Occupancy Sensor BACnet Integration: The Complete Guide
Occupancy sensors integrate with a building management system over BACnet/IP by exposing each monitored space as a set of BACnet objects that the BMS reads directly. In most modern deployments this is done by a gateway: a device on the building’s local network that receives data from the sensors, resolves it into space-level occupancy, and hosts those objects for the BMS.
The BMS discovers the gateway, subscribes to change-of-value notifications, and receives an update the instant occupancy changes rather than polling on a timer.
That is the mechanism in one paragraph. The rest of this guide covers what actually goes wrong.
Most content on this topic stops at “our platform supports BACnet.” That claim is nearly meaningless on its own. BACnet support can mean a fully compliant server with COV subscriptions and cross-subnet discovery, or it can mean a nightly CSV export somebody built a converter around. The difference shows up on commissioning day.
This is the detail an integrator needs before specifying. For the wider architectural context, see our guide: What is on-premise occupancy intelligence?
What BACnet is, and why occupancy data has to speak it
BACnet is the Building Automation and Control Network protocol. It has been the dominant standard in building automation since the 1990s, and it is an ASHRAE and ISO standard rather than a vendor format.
If a commercial building has a BMS, that BMS almost certainly speaks BACnet. Which means occupancy data has to arrive as BACnet, one way or another. There are a few ways that happens, and they differ more than the word “integration” suggests.
BACnet/IP is the variant that runs over standard Ethernet using UDP, typically on port 47808. It is what modern building networks use. The older MS/TP variant runs over serial twisted pair and is still common on field-level devices, but it is not where occupancy data belongs.
The important thing about BACnet is not the wire format. It is the assumption underneath it. BACnet was designed for deterministic local control. It expects sub-second responses on a local network. It has no concept of “wait while I check the cloud,” and that is by design, because building control was built to keep running when the outside world does not cooperate.
Three ways occupancy data reaches a BMS
Before getting into mechanics, it is worth being clear that “occupancy integrated with BACnet” describes at least three quite different arrangements. They are not equivalent, and a proposal will rarely tell you which one is on offer.
1. The sensor is a point on a controller
The traditional approach, and still the most common in lighting control. A PIR or ultrasonic sensor is wired into a field controller, and the controller exposes it to the BMS as a BACnet point.
This works well for what it is. It is also limited to binary occupied or not occupied for the area that one device covers. There is no headcount, no space-level aggregation, and no concept of a room being at 30 percent capacity. For lighting and simple setback it is sufficient. For demand-controlled ventilation it is not.
2. Cloud API plus a middleware layer
The occupancy platform exposes a REST API. Something else polls that API and writes the values into BACnet objects the BMS can read.
That “something else” is usually one of three things: a supervisory platform already installed in the building, such as a Niagara-based station used for protocol normalization, a bespoke integration built by the systems integrator, or a general-purpose IoT middleware product.
This is a legitimate approach and a great deal of it exists in the field. Two caveats matter before choosing it.
The first is latency, which compounds in a way that is easy to underestimate. Data goes from the building to the cloud, gets processed, and comes back down before the BMS sees it. On top of that round trip sits whatever polling interval the middleware runs on, and those intervals are often measured in minutes because the layer was designed for dashboards rather than control loops.
The second is what happens during an outage. If the internet connection drops, the API is unreachable and the BACnet values go stale. The BMS falls back to a fixed schedule, which is exactly the behavior occupancy-driven control was installed to replace.
Worth noting too that this arrangement puts four parties on one data path: sensor vendor, middleware provider, systems integrator and BMS contractor. When occupancy stops updating in the BMS, the diagnostic conversation crosses all four of them.
3. An on-premise occupancy gateway
This is the newest of the three, and it is still emerging. Vendors describe it inconsistently: gateway, appliance, edge server, on-premise server, local processor. The underlying idea is the same.
A dedicated device is installed inside the building, usually rack-mounted in a comms room. It does three things:
1. Receives sensor data locally. Sensors report to it over the building’s own network rather than to a cloud endpoint.
2. Resolves that data into space-level occupancy. Raw sensor output becomes an occupancy status, a headcount and a percentage against capacity, per space.
3. Publishes the result in building protocols. It presents itself to the BMS as a native BACnet device, and typically also publishes UDMI over a local MQTT broker.
Because all three steps happen inside the building, the control path never leaves it. There is no API to poll, nothing to license in between, and the BMS reads a value that was calculated a few meters away rather than in a data center.
