How Can W5500 Give Eight Relays and Inputs a BACnet Management Interface?

Eight Inputs and Eight Relay Commands on a Building Network

JimBoHa's BACnet/IP firmware turns the Waveshare ESP32-S3-POE-ETH-8DI-8RO-C into an Ethernet-connected building-control node. The replacement application exposes eight digital inputs, eight relay commands and device health as BACnet objects. An ESP32-S3 runs the control and protocol software, while the onboard W5500 connects the controller to the Ethernet network.

The Waveshare board itself is a commercial product sold with a factory application; JimBoHa's project replaces that application entirely. The independent GitHub repository appeared on 31 August 2026, reached firmware 0.13.2 on 5 September, published release 1.0.0 on 8 September and 1.1.0 on 9 September, followed by a 1.1.4-dev prerelease on 12 September 2026. JimBoHa publishes the application, build configuration, a browser installer, commissioning tools and a detailed account of target-board testing. The project is useful to developers who want to study both a BACnet device and the management functions surrounding it.

Target hardware photograph: Waveshare. JimBoHa supplies replacement firmware for this PoE model.

BACnet is a communication standard for building automation and control. A BACnet object gives a physical or logical point a recognizable identity, properties and access rules. A supervisor can discover a controller, read an input or command a relay through those objects instead of learning a private register map for every device.

From an Ethernet Packet to an I/O Point

The supported controller contains an ESP32-S3-WROOM-1U-N16R8, with 16 MB flash and 8 MB PSRAM, plus the W5500 and a TCA9554 I/O expander. The firmware targets the exact -C PoE variant. Its onboard CAN interface is outside the current application.

The W5500 communicates with the processor over SPI, a short local serial bus, at 20 MHz. The pin map uses MOSI13, MISO14, clock15, chip-select16, interrupt12 and reset39. ESP-IDF's Ethernet driver passes frames into the processor's lwIP network stack; the BACnet application receives UDP datagrams on port 47808 by default. The firmware derives and programs a stable, locally administered Ethernet MAC address from the ESP32 identity.

System diagram based on the published Ethernet, BACnet and hardware I/O source files.

Digital inputs arrive on GPIO4 through GPIO11. The firmware samples them every 20 ms and accepts a changed state after three matching samples, reducing the effect of a brief contact bounce. Relay commands take a different path: the processor writes an eight-bit output mask to the TCA9554 at I2C address 0x20.

The BACnet model contains 28 objects. Alongside the eight Binary Inputs and eight Binary Outputs, health objects report Ethernet link, address assignment, relay-controller and RTC availability. Other properties expose uptime, memory and restart information. The controller can therefore report whether it is reachable and whether important local peripherals are responding, as well as its process I/O.

Who Controls a Relay When Commands Compete?

A relay may receive commands from a supervisory application and the local management page. BACnet's priority array gives those commands an explicit order. Each output has 16 slots; the lowest numbered active slot determines the effective command. Releasing a slot lets the next active command take effect.

The browser interface follows the same path as BACnet writes, using priority 8 by default. A web command does not bypass the protocol's arbitration. The firmware rejects reserved priority 6 and validates output values before changing the array.

Illustrative command sequence: releasing priority 8 restores the remaining priority 16 request.

For example, an OFF request at priority 16 can remain in place while an ON request at priority 8 takes temporary control. Relinquishing priority 8 reveals the lower-priority OFF request again. This behavior lets an operator make a temporary intervention without erasing another controller's intended state.

Startup has its own deliberate sequence. The firmware clears the expander's output latch before configuring its pins as outputs. Restoring saved relay states is an optional policy and starts disabled. A Binary Output reports the commanded relay state; mechanical contact feedback still requires a separate measurement.

A Small Receive Queue Explained a Discovery Failure

BACnet discovery uses a Who-Is request and an I-Am response. A quiet network can make discovery look reliable even when a controller struggles with several requests arriving together. JimBoHa's earlier diagnostic soak exposed an occasional missed response while another client generated unusually heavy traffic.

The 5 September update increased the UDP receive mailbox from 6 to 32 datagrams. The mailbox is the host software queue that holds incoming datagrams until the application reads them. Espressif's network configuration documentation explains that a full mailbox causes lwIP to drop incoming packets. Queue capacity therefore matters even when the cable and Ethernet controller remain healthy.

The maintainer's development and validation record records 320 responses to 320 requests, sent as ten bursts of 32 simultaneous directed Who-Is queries after that change. Further burst characterization then showed an exact 32-response ceiling, so firmware 0.13.5 on 7 September raised the mailbox to 64 datagrams, the maximum ESP-IDF 5.5.4 supports, and made the build fail if an old configuration compiles a smaller queue. The running capacity is now reported in the status page.

The same record states that a strict 24-hour soak of v0.13.5 passed between 7 and 8 September 2026 UTC: all 1,441 one-minute samples over 86,400 seconds completed with zero request failures, zero health alerts and zero restarts. JimBoHa notes that this result belongs to v0.13.5 and that a later version needs its own run to claim endurance. These are the maintainer's bench results for a defined test sequence.

