BMS Protocol Selection: BACnet vs Modbus vs KNX — and How to Spec It Without Vendor Lock-In

A typical retrofit brief looks like this: the chiller speaks one protocol, the energy meters another, the lighting installed by the electrical contractor a third — and the owner wants all of it on one screen. The question that follows is what to write into the specification. This article answers it from the standards bodies directly.

Different layers, not competing options

The mistake that undermines many specifications is treating this as a choice of one. In practice, mid-size buildings and above run all three, each owning a different layer and bridged by gateways at panel level.

flowchart TD
    A["Building management layer
Front end · energy reporting"] --> B["BACnet
ANSI/ASHRAE 135
ISO 16484-5"]
    B --> C["Protocol gateway
at control panel"]
    C --> D["Modbus RTU / TCP
Chillers · pumps · VFDs · meters"]
    C --> E["KNX
Lighting · blinds · room switches"]
    B --> F["BACnet MS/TP · BACnet/IP
AHU and FCU controllers"]

BACnet — the open building-level standard

Development began in the ASHRAE committee in June 1987, and the protocol was first published as ANSI/ASHRAE Standard 135 in 1995. It became an international standard in 2004 as ISO 16484-5, with the companion conformance-testing standard ASHRAE 135.1 adopted as ISO 16484-6. Its declared scope is broader than HVAC alone — it covers lighting, access control, elevators, security and fire detection.

The current base edition is ANSI/ASHRAE Standard 135-2020, extended by published addenda. Addendum 135-2020cp, published on 30 November 2024 at protocol revision 29, added finer-grained authorization and authentication for machine-to-machine communication. This matters for procurement: a clause saying only "shall support BACnet", with no edition or protocol revision, binds a vendor to very little. What makes BACnet enforceable in tendering is independent product certification — devices claiming conformance are tested and listed by the BACnet Testing Laboratories, which a specification can reference without naming a brand.

Modbus — simple, ubiquitous, and easy to cite incorrectly

Modbus is a request-reply protocol simple enough that nearly every equipment manufacturer ships it. The Modbus Organization publishes several documents, and citing the wrong one is a common specification error.

Function codes are one byte. Function 06 writes a single holding register, function 15 (0x0F) forces multiple coils, and function 16 (0x10) writes a block of 1 to 123 contiguous registers. That last limit has real design consequences: a power meter exposing several hundred points must be polled in multiple transactions, which drives the scan time of the whole system.

The honest weakness is security. Plain Modbus has no authentication or encryption in the protocol itself, so reachability equals write access. The official answer is the Modbus Security Protocol on port 802, but adoption is still thin — so the practical control is network segmentation, not the protocol.

KNX — room-level electrical control

KNX is an open standard for home and building automation whose value is multi-vendor interoperability on a shared bus covering lighting, HVAC, blinds, security and energy management, configured through the ETS planning and configuration tool. That tool matters commercially: the ETS project file is an asset the owner must claim at handover, not the contractor's property.

On security, two elements should be specified separately. KNX Data Secure protects user data against unauthorised access and manipulation through encryption and authentication, while KNX IP Secure encrypts all telegrams carried over IP. The technology is standardised on the basis of EN 50090-3-4, uses AES 128 CCM encryption referencing the ISO 18033-3 encryption standard, and received VDE "Information security tested Smart Home and Building" certification in 2022. More than 1,000 certified KNX Secure devices are now available, so requiring it does not narrow the bidder field.

Specification clauses that prevent lock-in

1. Cite the standard with its edition. Reference ANSI/ASHRAE Standard 135-2020 and the required protocol revision, and require devices to appear on the BACnet Testing Laboratories listing.
2. Require the point map as a deliverable. Every Modbus device needs documented register addresses, data types, scaling factors and units, because the protocol carries none of this.
3. Claim the project files. ETS project files and controller configuration files, with administrator credentials, must be handed over — otherwise nothing can be changed after the contract ends.
4. Use ASHRAE Guideline 13 as the outline. The current edition, Guideline 13-2024, frames BAS specification across system architecture, hardware performance, installation, training, communication protocols, program configuration, testing, documentation and cybersecurity.
5. Segment the network. Follow NIST SP 800-82 Rev. 3: isolate the BMS network, avoid direct internet exposure, and replace all default credentials.
6. Plan point naming now. Industry direction is machine-readable semantic description of building data, pursued through ASHRAE Standard 223P using W3C semantic-web technologies such as RDF, SPARQL and SHACL so software can discover and self-configure instead of being mapped point by point.

Summary

BACnet, Modbus and KNX are layers, not alternatives. Whether a BMS remains maintainable is decided less by the controller brand than by three things written into the specification: the standard cited with edition and certification, the point maps and project files required at handover, and an encrypted data link mandated in line with OT security guidance. Sahawatthanakit (1988) advises on specification structure and handover-document completeness for projects of this type.