How it resembles a conventional protocol gateway. In BACnet terms it behaves like any other gateway on the network. It is mains-powered, sits in a comms room, has no user interface, and appears as a BACnet device that the BMS discovers with WhoIs and IAm, enumerates, reads and subscribes to. Nothing about the integration itself is unfamiliar to a controls contractor, which is largely the point.
How it differs, and why it is not just a rebadged protocol converter. A conventional gateway does stateless point mapping. Modbus register 40001 becomes Analog Input 1. One input, one output, a fixed relationship configured at commissioning and left alone.
An occupancy gateway does resolution rather than mapping, and there is no one-to-one relationship between a sensor and a BACnet object. A single space is often covered by several sensors, coverage overlaps deliberately, and the same person can be seen by more than one sensor at once. Producing one trustworthy headcount means stitching those views together and deduplicating in real time. That is a computational job, not a lookup table.
It also holds a model of the building: which sensors cover which space, how spaces are grouped, what each space’s capacity is. That model changes whenever the floorplan does, so it has to be maintained rather than flashed once. In practice that means these devices are usually cloud-managed and vendor-maintained, which is a different operational model from a gateway an integrator commissions and hands over. It is also why several vendors call it an appliance rather than a gateway: the word signals managed hardware rather than a box you configure yourself.
For the rest of this guide we will call it an on-premise occupancy gateway. It is the arrangement that gives a BMS the real-time, space-level occupancy signal that demand-controlled ventilation and occupancy-driven HVAC sequencing actually require, so it is the one worth understanding in detail.
Three ways occupancy data reaches a BMS
Before getting into mechanics, it is worth being clear that “occupancy integrated with BACnet” describes at least three quite different arrangements. They are not equivalent, and a proposal will rarely tell you which one is on offer.
1. The sensor is a point on a controller
The traditional approach, and still the most common in lighting control. A PIR or ultrasonic sensor is wired into a field controller, and the controller exposes it to the BMS as a BACnet point.
This works well for what it is. It is also limited to binary occupied or not occupied for the area that one device covers. There is no headcount, no space-level aggregation, and no concept of a room being at 30 percent capacity. For lighting and simple setback it is sufficient. For demand-controlled ventilation it is not.
2. Cloud API plus a middleware layer
The occupancy platform exposes a REST API. Something else polls that API and writes the values into BACnet objects the BMS can read.
That “something else” is usually one of three things: a supervisory platform already installed in the building, such as a Niagara-based station used for protocol normalization, a bespoke integration built by the systems integrator, or a general-purpose IoT middleware product.
This is a legitimate approach and a great deal of it exists in the field. Two caveats matter before choosing it.
The first is latency, which compounds in a way that is easy to underestimate. Data goes from the building to the cloud, gets processed, and comes back down before the BMS sees it. On top of that round trip sits whatever polling interval the middleware runs on, and those intervals are often measured in minutes because the layer was designed for dashboards rather than control loops.
The second is what happens during an outage. If the internet connection drops, the API is unreachable and the BACnet values go stale. The BMS falls back to a fixed schedule, which is exactly the behavior occupancy-driven control was installed to replace.
Worth noting too that this arrangement puts four parties on one data path: sensor vendor, middleware provider, systems integrator and BMS contractor. When occupancy stops updating in the BMS, the diagnostic conversation crosses all four of them.
3. An on-premise occupancy gateway
This is the newest of the three, and it is still emerging. Vendors describe it inconsistently: gateway, appliance, edge server, on-premise server, local processor. The underlying idea is the same.
A dedicated device is installed inside the building, usually rack-mounted in a comms room. It does three things:
1. Receives sensor data locally. Sensors report to it over the building’s own network rather than to a cloud endpoint.
2. Resolves that data into space-level occupancy. Raw sensor output becomes an occupancy status, a headcount and a percentage against capacity, per space.
3. Publishes the result in building protocols. It presents itself to the BMS as a native BACnet device, and typically also publishes UDMI over a local MQTT broker.
Because all three steps happen inside the building, the control path never leaves it. There is no API to poll, nothing to license in between, and the BMS reads a value that was calculated a few meters away rather than in a data center.
How it resembles a conventional protocol gateway. In BACnet terms it behaves like any other gateway on the network. It is mains-powered, sits in a comms room, has no user interface, and appears as a BACnet device that the BMS discovers with WhoIs and IAm, enumerates, reads and subscribes to. Nothing about the integration itself is unfamiliar to a controls contractor, which is largely the point.
How it differs, and why it is not just a rebadged protocol converter. A conventional gateway does stateless point mapping. Modbus register 40001 becomes Analog Input 1. One input, one output, a fixed relationship configured at commissioning and left alone.