The engineering lesson is practical: a missing BACnet reply can originate in the host's receive queue rather than in the cable or the W5500.

From Prerelease to Release 1.1: Installer and Automatic Device Instance

Release 1.0.0 added a browser-based USB installer for desktop Chrome or Edge. A technician connects the board with a USB-C data cable, saves a full recovery backup of the factory image, flashes the recommended firmware, downloads the private admin key and opens the controller's discovered Ethernet address. No command line or development tools are needed for that path.

Original installer screenshot: JimBoHa, 0BSD. The project publishes screenshots with private data removed.

Release 1.1.0 solves a commissioning problem that appears as soon as several identical controllers join one network. Every BACnet device needs a unique Device instance number. The firmware now picks an unused number in the 599000 to 599999 range on first start, saves it and locks it immediately, so power cycles, DHCP changes and later duplicates do not move a controller that a building automation system has already mapped. JimBoHa also records a read-only check against an existing Metasys NAE 9.0.5 mapping, the supervisory platform from Johnson Controls: all eight Binary Outputs held confirmed change-of-value subscriptions and the inspected points matched the controller. That check covers reads and subscriptions, not command generation or physical contacts.

The 1.1.4-dev prerelease of 12 September adds recovery for confirmed change-of-value delivery after transaction exhaustion, relay-driver recovery that re-verifies the TCA9554 latch, and validated network time with BACnet restart diagnostics. JimBoHa labels it a prerelease, not accepted field behavior.

Commissioning and Updating Through the Browser

The embedded management page provides I/O, status, configuration and firmware-update views. Read-only status endpoints need no key. Commands, saved configuration, reboot and firmware uploads require a message signature generated with the device's admin key. The first-boot key is obtained through USB serial.

Original management interface, rendered offline from source. No live controller readings are shown.

The signature scheme uses HMAC-SHA256 with fresh challenges. Ethernet firmware updates also check the image hash, ESP image structure and project identity before switching application slots. Two 6 MiB update slots provide room for the active and replacement application, with rollback support.

The web transport is ordinary HTTP, and BACnet/IP itself is unauthenticated, so this version belongs on a trusted automation network. The author still lists physical input stimulation, relay-contact measurements, discovery and point import from ALC and Niagara/Tridium workstations, and a version-specific endurance run for 1.1 as remaining field gates. The firmware is not BTL tested or listed, and the README says so directly.

Reproducing the Firmware and Reading Further

Source builds use ESP-IDF 5.5.4 and a pinned bacnet-stack 1.6.0 dependency. The repository includes host tests, target-board acceptance tools and a packaging script for initial and update images. For version 1.1.0 the maintainer reports 56 non-actuating hardware-in-the-loop checks, 45 Python tests, 23 Node tests and 22 Chromium interaction tests.

The project code moved to the 0BSD licence on 7 September 2026, which allows reuse without an attribution requirement. The repository also publishes an AGENTS.md file and a Codex CLI workflow document describing how the firmware is developed with an AI coding agent, including the rule that live-device control stays with one coordinator.

Related WIZnet Maker Projects

ESP32-S3-POE-ETH-8DI-8DO on WIZnet Maker introduces the sister Waveshare board as a commercial product, and ESP32-S3-ETH-8DI-8RO covers the relay variant. Both describe the hardware as sold. JimBoHa's firmware shows what a third-party developer built on top of that same W5500 board family once the factory application was replaced.

BACnet Field Controller on WIZnet Maker is the closest earlier project: separate BACnet firmware for the 8DI-8DO transistor-output variant of the Waveshare board. JimBoHa's project targets the 8DI-8RO-C relay variant and adds the priority-array web path, signed Ethernet updates, a browser installer, automatic instance locking and a published 24-hour soak.

BACnetLight on WIZnet Maker explores BACnet in a lighting-oriented project.

FAQ

Q. Which board does this firmware target? The ESP32-S3-POE-ETH-8DI-8RO-C with the N16R8 module, W5500 and TCA9554. Check the exact model and revision before attempting a build or flash.

Q. What does the W5500 do in this project? It provides the Ethernet frame interface between the cable and the ESP32-S3. ESP-IDF, lwIP and bacnet-stack implement the host networking and BACnet application.

Q. Can the browser override a BACnet relay command? Browser commands enter the same priority array, at priority 8 by default. Their effect depends on any higher-priority command already present.

Q. Are relay states restored automatically after reboot? Restoration is disabled by default. The firmware clears the relay outputs during startup before applying any explicitly enabled restore policy.

Q. Is the controller ready for an unattended building installation? Not yet by the author's own checklist. Firmware 0.13.5 passed a strict 24-hour soak and 1.1.0 was read against an existing Metasys mapping, but physical I/O measurement, ALC and Niagara checks and a 1.1 endurance run remain open, and the firmware is not BTL listed.

Q. How is the firmware installed without development tools? Since release 1.0.0 a browser installer flashes the board over USB-C from desktop Chrome or Edge, saves a recovery backup of the factory image and hands over the private admin key used for signed commands and Ethernet updates.