BACnet MS/TP BACnet

The complaint is always some flavor of the same thing: points going stale, controllers flickering offline and back, a trunk that worked all morning and falls apart at two in the afternoon — or the new device that’s wired, addressed, powered, and simply never shows up. BACnet Basics and BACnet Networking both deferred this story, and this page pays it: why devices fall off an MS/TP trunk — and what the token ring, the addressing, and the two wires each need to stay healthy. Those are the three layers, and each one fails differently. Knowing which layer you’re looking at is most of the diagnosis.

The token ring — whose turn it is to talk

MS/TP runs on an RS-485 pair, and RS-485 has no referee: if two devices transmit at once, both messages die. BACnet’s answer is a token. The masters on the trunk organize themselves into a logical ring by MAC address, and only the device holding the token may initiate a message. When it’s done — or after it has sent its allowance — it passes the token to the next master up the ring, the highest address wraps back to the lowest, and around it goes, hundreds of times a minute on a healthy trunk.

Two device properties tune the ring, and both are routine commissioning entries. Max_Info_Frames is the talking allowance — how many messages a device may send per token visit. Field controllers are fine at 1; the supervisor or router that funnels the whole trunk’s traffic wants more (10–20 is common), or it spends most of the day waiting for its next turn. Max_Master is the search ceiling: a token holder periodically sends a Poll-For-Master to addresses between itself and the next known master, inviting newcomers into the ring — but it never polls above its own Max_Master.

That ceiling is the classic silent failure. Set the trunk’s devices to Max_Master = 40 — a sensible tightening on a 25-device trunk — and the controller someone later addresses as MAC 45 is wired correctly, configured correctly, and never polled. It can’t be invited into a ring that stops searching below its address. Nothing is broken, so nothing fixes it: not a power cycle, not a new transceiver, not reterminating the same two wires a third time.

The opposite mistake costs speed instead of silence. Leave every device at the factory Max_Master = 127 on an 8-device trunk, and the token holder dutifully Poll-For-Masters its way through a hundred-odd empty addresses, over and over, forever. The trunk works — it’s just spending a chunk of every rotation talking to nobody. The healthy pattern: compact MACs starting low, and Max_Master set the same on every device, a little above the highest MAC in use so there’s room to add a controller without touching the whole trunk.

Two addresses, and why the wrong one gets blamed

BACnet Networking laid out the three-address picture; on an MS/TP trunk the two that matter are easy to conflate and completely independent. The MAC address (0–127 for masters) is the one-byte station address on this physical trunk — the token ring runs on it, it’s set with DIP switches or a vendor-tool field, and it only has to be unique on this segment. The device instance (up to 4,194,302) is the application-layer identity the BMS programs against, and it must be unique across the whole site. MAC 5 can be device 100503 — the pairing is arbitrary, and assuming one from the other is how the wrong controller gets reprogrammed.

A duplicate MAC is the addressing failure with the strangest symptom. Two devices both believe it’s their turn when the token reaches the shared address; both transmit; the frames collide and corrupt. Depending on timing, one device wins for a while and the other looks dead, then they trade — so the front end shows two controllers taking turns flickering offline, often miles apart in the device list because their instances are nothing alike. Trunk-wide retries and CRC errors climb too: a duplicate MAC degrades everyone, not just the twins. It’s a favorite gift of the controller swap — the replacement arrives with a factory default of MAC 0 or 1, which is usually the router.

The two wires — what the electrical layer needs

Everything above assumes the bits arrive. RS-485 makes that conditional on physical discipline, and every clause of it shows up in a service call eventually. The trunk is a shielded twisted pair, daisy-chained from device to device — one cable in, one cable out, no star taps, no tee splices, stubs as close to zero as the terminal block allows. A branch line looks harmless and works on the bench; electrically it’s an unterminated reflection generator that corrupts frames in proportion to its length and the baud rate.

The pair is polarity-sensitive: + lands on + and − on − at every single device, the full length of the trunk. One swapped device can drag the whole segment down, not just itself — its transceiver actively drives the pair inverted. (Vendors label the conductors +/− or A/B; the cruel joke is that A and B aren’t defined the same way by every manufacturer. Trust the + and −, or the wire colors of a consistent install, over the letters.) Termination is a 120 Ω resistor across the pair at each physical end of the trunk — exactly two, at the ends, nowhere else. Most controllers have an EOL switch or jumper so the resistor is already onboard; the failure mode is three or four of them flipped on by habit, or none. And one point on the trunk — conventionally the supervisor or router — provides fail-safe bias, weak pull-aparts that hold the pair at a defined idle state between transmissions so receivers don’t chatter on noise. The shield lands on ground at one end only, the same rule as sensor wiring.

The remaining limits are budgets, and they read in two tiers. The ceiling is the standard: ASHRAE 135 rates a segment for up to 4000 ft (1200 m) of proper cable — shielded twisted pair, 100–130 Ω impedance, low capacitance — and 32 full unit loads of transceivers (modern ⅛-load parts stretch the device count; many vendors still draw the line near 32 devices per segment without a repeater). The working line is the vendor’s: field guides often quote shorter runs at the higher baud rates and stricter counts for their own hardware. Past the vendor’s figure, it could be a problem — marginal territory where cable quality, temperature, and that one forgotten stub decide whether the trunk holds. Past the standard’s figure, it is a problem — outside what the transceivers are specified to drive, and no amount of reterminating buys it back; that’s a repeater or a second segment. Every device on the segment runs the same baud — 9600, 19200, 38400, or 76800 are the standard set, 38400 and 76800 the common field picks — and a device on the wrong baud is simply mute, with its share of Poll-For-Master traffic turning to garbage on everyone else’s scope.

Reading the symptom — which layer is failing

The payoff of the three-layer picture is that the complaint usually names its layer before the meter comes out:

Symptom	Layer	Usual suspects
One device never appears, everything else fine	Ring / addressing	MAC above the trunk’s Max_Master; wrong baud on that device; +/− swapped at its terminals; its EOL switch flipped on mid-trunk.
Two devices take turns flickering offline	Addressing	Duplicate MAC — classic after a controller swap lands at the factory default.
Random devices drop, worse at certain hours	Electrical	Marginal termination or bias drifting with temperature; EMI from a VFD sharing conduit; a star tap added on the last retrofit doing its reflection work under load.
Whole trunk online but sluggish	Ring tuning	Max_Master left at 127 on a small trunk (empty-address polling); Max_Info_Frames = 1 on the router carrying everyone’s traffic.
Whole trunk dead or garbage	Electrical	Polarity swap introduced mid-trunk; no termination at all, or three of them; a dead short from a pinched jacket; missing bias leaving the pair floating.

And the one that pays the page’s opening debt: the trunk an electrician just extended with four new controllers that drop devices intermittently is carrying several of these at once more often than not — the old end’s EOL is now mid-trunk, the new devices shipped at default MACs and 9600 baud, and the new run may be a different cable. Extensions re-open every layer; walk all three.

What this page didn't cover

Seeing these failures happen — laying out a virtual trunk, flipping a terminator, doubling a MAC, capping Max_Master, and watching the ring degrade live — is a hands-on bus simulator’s job, and one is on the roadmap as this page’s practice pair; the Controller Wiring Simulator’s greyed-out NET terminals are the seam it will plug into. Also out of scope here: the transmission-line physics behind the no-stub rule (reflections, impedance, why the budgets are what they are), and BACnet/SC, the TLS-secured transport that will eventually inherit much of this work. The protocol that rides the trunk — objects, services, the priority array — is BACnet Basics; what happens when the conversation has to cross a router is BACnet Networking.