This is a platform-agnostic reference for decoding BACnet Protocol Data Unit (PDU) errors. When a BAS controller or workstation logs a BACnet error, it typically reports the Error Class and Error Code, or a Reject/Abort reason code. This reference maps those codes to human-readable descriptions and real-world field scenarios. Unlike vendor-specific error references, these codes apply to any BACnet device regardless of manufacturer. Technicians using WebCTRL, TotalControl, EBO, or any BACnet-compliant system will encounter these codes. Understanding them accelerates troubleshooting from "BACnet error occurred" to "the remote device is refusing writes due to access denial."
BACnet errors occur at different layers:
This reference focuses on Application Layer errors, which are most commonly encountered in field troubleshooting.
| Error Class | Codes | Meaning | When It Occurs |
|---|---|---|---|
| device | 0-4 | Issues with the device itself (offline, overloaded, etc.) | Device failed or configuration invalid |
| object | 0-4 | Issues with accessing a specific object (doesn't exist, wrong type) | Object not found or deleted |
| property | 0-5 | Issues with object properties (read-only, out of range, etc.) | Cannot read/write property |
| security | 0-5 | Access control or authentication issues | User not authorized or credentials invalid |
| services | 0-7 | General service or communication errors | Malformed request or unsupported operation |
| vt | 0-8 | Virtual Terminal (text communication) issues | Rare; mostly obsolete |
Device errors indicate a problem with the target device itself, not the request.
| Code | Name | Meaning | Real-World Scenario | Field Fix |
|---|---|---|---|---|
| 0 | other | Undefined device fault | Controller encountered an unexpected condition | Power-cycle the device. Check system logs for more details. |
| 1 | busy | Device is busy and cannot process request | Device handling too many simultaneous requests | Retry operation in a few seconds. Reduce polling frequency if excessive. |
| 2 | configuration-error | Device configuration is invalid or incomplete | Settings on device are inconsistent or corrupted | Restart device. If persists, reconfigure the device via its native tool. |
| 3 | device-fault | Device has detected an internal hardware fault | Memory, processor, or I/O board failure | Power-cycle device once. If fault persists, device likely needs replacement. |
| 4 | generic | Generic device error not classified elsewhere | Catch-all for unspecified device issues | Check device event log and manufacturer documentation. |
Object errors indicate the requested BACnet object (e.g., Analog Input 50) doesn't exist, is wrong type, or cannot be accessed as configured.
| Code | Name | Meaning | Real-World Scenario | Field Fix |
|---|---|---|---|---|
| 0 | other | Undefined object error | Object exists but request cannot be processed | Verify object instance number is correct. Restart controller. |
| 1 | duplicate-name | Object name already exists on device | Two objects have same name (BACnet requires unique names per type) | Rename one object via device commissioning tool. Resync with supervisory system. |
| 2 | duplicate-object-id | Object instance ID already exists | Two Analog Inputs both configured as instance 50 | Reconfigure one object to unique instance (e.g., 51). Verify in supervisory software. |
| 3 | object-deleted | Object was deleted but reference still exists | Supervisory system still references object that was removed from device | Remove the deleted object reference from supervisory system config. Rescan device to find current objects. |
| 4 | unsupported-object-type | Device does not support this object type | Trying to read a Trend Log from device that only supports Analog Input/Output | Check device datasheet. Use supported object types only. Create virtual points on gateway if translation needed. |
Property errors indicate the requested property of an object is not available, not readable/writable, or value is out of acceptable range.
| Code | Name | Meaning | Real-World Scenario | Field Fix |
|---|---|---|---|---|
| 0 | other | Undefined property error | Cannot process property request for unspecified reason | Verify property name/ID is correct. Check device supports property. Restart device. |
| 1 | read-access-denied | Property is not readable or access denied | Trying to read a write-only property, or user lacks read permission | Verify correct property is being accessed. Check device security settings. Ensure user has read privilege. |
| 2 | write-access-denied | Property is not writable or write access denied | Trying to write to a read-only property (e.g., present-value of input object), or user lacks write permission | Verify you're not writing to read-only property. Check device priority settings (may require Priority 1 to write). Verify user/client has write privilege. |
| 3 | missing-required-parameter | A required property was not included in the request | Request malformed; required field missing | Check supervisory software request format. Verify all mandatory fields are included. May indicate driver bug. |
| 4 | invalid-parameter-data-type | Data type of property value does not match expected type | Trying to write REAL value to a BOOLEAN property, or vice versa | Verify data type of property. Check supervisory system is sending correct type. Look up property definition in device manual. |
| 5 | out-of-range | Property value is outside acceptable limits | Trying to write setpoint 150°F to a sensor expected to be 32-125°F | Verify value is within device's acceptable range. Adjust value or reconfigure property limits. Some devices have constraints. |
Security errors indicate access control or authentication issues. More common in systems with user accounts or network authentication enabled.
| Code | Name | Meaning | Real-World Scenario | Field Fix |
|---|---|---|---|---|
| 0 | other | Undefined security error | Authentication or authorization failed for unknown reason | Check device security logs. Verify credentials. Restart security service. |
| 1 | authentication-failed | User credentials not accepted | Password wrong or user account disabled | Verify username and password on supervisory system. Check if account is locked (try resetting password). Verify account is enabled. |
| 2 | command-not-allowed | Command not permitted for this user | User not in correct group for administrative operations | Assign user to group with required privileges. Or use administrator account for this operation. Check access control list (ACL) on device. |
| 3 | device-security-level-mismatch | Device security level doesn't match client's | Client trying to connect without encryption to device requiring encryption | Enable encryption on client side if supported. Or disable encryption requirement on device (may reduce security). |
| 4 | decryption-failed | Encrypted message could not be decrypted | Encryption key mismatch or corrupted encrypted data | Verify encryption keys match between client and device. Restart security exchange. May need to re-register device. |
| 5 | encipherment-not-supported | Device does not support encryption | Client trying to use encryption on device that doesn't support it | Disable encryption on client side for this device. Or use non-encrypted protocol (less secure). |
Service errors indicate issues with the BACnet service being requested, not the device or object. These are the most commonly encountered errors in field troubleshooting.
