Can EV chargers be integrated with a building management system?

Yes. The usual approach is to integrate the EV charging controller or CSMS rather than each charger. The BMS reads site EV power, per-phase current, charger status and alarms over Modbus TCP, BACnet (often through a gateway) or MQTT, and may write a site-level cap. The chargers themselves talk OCPP to their management system, and OCPP is not a building automation protocol.

What is the difference between Modbus function codes 03 and 04?

Function code 03 reads holding registers and function code 04 reads input registers. Both return 16-bit registers, and one request can read 1 to 125 contiguous registers. The manufacturer decides which register space carries each measurement; some meters, such as the Algodue UPM209, answer on both. A good register map states the function code for every point.

Why does my Modbus value read as a huge or tiny number?

Usually the word order is wrong. A 32-bit float occupies two 16-bit registers, and devices differ on which register holds the high word. Modbus sends the most significant byte first within a register, but word order across registers is the device's choice. If a 231.4 V reading comes back as about 2.7 × 10²³, swap the words. An off-by-one address produces similar nonsense.

Do EV chargers support BACnet?

Do not assume it: check the datasheet. Where native BACnet is absent, the common route is a gateway that maps Modbus registers from the charging controller or site meter into BACnet objects, such as Analog Inputs for measurements and Analog Values for setpoints. The BMS then reads them over BACnet/IP. Confirm units, scaling and write priorities during commissioning.

Is MQTT a good choice for EV charging data?

MQTT suits telemetry. A device publishes values to a broker once, and any number of systems subscribe. You must agree a topic structure and payload format, because MQTT does not define one. Use TLS (TCP port 8883 is registered for secure MQTT), per-client credentials and topic access rules, and treat any command topic with the same care as a Modbus write.

How do I connect a Modbus RTU meter to a Modbus TCP system?

Use a Modbus TCP-to-RTU gateway. The TCP client reaches each RS-485 device through the unit identifier in the Modbus TCP header, which maps to the device's serial address (1 to 247). Keep within 32 devices per segment unless every device is documented for more, match baud rate and parity on every device, and terminate both ends of the trunk.

Does Nohmad Edge CSMS integrate with a BMS?

Not through a BMS protocol yet. Edge CSMS reads site meters over Modbus TCP, and Shelly Pro 3EM meters over MQTT, and sends alarm webhooks and CSV or REST data out today. A Modbus TCP server that lets a BMS read site state and write caps is on the roadmap, as is MQTT publishing. Edge CSMS does not speak BACnet.

Integration

23 October 2026Nohmad Engineering13 min read

EV charger BMS integration: Modbus, MQTT and BACnet in practice

Integrate EV charging with a building management system by letting the BMS read EV power, per-phase current, charger status and alarms, and at most write a site cap that the on-site charging controller enforces. Modbus TCP is the usual path, BACnet normally needs a gateway, and MQTT suits telemetry.

Last updated 23 October 2026

Key takeaways

Let the BMS supervise and the EV charging controller control: the BMS reads EV load and alarms and may write a site cap, while the fast per-phase loop stays on site, close to the chargers.
OCPP connects chargers to their management system. It is not a BMS protocol, so BMS integration happens one level up, over Modbus TCP, BACnet or MQTT.
Most Modbus faults are addressing and format mistakes: an off-by-one register, the wrong function code or swapped 32-bit word order. Test-read a known value, such as phase voltage, first.
Writable points need more care than readable ones: restrict who can write, range-check and log every write, and define what happens when the BMS stops updating.
Put EV charging, meters and the BMS interface on a segregated OT network with no inbound internet access, read-only by default.

Facility managers want EV charging on the same screen as the chillers and the main switchboard. BMS integrators want a register map, not another cloud login. This guide covers who should be in charge, which protocol carries what, which points to expose and how to keep it secure.

Why integrate EV charging with your BMS?#

Integrating EV charging with a building management system (BMS) puts charging load, charger status and alarms on the same single pane of glass as the rest of the building. The BMS can then count EV load in demand management and energy reports, and charger faults reach the alarm handling the site already staffs.