An occupancy gateway does resolution rather than mapping, and there is no one-to-one relationship between a sensor and a BACnet object. A single space is often covered by several sensors, coverage overlaps deliberately, and the same person can be seen by more than one sensor at once. Producing one trustworthy headcount means stitching those views together and deduplicating in real time. That is a computational job, not a lookup table.
It also holds a model of the building: which sensors cover which space, how spaces are grouped, what each space’s capacity is. That model changes whenever the floorplan does, so it has to be maintained rather than flashed once. In practice that means these devices are usually cloud-managed and vendor-maintained, which is a different operational model from a gateway an integrator commissions and hands over. It is also why several vendors call it an appliance rather than a gateway: the word signals managed hardware rather than a box you configure yourself.
For the rest of this guide we will call it an on-premise occupancy gateway. It is the arrangement that gives a BMS the real-time, space-level occupancy signal that demand-controlled ventilation and occupancy-driven HVAC sequencing actually require, so it is the one worth understanding in detail.
How a gateway integration is structured
The gateway operates as a BACnet server, and the BMS is the client. This direction matters more than it sounds.
The gateway hosts objects representing each space and serves their values on request. It does not write into the BMS. It does not scan or discover objects on the BMS. It does not read the BMS at all. The BMS discovers the gateway and pulls what it needs.
That one-way relationship is usually the answer to the first question a controls contractor asks, and it is the answer that gets the integration approved. Nothing is writing to their plant.
Not every gateway is built this way, and it is worth confirming. Some products act as BACnet clients and write occupancy values into objects hosted on the BMS side. That inverts the trust relationship and it will be treated very differently at review.
A gateway typically appears as a single BACnet device with one configurable Device Instance number. It responds to WhoIs broadcasts with IAm, so standard discovery tools find it without any static IP-to-device mapping.
What gets exposed: the three object types
Each space is typically represented by up to three BACnet objects.
|
Point |
BACnet object type |
Value |
Notes |
|---|---|---|---|
|
Occupancy status |
OBJECT_BINARY_VALUE |
1 occupied, 0 not occupied |
The core point. Always present. |
|
Headcount |
OBJECT_POSITIVE_INTEGER_VALUE |
Integer person count |
Optional. Requires sensing that counts, not just detects. |
|
Percent occupied |
OBJECT_ANALOG_VALUE |
Float 0 to 100, units percent |
Optional. Calculated against configured space capacity. |
Each object carries the standard required properties: Present_Value, Object_Name, Object_Identifier, Object_Type, Status_Flags, Event_State, Reliability, Out_Of_Service, plus Units, Polarity and COV_Increment where applicable.
The headcount object is the one worth scrutinizing when comparing platforms. Binary occupied or not occupied is straightforward, and almost any sensing technology can produce it. An accurate integer person count is a materially harder problem, and it is what demand-controlled ventilation actually needs.
Object naming convention is typically Occupancy_<name>, Headcount_<name>, PercentOccupied_<name>, where the name is configured per space.
How the BMS gets the data
Three mechanisms, and the third is the one that makes real-time control possible.
Read. The BMS can issue ReadProperty or ReadPropertyMultiple against any object at any time. Simple, reliable, and entirely dependent on how often the BMS chooses to ask.
Subscribe to change-of-value. The BMS issues a SubscribeCOV. The gateway immediately returns the current value, then sends a notification on every subsequent change, confirmed or unconfirmed depending on the subscriber’s request. Present_Value and Status_Flags are included.
COV is the difference between a building that reacts and a building that checks. With a polling loop, response time is capped by the poll interval no matter how fast the sensing is. With COV, a room filling up produces a notification as it happens.
Discovery. The BMS finds the device via WhoIs and IAm, then reads the Object_List property to enumerate everything available.
Five things that go wrong
These are the practical failure modes. Ask about them during evaluation, not during commissioning.
- Object_List reads fail on large sites
A large deployment produces a lot of objects. A 235-space site with all three points exposed is roughly 705 objects.
If the gateway does not implement BACnet segmentation, a single unsegmented response cannot carry an object list that long. A full-array read gets rejected with ABORT_APDU_TOO_LONG.
Nothing has gone wrong here. The abort is the protocol telling the client to read Object_List by array index instead: element 0 returns the count, elements 1 to N return each identifier. All mainstream BMS clients, including EcoStruxure, do this automatically. But it is worth knowing before someone escalates an abort code as a defect.
- Renamed spaces do not appear in the BMS
Most BMS clients read object names once at discovery and cache them. Rename a space in the occupancy platform after the BMS has discovered it, and the new name will not appear until the BMS re-discovers or re-reads object names.