| Code | Name | Meaning | Real-World Scenario | Field Fix |
|---|---|---|---|---|
| 0 | other | Undefined service error | Request could not be processed for unspecified reason | Check supervisory system logs for more detail. Verify request format. Restart device. |
| 1 | abort | Service aborted by remote device | Device received valid request but aborted processing mid-stream | Usually indicates network issue or device overload. Retry operation. If recurs, investigate network congestion. |
| 2 | access-denied | Access to service denied | Client does not have permission to use this service | Check device access control settings. Verify client is authorized. May be device-specific. |
| 3 | acknowledge-missing | Expected response acknowledgment not received | Service requires ACK (acknowledgment) but device didn't send one | Likely network issue (response lost). Retry. If persistent, check network quality. |
| 4 | ack-too-long | Acknowledgment response from device too large | Device response exceeded protocol limits | Reduce requested data size. Request one object at a time instead of bulk. |
| 5 | action-not-supported | Device does not support requested action | Trying to use a BACnet service not supported by device | Check device datasheet for supported services. Use alternative method if available. |
| 6 | service-request-denied | Device explicitly refused to process request | Generic rejection from device | Verify request is valid and within device's capabilities. Check device logs. May be device-specific reason. |
| 7 | inconsistent-parameters | Request parameters are internally inconsistent | E.g., start date after end date in range request | Verify logical consistency of parameters. Fix parameter order or values. |
VT (Virtual Terminal) errors are related to text-based remote access, rarely encountered in modern systems.
| Code | Name | Typical Scenario |
|---|---|---|
| 0 | other | Undefined VT error |
| 1-8 | Various | Mostly obsolete; modern BAS uses graphics, not terminal-based interfaces |
Reject PDUs occur at the BACnet Network layer when a message cannot be routed or is rejected before reaching the application layer. These are less common than Error PDUs but still appear in troubleshooting.
| Code | Name | Meaning | Scenario | Field Action |
|---|---|---|---|---|
| 0 | all-npdu-rejected | Network Processor Data Unit rejected for unspecified reason | Router/device doesn't recognize message format | Verify sending device has correct protocol version. Restart router. |
| 1 | inappropriate-network-message | Message type not appropriate for this network | e.g., MS/TP broadcast sent over BACnet/IP only network | Check device configuration. May be using wrong network segment or protocol. |
| 2 | unknown-network-message-type | Router doesn't understand message type | Old device version or proprietary extension | Verify all devices on network have compatible firmware versions. |
| 3 | network-layer-address-translation-failed | Cannot translate network address (e.g., DNACs resolution failed) | Device cannot convert network address to routing path | Check DNS/address resolution settings. Verify network topology configuration. |
| 4 | unknown-device | Target device not found on network | Device offline or never registered | Ping target device IP. Verify device IP and Device ID match configuration. |
| 5 | unsupported-message-in-this-network-type | Message type not supported on this network technology | e.g., MS/TP router receiving BACnet/IP message | Verify message is being sent on correct network segment. May be routing rule mismatch. |
| 6 | too-many-apdu-retries | Application level retried too many times | Network very congested or device very slow | Reduce polling frequency. Investigate network congestion. May indicate need for redundant network. |
| 7 | apdu-timeout | Response not received within expected time | Network latency or device offline | Increase APDU timeout value if possible. Check network performance. Verify device is online. |
| 8 | router-busy | Router cannot forward message immediately | Router overloaded | Wait and retry. Reduce traffic to that router. May need router upgrade. |
| 9 | unknown-route | No route exists to destination network | Device on unreachable network segment | Check network topology and router configuration. Verify BACnet router is powered and configured correctly. |
Abort PDUs indicate the remote device received the request but had to terminate processing due to an error condition it detected. Unlike Reject (network layer), Abort is application-layer and means the device tried but failed.
| Code | Name | Meaning | Scenario | Field Action |
|---|---|---|---|---|
| 0 | other | Undefined abort reason | Device aborted for unspecified reason | Check device logs. May need to restart device or investigate specific error. |
| 1 | buffer-overflow | Device buffer exceeded capacity | Request too large for device to handle | Break request into smaller chunks. Request fewer objects at once. |
| 2 | invalid-apdu-type | Application PDU type not recognized | Malformed or unsupported request format | Verify supervisory system is sending correct request format. Update driver if needed. |
| 3 | preempted-by-higher-priority-task | Device preempted this request due to higher-priority task | Device processing another request and hit priority limit | Retry. Reduce background polling if possible. Device is under heavy load. |
| 4 | segmentation-not-supported | Segmentation required but device doesn't support it | Request is large and requires segmentation; device cannot segment | Reduce request size. Request one object instead of many. Check device capabilities. |
| 5 | security-error | Security processing failed | Encryption mismatch or security policy violation | Verify encryption settings match. Check security keys. Verify firewall allows traffic. |
| 6 | insufficient-security | Request does not meet device's security requirements | Client not authenticated or encryption not enabled when required | Enable required security on client. Verify authentication credentials. |