What B-AACWS Is
A BACnet device profile is a standardized capability level: a checklist of things a device must be able to do before it can wear the label. B-AACWS (BACnet Advanced Access Control Workstation) is the full physical-access-control operator interface, defined in Annex L of ANSI/ASHRAE 135-2024 (clause L.3.1). It enrolls and manages users, credentials, and rights, and it creates, deletes, and configures access points, access zones, access doors, and credential data inputs, targeted at an administrator with the maximum privileges on the access-control system.
The checklist items are BACnet Interoperability Building Blocks (BIBBs), each a named unit of capability such as “can send a read request” (DS-RP-A). B-AACWS is an operator-side (client) profile: it initiates reads, writes, object creation, and device management against other devices, and it receives access-event notifications rather than generating them. A device documents its profile claim in its PICS (Protocol Implementation Conformance Statement); to verify a claim, ask for the PICS and check the profile line.
Where It’s Used
B-AACWS is the access-control administrator seat, running enrollment and configuration for the whole system.
- Security administration workstations. A head end (the central BMS server) console where an administrator enrolls credential holders, assigns rights, and configures doors and readers.
- Access-control commissioning stations. A workstation used at startup to create Access Point, Access Zone, Access Door, and Credential Data Input objects and set alarm routing.
- Integrated security consoles. A supervisory station that presents access events, event logs, and audit records across the access-control system.
Required Services
The table below is the exhaustive service set required by the B-AACWS BIBBs. Initiates means the device sends the request or notification; Executes means the device receives and acts on it (responding, for confirmed services). BIBB codes encode the same split: a -A BIBB is the initiating side, a -B BIBB the executing side. A - means the profile does not require that direction; a device may still support it. A service can appear under two capability areas when two different BIBBs use it.
| Capability area | Service | Required by BIBB | Initiates | Executes |
|---|---|---|---|---|
| Data sharing | ReadProperty | DS-RP-A, DS-RP-B, DS-ACAV-A | Yes | Yes |
| Data sharing | ReadPropertyMultiple | DS-RPM-A | Yes | - |
| Data sharing | WriteProperty | DS-WP-A, DS-ACAM-A | Yes | - |
| Data sharing | WritePropertyMultiple | DS-WPM-A | Yes | - |
| Alarm and event management | ConfirmedEventNotification | AE-N-A, AE-AC-A, AE-ACAVN-A | - | Yes |
| Alarm and event management | UnconfirmedEventNotification | AE-N-A, AE-AC-A, AE-ACAVN-A | - | Yes |
| Alarm and event management | AcknowledgeAlarm | AE-ACK-A, AE-AC-A | Yes | - |
| Alarm and event management | GetEventInformation | AE-AS-A | Yes | - |
| Alarm and event management | GetAlarmSummary | AE-AS-A | Yes | - |
| Alarm and event management | ReadRange (event-log view) | AE-ELVM-A | Yes | - |
| Device and network management | Who-Is | DM-DDB-A, DM-DDB-B | Yes | Yes |
| Device and network management | I-Am | DM-DDB-A, DM-DDB-B | Yes | Yes |
| Device and network management | Who-Has | DM-DOB-B | - | Yes |
| Device and network management | I-Have | DM-DOB-B | Yes | - |
| Device and network management | DeviceCommunicationControl | DM-DCC-A | Yes | - |
| Device and network management | TimeSynchronization | DM-MTS-A | Yes | - |
| Device and network management | UTCTimeSynchronization | DM-MTS-A | Yes | - |
| Device and network management | ReinitializeDevice | DM-RD-A, DM-BR-A | Yes | - |
| Device and network management | CreateObject | DM-OCD-A, DS-ACUC-A, DS-ACSC-A, AE-ACAVM-A, SCHED-AVM-A, AR-AVM-A | Yes | - |
| Device and network management | DeleteObject | DM-OCD-A, DS-ACUC-A, DS-ACSC-A, AE-ACAVM-A, SCHED-AVM-A, AR-AVM-A | Yes | - |
| Device and network management | AtomicReadFile (backup) | DM-BR-A | Yes | - |
| Device and network management | AtomicWriteFile (restore) | DM-BR-A | Yes | - |
| Audit reporting | AuditLogQuery | AR-AVM-A | Yes | - |
The view, modify, and configuration BIBBs add no wire service beyond the rows above. DS-ACAV-A (Access Control Advanced View) and DS-ACAM-A (Access Control Advanced Modify) read and write access-object properties; DS-ACUC-A (User Configuration) and DS-ACSC-A (Site Configuration) create, delete, read, and write the access-object family; AE-ACAVM-A and AE-ELVM-A adjust access-event parameters and event-log settings; SCHED-AVM-A views and modifies schedules and calendars; AR-AVM-A and DM-ADM-A configure audit reporting and enumerate objects; DM-ANM-A adjusts alarm routing by writing Notification Class recipient lists. Each is carried by the ReadProperty, WriteProperty, ReadRange, CreateObject, and DeleteObject rows above.
Related Profiles
| Profile | How it differs from B-AACWS |
|---|---|
| B-ACWS | Access Control Workstation: one step down. Manages users, credentials, and rights, but not the door and reader (site) object set, and no audit reporting |
| B-ACSD | Access Control Security Display: the monitoring display. Handles events and minimal configuration, no object creation |
| B-AACC | Advanced Access Control Controller: the device side. It generates the access events a B-AACWS handles and hosts the access objects it configures |
What Chipkin Provides
B-AACWS is an operator-side profile: its initiating and notification-receiving behavior is implemented in Chipkin’s BACnet test tooling rather than the shipping device stack, which targets the server-side profiles. Talk to us about building or integrating a B-AACWS operator interface.