One pane of glass. Operators already watch the BMS. A separate charging portal is one more screen nobody checks at 2 am.
Demand management. EV charging is a large, flexible load: a car parked for eight hours rarely needs full power for all eight. Many network tariffs bill the highest demand in a window; Ausgrid's capacity charge uses the highest half-hour kVA between 3 pm and 9 pm on working weekdays over the previous 12 months [13]. See our maximum demand guide.
Alarms. A faulted charger or lost meter should alarm where someone will act on it.
Energy reporting. Separate EV energy supports tenant recharging, sustainability reporting and cost allocation.

Who should be in charge: the BMS or the EV controller?#

In most buildings the BMS should supervise and the EV charging controller should control. The BMS reads EV load and alarms and, at most, writes a site or board cap. The controller turns that cap into per-charger, per-phase current limits every few seconds, because it knows each charger's phase wiring, minimum current and response to limits.

Pattern	What the BMS does	Strengths	Watch-outs
1. Monitor only	Reads EV power, status and alarms	Simple; no control risk	Cannot trim EV load during a building-wide event
2. Supervisory cap	Reads, and writes a site or board EV cap the controller enforces	A demand lever for the BMS; fast loop and fail-safes stay local	Needs restricted, logged writes and a fallback if the BMS goes quiet
3. BMS as master	Sets per-charger limits itself, often through an OCPP-to-Modbus gateway	One control system	BMS logic must handle phases, minimum currents and charger quirks in custom code

The per-phase loop belongs close to the chargers. Loads move quickly: when a lift or compressor starts, one phase's headroom shrinks within seconds. The controller knows what the BMS does not, such as each charger's phase, its lowest settable current and whether it accepted its last limit. And a local loop keeps working when the network to the BMS head end does not.

For pattern 2, agree a heartbeat: the BMS increments a counter at a fixed interval, and if it stops, the controller reverts to a local default cap and alarms. In every pattern, load management sits on top of electrical protection, never instead of it. Circuit breakers remain the last line.

Three ways to connect a BMS

Sets each charger's limitArrows show which way data or commands flow

In patterns 1 and 2 the charging controller keeps the fast per-phase loop and the BMS supervises; pattern 2 adds a cap the BMS can write. In pattern 3 the BMS sets every charger's limit itself.

Where does OCPP fit?#

OCPP, the Open Charge Point Protocol, is how a charger talks to its charging station management system (CSMS): authorisation, sessions, meter values and smart-charging limits. It is not a building automation protocol, and a BMS does not normally speak it. BMS integration happens one level up, between the CSMS or load controller and the BMS.

OCPP 1.6 dates from 2015, 2.0.1 from 2020 and 2.1 from 2025; edition 3 of 2.0.1 became IEC 63584 in 2024 [9].

Where the BMS must manage chargers itself (pattern 3), OCPP-to-Modbus gateways exist. HMS's Intesis gateway translates OCPP to Modbus RTU/TCP for up to 20 chargers [10]. Eiffage's gateways offer the BMS as central system, or a bridge mode where an external central system manages the chargers and the BMS monitors [11]. See also what "OCPP compatible" means and OCPP proxy or on-site CSMS.

How does Modbus TCP work for EV charging data?#

Modbus TCP is a request–response protocol: a client, such as the BMS, asks a server, such as a meter, for a block of 16-bit registers. It uses TCP port 502, defines no data types beyond the register, and has no authentication. Success depends on agreeing function codes, addresses, types, scaling and word order up front.

From the Modbus specifications [1]:

Function codes. 03 reads holding registers and 04 reads input registers; 06 and 16 write registers. One read returns 1 to 125 contiguous registers.
Addressing. Registers are numbered from 1 but addressed from 0 on the wire. Manuals mix the two conventions, hence off-by-one errors.
Data types. A register is 16 bits. A 32-bit integer or IEEE 754 float spans two registers.
Word order. Bytes within a register are most significant first, but which register holds a 32-bit value's high word is the device's choice.
Unit identifier. A header byte that routes requests through gateways to serial devices.
Security. Modbus/TCP Security wraps Modbus in TLS on port 802 [2], if both ends support it.

