Free Forever — No License Required

BSC-1000
Free BACnet Controller

A full-featured BACnet controller that runs as a virtual appliance on any hypervisor or as a native controller on any Linux single-board computer with auto-detected physical I/O. Multi-protocol integration—BACnet/IP, BACnet/SC, Modbus TCP, Modbus RTU, MQTT, HTTP/REST, and OPC UA—plus a built-in OPC UA server for SCADA systems.

Download GitHub
228/228
BACnet Conformance
20K
Objects on 1 GB RAM
7
Protocols Supported
Capabilities
Everything You Need in a Controller

Write control programs in Python, integrate multiple protocols, and manage everything from a modern web interface.

Python Programming

18 HVAC classes, 23 program templates, built-in linter, hot-reload. Import from PPCL, Plain English, GCL+, Control Basic, and XML.

Multi-Protocol

7 protocols: BACnet/IP, BACnet/SC, Modbus TCP, Modbus RTU, MQTT, HTTP/REST, OPC UA. Built-in OPC UA server for SCADA integration. App Builder with auto-discovery for all protocols.

Production Ready

228/228 BACnet conformance tests. 20,000 objects on 1 GB RAM. 11-hour stability test with zero crashes. Penetration tested with all findings fixed. Trend logging, scheduling, alarm management, and email notifications included.

Security

MFA with TOTP and FIDO2/WebAuthn hardware keys. Role-based access control, login alerts, rate limiting, TLS 1.2+ with custom CA, and API key auth. BACnet/SC (Secure Connect) with TLS 1.3, mutual X.509 certificate authentication, and Direct Connect for encrypted peer-to-peer BACnet communication. Full pen test completed — security headers, timing-safe auth, secret masking.

Graphics & UI

SVG equipment graphics with live BACnet binding. 8 pre-built HVAC templates. Viewer tokens for lobby displays. Dark-theme dashboard with trend charts.

Management

Web UI, 35+ REST API endpoints, and 37 MCP integration tools. SSH management console with interactive CLI, tab completion, and network diagnostics. Session tracking, audit trails, user management.

Download
Choose Your Platform

Import the virtual appliance into your hypervisor, set the network to bridged, and you have a working BACnet controller in under 5 minutes.

OVA

VMware ESXi · vSphere · VirtualBox
~900 MB

VHD

Microsoft Hyper-V
~870 MB

qcow2

Proxmox VE · KVM · libvirt
~950 MB

Docker

Raspberry Pi · Linux SBC · Any Linux
docker pull

Up and Running in 5 Minutes

1

Download

Choose OVA, VHD, or qcow2 for your hypervisor

2

Import

Deploy the virtual appliance in your hypervisor

3

Bridge Network

Set the VM network adapter to Bridged mode

4

Connect

Browse to https://<vm-ip> and start building

Or run with Docker:

docker run -d --name bacsync-controller --network host \
  -v bacsync-data:/app/data \
  -v bacsync-programs:/app/programs/user \
  ghcr.io/humber-horizons-limited/bsc-1000:latest
Editions
Community vs Professional
Feature Community (Free) Professional
BACnet Objects Unlimited Unlimited
Control Programs 3 Unlimited
Trend Logs 3 Unlimited
Schedules 5 Unlimited
Alarms (on-screen) ✓ ✓
Alarm Email Notifications — ✓
Login Alerts & Test Email ✓ ✓
Web UI, REST API & MCP Tools ✓ ✓
App Builder (6 protocols) 1 app / 10 points Unlimited
MQTT Bridge (Publish All to Broker) — ✓
Modbus TCP Server (Expose Registers) — ✓
Custom Graphics 1 page Unlimited
Viewer Tokens (Shareable Displays) — ✓
SSH Console & Network Diagnostics Read-only Full access
BACnet/IP + BBMD + HTTPS ✓ ✓
OPC UA Server (SCADA Integration) Read-only Read + Write
BACnet/SC (Secure Connect) & MS/TP — ✓
Multi-User & RBAC 1 admin Unlimited
Priority Support — ✓

The Community Edition is free forever — no trial period, no time limit, no license file required. Unlimited BACnet objects out of the box.

Testing & Conformance
Tested Like Production Infrastructure

Comprehensive protocol conformance, stress testing, multi-hour stability runs, and security audits—not just unit tests.

