BAS networks, protocols and cybersecurity

When Theo connected the residence's two new walk-in controllers to the network in lesson 6, the freezer appeared on the building automation screens within minutes, but the cooler did not. The controls contractor's technician, Anika, came out the following week to finish the integration, and Raj asked her to let Theo watch. She plugged a small USB adapter into her laptop, clipped onto the network cable, and started reading raw data. "Ninety percent of network problems are wiring and addresses," she said. "The other ten percent are settings that don't match. Protocols sound mysterious, but they're just rules about who talks when."

Controllers in a building automation system exchange data over networks, using agreed rules called protocols. A technician does not need to be a network engineer, but needs to know the common protocols well enough to read a points list, recognize a wiring or addressing fault, and work safely on a system connected to the building's computer network. This lesson covers BACnet, Modbus and other common protocols, the RS-485 wiring most field networks use, and the basics of keeping building systems secure.

Why protocols matter

A protocol defines how devices identify themselves, how data is organized and how one device asks another for a value or tells it to do something. When equipment and controllers use the same open protocol, a building owner can mix manufacturers and choose service companies freely. Proprietary protocols tie the owner to one manufacturer's tools and dealers. Most new commercial systems use BACnet between controllers and the front end, with Modbus common for equipment such as drives, meters, boilers, chillers and refrigeration controllers. Older buildings often have LonWorks or proprietary networks, linked to newer systems through gateways.

BACnet

BACnet is the open protocol developed for building automation and published as ANSI/ASHRAE Standard 135, also adopted internationally as ISO 16484-5; the standard is revised regularly, with a 2024 edition current at the time of writing. BACnet describes every device as a collection of objects. Each object has properties, and devices use services to read and write them.

• Objects: analog input, analog output, analog value, binary input, binary output, binary value, multi-state value, schedule, calendar, trend log, notification class and others. A supply air temperature sensor appears as an analog input object.
• Properties: each object has properties such as its name, present value, units, status flags and, for commandable objects, a priority array.
• Services: who-is and I-am to discover devices, read-property and write-property to get and set values, and change-of-value subscriptions so a device reports when a value changes.
• Device instance: every BACnet device on an internetwork must have a unique device instance number.

Commandable BACnet objects, such as outputs and many values, have a priority array of sixteen levels. A command is written at a priority, and the object's present value is the command at the highest active priority; if none is active, it takes its default, called the relinquish default. Low numbers are high priority, with the top levels reserved for life-safety and critical equipment protection, manual operator commands in the middle and normal program control at lower priorities. This is why the forgotten override in lesson 9 kept the make-up air unit running: it had been written at a manual priority above the schedule's, and the schedule's commands were simply being ignored. Releasing a command means writing a null at the same priority.

BACnet runs over several kinds of network. BACnet/IP uses the building's Ethernet and IP network, normally on UDP port 47808. BACnet MS/TP, master-slave token passing, uses RS-485 wiring between field controllers, with a token passed from device to device so that only one transmits at a time. BACnet Secure Connect, called BACnet/SC, adds encrypted, authenticated connections over IP and was added to the standard to address the security weaknesses of the older data links.

Modbus

Modbus is an older, simpler protocol widely used on equipment. A master, such as a gateway or supervisory controller, polls slave devices by address, and each slave answers with the contents of numbered registers. Modbus RTU runs on RS-485, and Modbus TCP runs on Ethernet, normally on port 502. Modbus has no built-in names or units: register 40012 might be box temperature in tenths of a degree, a setpoint, or an alarm word, and only the manufacturer's register map says which. Values are 16-bit integers, often scaled, and 32-bit values occupy two registers whose order varies between manufacturers. Most Modbus integration errors are register maps read with the wrong offset, the wrong scaling or the wrong word order.

import struct
# Decoding Modbus registers from a walk-in controller (register map values are illustrative)
raw = {1: 0xFF38, 2: 0x0014, 3: 0x0001, 4: 0x41A4, 5: 0x0000, 6: 0x0000, 7: 0x41A4}

def signed16(v):
    return v - 0x10000 if v & 0x8000 else v

box_tenths = signed16(raw[1])                 # box temperature, signed, in tenths of a degree C
print(f"register 1 raw {raw[1]:#06x} -> box temperature {box_tenths / 10:.1f} C, or {box_tenths / 10 * 1.8 + 32:.1f} F")
print(f"register 2 raw {raw[2]} -> setpoint differential {raw[2] / 10:.1f} K, or {raw[2] / 10 * 1.8:.1f} F")
print(f"register 3 raw {raw[3]} -> bit 0 = compressor relay {'on' if raw[3] & 1 else 'off'}")

# a 32-bit float split across two registers: the word order must match the manufacturer's map
hi_lo = struct.unpack('>f', struct.pack('>HH', raw[4], raw[5]))[0]
lo_hi = struct.unpack('>f', struct.pack('>HH', raw[7], raw[6]))[0]
wrong = struct.unpack('>f', struct.pack('>HH', raw[5], raw[4]))[0]
print(f"registers 4-5, high word first: {hi_lo:.2f} (discharge pressure, bar gauge, per this map)")
print(f"registers 6-7, low word first: {lo_hi:.2f}")
print(f"registers 4-5 read in the wrong order: {wrong:.3e}  <- a classic integration error")

register 1 raw 0xff38 -> box temperature -20.0 C, or -4.0 F
register 2 raw 20 -> setpoint differential 2.0 K, or 3.6 F
register 3 raw 1 -> bit 0 = compressor relay on
registers 4-5, high word first: 20.50 (discharge pressure, bar gauge, per this map)
registers 6-7, low word first: 20.50
registers 4-5 read in the wrong order: 2.355e-41  <- a classic integration error

Note that the controller in the example reports in metric units whatever the site's display units; many refrigeration controllers do, and the integrator must convert them. A box temperature that suddenly reads 6,553 degrees is almost always a signed value read as unsigned.