Worked example: reading an Algodue UPM209#

The Algodue UPM209 is a four-module DIN-rail three-phase analyser. The Ethernet version speaks Modbus TCP, and the UPM209RGW kit adds Rogowski coils of 30 to 90 cm, which Algodue notes suit installation on existing plant [3]. Its manual publishes each measurement twice: an integer bank in milli-units and an IEEE float bank in engineering units [4]. Each float spans two registers:

Measurement	Register (hex)	Register (decimal)	Unit
Phase 1–N voltage	0x1000	4096	V
Phase 2–N voltage	0x1002	4098	V
Phase 3–N voltage	0x1004	4100	V
Phase 1 current	0x100E	4110	A
Phase 2 current	0x1010	4112	A
Phase 3 current	0x1012	4114	A
System active power	0x101E	4126	W
Frequency	0x105A	4186	Hz
System imported active energy	0x140C	5132	Wh

Either function code 03 or 04 works. Because 0x1000 to 0x101F are contiguous, one 32-register request returns every voltage, current and power. Values arrive high word first (AB CD): if 0x1000 and 0x1001 return 0x4367 and 0x6666, they decode to 231.4 V. Swap the words and the same data reads about 2.7 × 10²³ V. A wildly wrong magnitude almost always means word order or an off-by-one address.

The integer bank shows why units belong in the register map: phase 1 voltage at 0x0000 is in millivolts, and system power at 0x0024 spans four registers in milliwatts. The UPM309RGW panel analyser [5] and the Eastron SDM630 have their own layouts; never assume one meter's map fits another.

Modbus RTU and gateways#

Many meters use Modbus RTU over RS-485 instead. A serial bus addresses devices 1 to 247, with 32 devices always allowed per segment without a repeater [1]. A TCP-to-RTU gateway bridges the two, using the unit identifier as the serial address. Match baud rate and parity, terminate both ends of the trunk, and remember every extra poller slows a shared bus.

When does MQTT make sense?#

MQTT is a lightweight publish/subscribe protocol: devices publish messages to topics on a broker, and any number of systems subscribe. It suits EV charging telemetry feeding energy analytics, dashboards or an IoT platform, because one publisher serves many consumers without each one polling. It needs agreed topics, payloads and security.

From the MQTT 5.0 standard [6]:

Topics. A documented hierarchy such as site/carpark-b1/ev/power_kw.
Quality of service. QoS 0 is at most once, 1 at least once, 2 exactly once. Make commands absolute ("cap is 80 kW", not "reduce by 10 kW") so a duplicate does no harm.
Retained messages. The broker hands the last message on a topic to new subscribers; useful for state such as the active cap.
Will messages. The broker publishes a client's "will" if it drops unexpectedly: a free "controller offline" signal.
Payloads. MQTT leaves payload format to the application, so document fields, units and timestamps.
Security. Port 1883 is registered for plain MQTT and 8883 for MQTT over TLS [2]. Use TLS, per-client credentials and topic access rules.

MQTT also works inbound: meters such as the Shelly Pro 3EM can publish readings rather than wait to be polled.

Do EV chargers speak BACnet?#

BACnet is the building automation standard maintained by ASHRAE committee SSPC 135 and published as ISO 16484-5 [7], and many BMS platforms are built around it. Native BACnet should not be assumed on EV charging equipment. The common route is a gateway that maps a charging controller's or meter's Modbus registers into BACnet objects.

BACnet models a device as objects: an Analog Input for a measurement such as EV power, an Analog Value for a setpoint such as a site cap, Binary or Multi-state Values for states. Commandable objects carry a 16-level priority array, so agree which priority the BMS writes the cap at and what it relinquishes to.

BACnet/IP uses UDP port 47808 [2] and broadcast discovery, so multi-subnet sites need broadcast management devices (BBMDs). BACnet Secure Connect uses TLS 1.3 over WebSockets without broadcasts [8]. BACnet's FAQ notes Modbus equipment can be reached through a gateway [7]; check its units, scaling, change-of-value increments, write priority and stale-data flags.

What points should an EV charging system expose to a BMS?#

A useful EV charging points list is short: total EV power, per-phase current, headroom on each constrained board, charger counts by state, alarm status, the active cap and who set it and, if the BMS supervises, one writable cap with a heartbeat. Keep per-charger detail in the charging system unless the BMS genuinely needs it.