Set your naming convention before integration. Renaming afterwards means a re-scan.
- COV subscriptions are lost on restart
A BACnet device losing its COV subscriptions when it restarts is normal behavior. Compliant clients re-subscribe after receiving a device restart notification, which is the DM-R-A BIBB.
Not every client implements it. EcoStruxure, for example, does not. A well-built gateway handles this two ways: it emits a restart notification on startup so compliant clients re-subscribe promptly, and it persists its COV subscription table so notifications keep flowing across a software update even for clients that ignore the notification.
Ask whether the subscription table is persisted. If it is not, every firmware update silently stops the automation until someone notices.
- The BMS is on a different subnet
BACnet/IP discovery relies on broadcasts, and broadcasts do not cross subnets. If the BMS sits on a different subnet from the occupancy gateway, you need BBMD, the BACnet Broadcast Management Device, with the gateway registered as a foreign device.
This is routine, but it needs to be in the network design from the start. Discovering it during commissioning means a change request with the network team.
- Object instance collisions
Object instance numbers must be unique per object type across the device. Two spaces configured with the same type and instance number collapse into a single object. The symptom is a meeting room that reports the occupancy of a different meeting room, which can take a long time to diagnose.
What to confirm before specifying
— BACnet/IP or MS/TP? Occupancy data over serial BACnet is not realistic. Confirm BACnet/IP over UDP.
— BACnet/SC support? Secure Connect over WebSocket and TLS is the newer secure variant. Many gateways do not support it yet. Confirm rather than assume.
— Is COV supported, and is the subscription table persisted?
— Server or client? Confirm the gateway never writes to the BMS.
— How is per-space configuration managed? Static mapping files mean a site visit for every change. Configuration fetched at runtime from a central portal means a change takes effect on the next cache refresh.
— What is the update latency at the sensor? BACnet can deliver a change in milliseconds. If the sensing platform only produces a new reading every few minutes, the protocol is not your bottleneck.
That last point is worth dwelling on. A perfectly implemented BACnet integration sitting on top of a battery-powered sensor that polls every five minutes is still a five-minute integration. Battery life and real-time control are a direct trade-off, and the trade-off gets made at the sensor, not the gateway.
Where XY Sense sits in this
Everything above is category-level and applies whichever platform you specify. Two points are specific to XY Sense and worth stating plainly.
Our sensors update every two seconds. That is the input side of the equation, and it is fixed at the hardware. A gateway can only publish changes as fast as it is told about them, so a platform reporting on a multi-minute interval cannot produce a real-time BACnet signal no matter how well the integration layer is built.
Our sensors produce an accurate integer headcount rather than binary presence, at roughly 99 percent accuracy, with each sensor covering up to 3,000 sq ft. That is what makes the headcount and percent-occupied objects meaningful rather than nominal, and it is what demand-controlled ventilation needs to sequence against.
Where a space is covered by more than one sensor, which is normal on open floors because coverage overlaps deliberately for redundancy, those views have to be stitched and deduplicated into a single count before anything is published to BACnet. That resolution step is the real work behind a headcount object, and it is worth asking any vendor how and where they do it.
- Frequently asked questions
What is a BACnet gateway?
A device that takes data from a system which does not natively speak BACnet and outputs it as BACnet objects a building management system can read. For occupancy data, the gateway hosts objects representing each monitored space and serves their values to the BMS over BACnet/IP.
What is BACnet used for in HVAC?
BACnet is how HVAC controllers, sensors, plant equipment and the central building management system exchange data and commands. It lets equipment from different manufacturers interoperate on a common network, which is why it became the dominant building automation standard.
How does BACnet work?
Devices on a BACnet network expose their data as standardized objects with defined properties. A client reads those properties, writes to them where permitted, or subscribes to be notified when a value changes. Discovery happens through WhoIs and IAm broadcasts, so devices find each other without manual address configuration.
Can occupancy sensors write directly to a BMS over BACnet?
They can, but a well-designed occupancy integration does not. The gateway acts as a server that hosts and serves its own objects, and the BMS reads them. The occupancy system never writes into building plant. This is both safer and much easier to get approved by a controls contractor.
Does a BACnet integration keep working if the internet goes down?
That depends entirely on where the occupancy data is processed. If the gateway processes sensor data locally, BACnet values keep updating through a WAN outage because nothing in that path touches the internet. If processing happens in the cloud, the values go stale and automation reverts to a fixed schedule.
Related reading
- Opinion
Cloud or on-premise? Buildings need occupancy data from both
I think it’s about time we connected the dots and started treating occupancy data as a true operational signal, as infrastructure. This changes what we should expect from the technology underneath it.