Wiznet makers

Eight Inputs and Eight Relay Commands on a Building Network

JimBoHa's BACnet/IP firmware turns the Waveshare ESP32-S3-POE-ETH-8DI-8RO-C into an Ethernet-connected building-control node. The replacement application exposes eight digital inputs, eight relay commands and device health as BACnet objects. An ESP32-S3 runs the control and protocol software, while the onboard W5500 connects the controller to the Ethernet network.

The independent GitHub project appeared on 31 August 2026 and reached firmware 0.13.2 with substantive fixes on 5 September. JimBoHa publishes the application, build configuration, commissioning tools and a detailed account of target-board testing. The project is useful to developers who want to study both a BACnet device and the management functions surrounding it.

Target hardware photograph: Waveshare. JimBoHa supplies replacement firmware for this PoE model.

BACnet is a communication standard for building automation and control. A BACnet object gives a physical or logical point a recognizable identity, properties and access rules. A supervisor can discover a controller, read an input or command a relay through those objects instead of learning a private register map for every device.

From an Ethernet Packet to an I/O Point

The supported controller contains an ESP32-S3-WROOM-1U-N16R8, with 16 MB flash and 8 MB PSRAM, plus the W5500 and a TCA9554 I/O expander. The firmware targets the exact -C PoE variant. Its onboard CAN interface is outside the current application.

The W5500 communicates with the processor over SPI, a short local serial bus, at 20 MHz. The pin map uses MOSI13, MISO14, clock15, chip-select16, interrupt12 and reset39. ESP-IDF's Ethernet driver passes frames into the processor's lwIP network stack; the BACnet application receives UDP datagrams on port 47808 by default. The firmware derives and programs a stable, locally administered Ethernet MAC address from the ESP32 identity.

System diagram based on the published Ethernet, BACnet and hardware I/O source files.

Digital inputs arrive on GPIO4 through GPIO11. The firmware samples them every 20 ms and accepts a changed state after three matching samples, reducing the effect of a brief contact bounce. Relay commands take a different path: the processor writes an eight-bit output mask to the TCA9554 at I2C address 0x20.

The BACnet model contains 28 objects. Alongside the eight Binary Inputs and eight Binary Outputs, health objects report Ethernet link, address assignment, relay-controller and RTC availability. Other properties expose uptime, memory and restart information. The controller can therefore report whether it is reachable and whether important local peripherals are responding, as well as its process I/O.

Who Controls a Relay When Commands Compete?

A relay may receive commands from a supervisory application and the local management page. BACnet's priority array gives those commands an explicit order. Each output has 16 slots; the lowest numbered active slot determines the effective command. Releasing a slot lets the next active command take effect.

The browser interface follows the same path as BACnet writes, using priority 8 by default. A web command does not bypass the protocol's arbitration. The firmware rejects reserved priority 6 and validates output values before changing the array.

Illustrative command sequence: releasing priority 8 restores the remaining priority 16 request.

For example, an OFF request at priority 16 can remain in place while an ON request at priority 8 takes temporary control. Relinquishing priority 8 reveals the lower-priority OFF request again. This behavior lets an operator make a temporary intervention without erasing another controller's intended state.

Startup has its own deliberate sequence. The firmware clears the expander's output latch before configuring its pins as outputs. Restoring saved relay states is an optional policy and starts disabled. A Binary Output reports the commanded relay state; mechanical contact feedback still requires a separate measurement.

A Small Receive Queue Explained a Discovery Failure

BACnet discovery uses a Who-Is request and an I-Am response. A quiet network can make discovery look reliable even when a controller struggles with several requests arriving together. JimBoHa's earlier diagnostic soak exposed an occasional missed response while another client generated unusually heavy traffic.

The September update increased the UDP receive mailbox from 6 to 32 datagrams. The mailbox is the host software queue that holds incoming datagrams until the application reads them. Espressif's network configuration documentation explains that a full mailbox causes lwIP to drop incoming packets. Queue capacity therefore matters even when the cable and Ethernet controller remain healthy.

The maintainer's 5 September test report records 320 responses to 320 requests, sent as ten bursts of 32 simultaneous directed Who-Is queries after the change. The same validation cycle included two 93-check target-board runs, an additional upstream BACnet client and recovery after 2,011 malformed frames. These are the maintainer's bench results for a defined test sequence.

The engineering lesson is practical: a missing protocol reply can originate in the application's receive queue. The W5500, the host network stack and the BACnet processing task must be considered together when diagnosing a burst-related fault.

Commissioning and Updating Through the Browser

The embedded management page provides I/O, status, configuration and firmware-update views. Read-only status endpoints need no key. Commands, saved configuration, reboot and firmware uploads require a message signature generated with the device's admin key. The first-boot key is obtained through USB serial.

Original Apache-2.0 management interface, rendered offline from source. No live controller readings are shown.

The signature scheme uses HMAC-SHA256 with fresh challenges. Ethernet firmware updates also check the image hash, ESP image structure and project identity before switching application slots. Two 6 MiB update slots provide room for the active and replacement application, with rollback support.

The web transport is ordinary HTTP, and BACnet/IP itself is unauthenticated, so this version belongs on a trusted automation network. The author also lists physical input stimulation, relay-contact measurements, representative commercial building supervisors and a strict 24-hour endurance run as remaining field gates. The current firmware is a documented bring-up platform and is not BTL tested or listed.

Reproducing the Firmware and Reading Further

Source builds use ESP-IDF 5.5.4 and a pinned bacnet-stack 1.6.0 dependency. The repository includes host tests, target-board acceptance tools and a packaging script for initial and update images. The published host suite passed 30 tests during this article's preparation; no firmware was flashed or physical outputs operated for that check.

For a complementary use of the protocol, BACnetLight on WIZnet Maker explores BACnet in a lighting-oriented project. JimBoHa's controller adds a useful reading path for priority-aware relay commands, device health and Ethernet management around a fixed eight-channel I/O board.

FAQ

Q. Which board does this firmware target? The ESP32-S3-POE-ETH-8DI-8RO-C with the N16R8 module, W5500 and TCA9554. Check the exact model and revision before attempting a build or flash.

Q. What does the W5500 do in this project? It provides the Ethernet frame interface between the cable and the ESP32-S3. ESP-IDF, lwIP and bacnet-stack implement the host networking and BACnet application.

Q. Can the browser override a BACnet relay command? Browser commands enter the same priority array, at priority 8 by default. Their effect depends on any higher-priority command already present.

Q. Are relay states restored automatically after reboot? Restoration is disabled by default. The firmware clears the relay outputs during startup before applying any explicitly enabled restore policy.

Q. Is the controller ready for an unattended building installation? Physical I/O verification, commercial-supervisor interoperability and the strict endurance run remain on the author's field checklist. The public release documents bench acceptance rather than a completed field qualification.