Other protocols

LonWorks, standardized as ISO/IEC 14908, was common in the 1990s and 2000s and remains in many buildings. Manufacturers of thermostats, chillers, rooftop units and refrigeration racks also have proprietary networks, and wireless protocols are increasingly used for sensors and retrofits. Integration between different protocols is done by gateways, which translate points from one protocol to another according to a map that someone has to configure and document. A gateway is a common single point of failure: if it stops, every point behind it goes stale.

RS-485 wiring

Both BACnet MS/TP and Modbus RTU usually run on RS-485, a two-wire differential signal that is robust over long runs if it is installed correctly. Most network faults come from violating a few rules.

• Daisy-chain the devices: the cable runs from one device to the next. Stars, tees and long stubs cause reflections.
• Use the specified cable, normally shielded twisted pair with the impedance the manufacturer specifies, and keep it away from line-voltage wiring and drives.
• Terminate only the two physical ends of the bus, usually with 120-ohm resistors or switches on the end devices, and provide biasing where the system requires it.
• Ground the shield at one point, as the manufacturer specifies, to avoid ground loops.
• Keep polarity consistent: plus to plus and minus to minus, which manufacturers may label A and B inconsistently.
• Respect limits on length and the number of devices on a segment, typically about 4,000 ft and 32 standard unit loads, with repeaters to extend them.
• Give every device a unique address and set every device to the same baud rate and data format.

What was wrong with the cooler controller

Anika's laptop showed the freezer controller answering at address 2 and nothing answering at address 1, where the cooler should have been. Theo had set both controllers' addresses, but when she checked the cooler's menu, its address was 2 as well: he had set it, then a parameter reset during a later probe change had restored the factory default. Two devices with the same address on a Modbus bus answer at the same time and garble each other, which explained why even the freezer's readings had occasional gaps. She also found the cooler's termination switch on, although it was in the middle of the run between the gateway and the freezer. Theo set the cooler to address 1, turned its termination off, left it on only at the gateway and at the freezer at the far end, and the cooler's points filled in on the screen. He added both addresses and the termination positions to the commissioning record.

Cybersecurity basics

Building systems used to sit on their own wires, isolated from the outside world. Today, supervisory controllers and front ends are usually on IP networks, often reachable remotely, and they control equipment that matters: heating in winter, refrigeration that protects food and medicines, and ventilation in health care spaces. Attackers have targeted building systems, sometimes as a route into a company's main network. Government cyber security agencies in both countries, including the Cybersecurity and Infrastructure Security Agency (CISA), publish guidance for operational technology, and the basic practices are well established. A service technician's role is defensive: follow the owner's policies, avoid creating weaknesses, and report what you find.

• Change default passwords on every controller, gateway and front end, and use individual accounts rather than shared logins.
• Never expose a controller or front end directly to the internet by port forwarding; use the owner's approved, secured remote access method, with multi-factor authentication where available.
• Keep building systems on their own segment of the network, separated from office and guest networks by firewalls, as the owner's IT staff direct.
• Apply firmware and software updates according to the manufacturer's and owner's procedures, and replace unsupported operating systems on front ends.
• Disable services and accounts that are not needed, and keep current backups of programs and databases.
• Use only clean, approved laptops and tools on the building's networks, and never install remote access software without the owner's approval.
• Use secure protocol options, such as BACnet/SC, where the system supports them and the owner has chosen them.

At the residence, Anika noticed that the supervisory controller's web page still accepted the manufacturer's default administrator password, and that a router in the maintenance office forwarded a port from the internet straight to it, so that a previous contractor could log in from home. Neither she nor Raj tried to exploit or test it further. Raj explained the risk to Wes in plain terms, and Wes passed it to the residence's IT provider, who removed the port forward the same day, set up the owner's approved remote access and arranged for Anika to change the passwords and create individual accounts.

Network tools and safe practice

Diagnosing a field bus needs only a few tools: a multimeter for voltages, resistance and continuity with power off, the manufacturer's configuration software, and often a USB-to-RS-485 adapter with protocol software that can list devices and read registers or objects. With power off and the bus disconnected from the devices at one end, the resistance between the two signal conductors at the far end should be close to the value of the termination resistors in parallel, about 60 ohms for two 120-ohm resistors; a much lower value suggests a short or extra terminations, and a much higher one a missing termination or an open. On IP networks, use only the ports and addresses the owner's IT staff provide, never scan or probe a building's network without written permission, and record any changes you make to device settings.

Wireless and cloud connections

New equipment increasingly reports through wireless gateways and cloud services instead of hard-wired networks. A walk-in controller may send its temperatures to a manufacturer's portal over a cellular modem, and a rooftop unit may connect to an app over the building's Wi-Fi. These connections are convenient for monitoring and alarms, but they bring the same questions as any network connection: who owns the account, who can change settings remotely, how the device is updated and what happens if the service is discontinued. Record which devices use cloud services, keep the owner informed of the accounts created and follow the owner's IT policies before connecting anything to a building's network.