ethernet and RS-485

The ACS-10V-MF CR is an RFID proximity card reader for access control, combining door access, voice guidance and elevator floor control in one unit. It reads Mifare Classic, Ultralight and DESFire cards and can store up to 8192 cards, making it suited to community door access and elevator control.The reader includes electric door lock control and door position detection, plus an anti-sabotage micro switch. It keeps access records and provides a built-in RTC and WDT. Elevator floor control supports up to 16 floors.Connectivity covers a 10/100Base-T(X) Ethernet port, an RS-485 port and CAN (ISO-11898-2). Four digital inputs and two Form C relay outputs support door and system integration. The unit is wall mounted and rated for -20 ~ +60 °C operation.ApplicationsCommunity door access controlElevator access and floor controlAccess control systems requiring door position monitoring

1 641,38 kr per stk. · mengderabatt fra 10 stk.

Detaljer

ACS-10V-MF-TC CR ACS-10V-MF-TC RFID Access Control Card Reader, Ethernet/RS-485/CAN

The ACS-10V-MF-TC is an RFID proximity card reader for access control systems. It reads ISO 14443 A cards, including Mifare Classic, Ultralight and DESFire, and combines door access control, voice guidance and elevator floor control in one unit.This -TC ordering code is the Chinese voice version of the reader. The built-in voice message function gives users audible feedback at the door. The unit has an Ethernet port, an RS-485 port and a CAN bus interface, so it can be integrated into different access control architectures.Door security is handled by an electric door lock output, door position detection and an anti-sabotage micro switch. Access records are kept on the device, and it can store up to 8192 cards. It is suited to community door access and elevator control installations.ApplicationsCommunity door access controlElevator floor controlAccess control systems

1 641,38 kr per stk. · mengderabatt fra 10 stk.

Detaljer

ACS-10VP-MF CR ACS-10VP-MF RFID Proximity Card Reader with Voice, Ethernet PoE and RS-485

The ACS-10VP-MF is a wall-mounted RFID proximity card reader for access control. It reads Mifare Classic, Ultralight and DESFire cards and combines door access, voice guidance and elevator floor control in one unit. This ordering code is the English voice version.Its Ethernet port supports Power over Ethernet (IEEE 802.3af, Class 1), so the reader can be powered from the same cable as its network connection. An RS-485 port is also provided for serial communication. Two digital inputs and two Form C relay outputs allow the reader to handle door lock control and door position detection, and a micro switch provides anti-sabotage detection.Stores up to 8192 cards and provides access records.Supports elevator floor control for up to 32 floors.Built-in RTC and WDT for timekeeping and watchdog protection.ApplicationsCommunity door accessElevator controlAccess control systems

1 828,38 kr per stk. · mengderabatt fra 10 stk.

Detaljer

ACS-11-MF CR ACS-11-MF Proximity Card Reader with Keypad for Access Control

The ACS-11-MF is a proximity card reader with a built-in keypad, designed for access control installations where credentials are presented by card, by code or by both. It reads ISO 14443 A cards including Mifare Classic, Ultralight and DESFire, and gives spoken feedback through its built-in voice message function.Beyond credential reading, the unit controls an electric door lock, monitors door position and supports elevator floor control of up to 32 floors. It stores up to 8192 cards and keeps access records. An anti-sabotage micro switch and a choice of Ethernet, RS-485 or CAN communication suit it to engineers building networked access control systems.The reader is wall mounted and rated for an operating temperature of -20 ~ +60 °C. Its 2.0 W consumption and reverse polarity protection simplify integration into existing low-voltage access control wiring.ApplicationsCommunity door accessElevator floor controlAccess control systems

1 703,71 kr per stk. · mengderabatt fra 10 stk.

Detaljer