A generic starting list for your integrator, not a description of any product:

Point	Type and unit	Direction	Purpose
Site incomer power	Float, kW	Read	Demand management
Total EV charging power	Float, kW	Read	EV share of the load
EV current per phase	Float, A	Read	Phase balance
Headroom per constrained board and phase	Float, A	Read	Distance to each limit
Cumulative EV energy	Float or counter, kWh	Read	Energy reporting
Chargers charging, idle, faulted, offline	Integer counts	Read	Status without a point flood
Fail-safe or degraded mode	Boolean	Read	Alarm when control is restricted
Active EV cap and its source	Float plus enumeration	Read	Who is in charge now
Controller heartbeat	Counter	Read	Detect stale data
Site EV cap setpoint	Float, kW or A	Write	Supervisory control (pattern 2)
BMS heartbeat	Counter	Write	Detect a silent BMS
Last cap write: value, time, writer	Record	Read	Accountability

How do you keep the integration secure?#

Treat EV charging as operational technology (OT). Put chargers, meters, the charging controller and the BMS interface on a segregated network with no inbound internet access. Make the BMS connection read-only by default, accept writes only from known hosts, and log every write. Plain Modbus TCP has no authentication, and BACnet/IP is typically deployed without it.

Segment. Give EV charging its own VLAN, with firewall rules that allow only the hosts and ports the points list needs. "Segment and segregate OT from all other networks" is one of six OT principles from the Australian Signals Directorate's ACSC and partners [12].
No inbound internet. The same guidance warns against direct OT-to-internet connections that bypass remote-access security for vendor servicing.
Writes. Enable them only for pattern 2, only from the BMS server, using Modbus/TCP Security or BACnet/SC where both ends support it. Reject caps above a board's rating or below a sensible floor.
Audit and time. Log who wrote what, when, old and new values, and synchronise clocks so trends and logs line up.

Commissioning checklist for EV charging and BMS integration#

Commission a BMS integration like any other control interface. Agree the points list before installation, prove every read against a reference instrument, test every write and its limits, then disconnect things on purpose to prove the failure behaviour. Record the result as an as-built points list that both the integrator and the site keep.

Agree every point's address, function code, type, scale, unit, word order, direction and update rate.
Settle IP addresses, VLAN, firewall rules and which host may write.
Check how many simultaneous Modbus TCP clients each meter accepts.
Test-read phase voltage (about 230 V) to prove addressing and word order first.
Check each phase's current against a clamp meter.
Write a cap; confirm the EV load settles under it, the write is logged and out-of-range values are rejected.
Stop the BMS heartbeat: the controller should revert and alarm. Stop the controller: the BMS should flag stale data.
Disconnect a meter and confirm the alarm reaches the BMS and service desk.
File the as-built points list and firmware versions.

Where Nohmad Edge CSMS fits#

Nohmad Edge CSMS is an on-site EV charging management system: an OCPP 1.6J CSMS and a load-management engine running together on one industrial PC at the site. Today it reads site meters and sends data out by webhook, REST API and CSV. A Modbus TCP server for BMS reads and cap writes is on the roadmap, not built.

Reading the site. Built-in Modbus TCP presets for the Algodue UPM209 (validated against an emulated meter so far) and Eastron SDM630. The UPM309 and other Modbus TCP meters connect through a configurable register map (address, data type, scale, byte order); there is no built-in UPM309 preset. Shelly Pro 3EM meters publish over MQTT into the box's own broker. Meters are polled every second by default; Modbus RTU meters need a Modbus TCP gateway.
Controlling the chargers. Every 10 seconds the engine re-allocates current down the site's electrical tree, giving EVs what is left after the measured non-EV load: per phase where meters and charger phase mappings exist, otherwise on the worst phase. Limits reach chargers through OCPP 1.6J smart charging. Optional incomer demand caps work in kW, not kVA, and need a meter reporting voltage there.
Fail-safe. If a meter goes stale (60 seconds by default), active chargers are set to their configured safe current and a critical alarm is raised.
Data out today. JSON alarm webhooks to a service desk (42 live alarm types), a REST API with self-service API keys (read API documented in OpenAPI) and CSV session exports. It needs no internet connection, and data stays on the box.
On the roadmap. A Modbus TCP server so a BMS or EMS can read site state and write caps (pattern 2), and MQTT publishing of telemetry. Neither exists today.
BACnet. Edge CSMS does not speak BACnet. A BACnet BMS can read the site meter through a gateway; reading Edge's own state that way waits for the Modbus TCP server.