228/228
Conformance Tests
0 failures, 0 skipped
20,000
Objects on 1 GB RAM
99.99% success rate
11 hrs
Stability Test
6 controllers, 0 crashes
14/14
Pen Test Findings Fixed
OWASP, API, TLS, auth

BACnet Conformance (228 Tests)

  • Protocol Revision 22 (ASHRAE 135-2020)
  • Device object: Who-Is/I-Am discovery, 20 required properties
  • 11 object types: AI, AO, AV, BI, BO, BV, MSV, TrendLog, Schedule, Calendar, NotificationClass
  • ReadProperty, ReadPropertyMultiple, WriteProperty, WritePropertyMultiple
  • SubscribeCOV (confirmed & unconfirmed), ReadRange for trend logs
  • Priority arrays & commandable output validation
  • APDU segmentation (tested with 1,040+ objects in single response)
  • CreateObject, DeleteObject, DeviceCommunicationControl, ReinitializeDevice
  • BBMD registration and forwarding behavior
  • 15 protocol fuzz scenarios: truncated APDUs, malformed encodings, invalid tags
  • Binary value enforcement: only 0 (inactive) or 1 (active) accepted
  • Read-only device property write rejection audit

Stress & Load Testing

  • 20,000 BACnet objects on 1 GB RAM (99.99% success)
  • 100 concurrent control programs (light, medium, heavy, fast tiers)
  • 50 concurrent MCP tool sessions: 100% success, <35ms response
  • Cross-controller discovery: 5 controllers, 20/20 success (100%)
  • Combined load: 1,500 objects + 30 programs + 6 users — 0 errors
  • 702 UI requests during combined load, 100% success rate
  • API response under 20K objects: 86ms list, 8ms status
  • P95 response time under combined load: 23ms
  • Who-Is flood: 100 rapid requests, 99–100% response rate

Stability Testing

  • 11-hour continuous run across 6 controllers simultaneously
  • 465 objects, 36 programs running with 5–60 second scan intervals
  • HVAC workloads: AHU, boiler plant, chiller plant, VAV zones, building services
  • Zero crashes, zero errors, zero program execution failures
  • MCP response stable at 3–5ms throughout entire test
  • Resource usage: ~1% CPU, ~49 MB RAM per controller
  • Canary value monitoring confirmed continuous program execution
  • 94% data persistence after unexpected power loss

Security Testing

  • Full penetration test: 14 findings identified and remediated across HTTPS, MCP, TLS, and auth
  • Security headers on all responses: CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy
  • Timing-safe authentication: bcrypt with constant-time comparison prevents username enumeration
  • Secret masking: API never returns passwords or tokens in plaintext
  • Program sandbox: all classic Python escape vectors blocked (AST + runtime)
  • Infinite loop protection with AST analysis + runtime timeout, auto-disables program
  • Session flooding resistance: rapid login attacks blocked, 0 unauthorized sessions created
  • TLS 1.2+ enforced, TLS 1.0/1.1 rejected at handshake

OPC UA Server Testing (60+ Tests)

  • Full node browsing: all BACnet object types visible as UA Variable nodes
  • SCADA read/write interoperability with subscription-based monitoring
  • 500-node bulk sync: all values correct, subscribe in 0.38s
  • Dynamic object sync: objects created/deleted via BACnet appear/disappear in OPC UA within 3s
  • Edge case validation: NaN/Inf rejection, integer clamping, out-of-range protection
  • 20 concurrent SCADA client connections with zero data loss
  • SourceTimestamp on every DataValue for historian compatibility
  • Community Edition read-only enforcement validated from SCADA client
Test Phase Tests Coverage Result
Phase 0 — Core BACnet 89 Device object, 7 object types, services, segmentation, priority arrays, error handling, uniqueness 89 PASS
Phase 1 — B-ASC BIBBs 77 WritePropertyMultiple, SubscribeCOV, ReadRange, BBMD, TimeSynchronization, DeviceCommunicationControl, ReinitializeDevice 77 PASS
Phase 2 — Extended Services 31 CreateObject/DeleteObject, password validation, property-list completeness, array indexing, GetEventInformation, MSV-specific, confirmed COV 31 PASS
Phase 3 — Protocol Hardening 31 APDU length enforcement, binary value validation, 15 protocol fuzz scenarios (truncated APDUs, malformed encodings, invalid tags) 31 PASS
OPC UA Server 60+ Node browsing, read/write interop, subscriptions, 500-node bulk sync, dynamic object tracking, edge cases, concurrent clients ALL PASS

Full conformance documentation available on request — contact us.

Get Started

Ready to Try It?

Download the BSC-1000, deploy it in 5 minutes, and see what a free BACnet controller can do.

Download Now GitHub Contact Us