Until then, a BMS can read the incomer meter directly, if the meter accepts a second client, while Edge's alarm webhooks feed a service desk; EV power and charger status are not yet exposed to the BMS. Webhooks go to one HTTPS webhook target.

See Edge CSMS, commercial and industrial sites and the capacity calculator. Integrators and consultants can talk to us. Running a depot? Read fleet depot and workshop charging.

Sources#

Modbus Organization, Modbus specifications: Application Protocol V1.1b3, TCP/IP Implementation Guide V1.0b, Serial Line V1.02, Modbus Security.
IANA, Port Number Registry: 502, 802, 1883, 8883, 47808.
Algodue, UPM209RGW product page and datasheet.
Algodue, UPM209 user manual, edition 2111, Modbus section 4.1.
Algodue, UPM309RGW datasheet.
OASIS, MQTT Version 5.0, 2019.
BACnet Committee, About the BACnet standard and FAQ.
ASHRAE, BACnet Secure Connect white paper, 2019.
Open Charge Alliance, Open Charge Point Protocol.
Automation World, HMS Intesis gateway for EV chargers in Modbus BMSs, December 2020.
Eiffage Energía Sistemas, OCPP-Modbus gateways for EV chargers, October 2021.
Australian Signals Directorate's ACSC, Principles of operational technology cyber security, October 2024.
Australian Energy Regulator, Ausgrid 2025–26 pricing statement of compliance, March 2025.

Frequently asked questions

Can EV chargers be integrated with a building management system?: Yes. The usual approach is to integrate the EV charging controller or CSMS rather than each charger. The BMS reads site EV power, per-phase current, charger status and alarms over Modbus TCP, BACnet (often through a gateway) or MQTT, and may write a site-level cap. The chargers themselves talk OCPP to their management system, and OCPP is not a building automation protocol.
Should the BMS control EV chargers directly?: Usually not. A BMS is good at supervising, trending and alarming, but per-charger, per-phase current control needs a fast loop that knows each charger's phase wiring, minimum current and response to limits. The robust pattern is for the BMS to write a site or board cap that an on-site charging controller enforces, with a defined fallback if the BMS stops updating.
What is the difference between Modbus function codes 03 and 04?: Function code 03 reads holding registers and function code 04 reads input registers. Both return 16-bit registers, and one request can read 1 to 125 contiguous registers. The manufacturer decides which register space carries each measurement; some meters, such as the Algodue UPM209, answer on both. A good register map states the function code for every point.
Why does my Modbus value read as a huge or tiny number?: Usually the word order is wrong. A 32-bit float occupies two 16-bit registers, and devices differ on which register holds the high word. Modbus sends the most significant byte first within a register, but word order across registers is the device's choice. If a 231.4 V reading comes back as about 2.7 × 10²³, swap the words. An off-by-one address produces similar nonsense.
Do EV chargers support BACnet?: Do not assume it: check the datasheet. Where native BACnet is absent, the common route is a gateway that maps Modbus registers from the charging controller or site meter into BACnet objects, such as Analog Inputs for measurements and Analog Values for setpoints. The BMS then reads them over BACnet/IP. Confirm units, scaling and write priorities during commissioning.
Is MQTT a good choice for EV charging data?: MQTT suits telemetry. A device publishes values to a broker once, and any number of systems subscribe. You must agree a topic structure and payload format, because MQTT does not define one. Use TLS (TCP port 8883 is registered for secure MQTT), per-client credentials and topic access rules, and treat any command topic with the same care as a Modbus write.
How do I connect a Modbus RTU meter to a Modbus TCP system?: Use a Modbus TCP-to-RTU gateway. The TCP client reaches each RS-485 device through the unit identifier in the Modbus TCP header, which maps to the device's serial address (1 to 247). Keep within 32 devices per segment unless every device is documented for more, match baud rate and parity on every device, and terminate both ends of the trunk.
Does Nohmad Edge CSMS integrate with a BMS?: Not through a BMS protocol yet. Edge CSMS reads site meters over Modbus TCP, and Shelly Pro 3EM meters over MQTT, and sends alarm webhooks and CSV or REST data out today. A Modbus TCP server that lets a BMS read site state and write caps is on the roadmap, as is MQTT publishing. Edge CSMS does not speak BACnet.