Do’s and Don’ts of BACnet/IP

As IoT and AI rapidly become key elements of building automation systems, and BAS become fully integrated across VLANs, WANs, cloud servers, and data lakes, building automation is now deeply intertwined with IT network structures. The evolution from MS/TP to IP controllers introduces a new dynamic between BAS and IT, resulting in one of the most interesting challenges facing projects today. This includes the introduction of BACnet/SC.

The main benefits of BACnet/IP lie in vastly increased data communication speed, ease of scalability, and ability to troubleshoot errors efficiently. While the benefits of BACnet/IP outweigh the risks, they need to be balanced with the security concerns of IT. Let’s take a look at some Do’s and Don’ts of BACnet/IP in BAS design and implementation.

1. Start discussions between the BAS contractor and IT group very early in a project and strictly adhere to the customer’s desires in network infrastructure and security

Different customers have different requirements and expectations of network security: some are happy to provide IP addresses on their in-house business networks and allow the BAS contractor to provide their own network switches, where others want the BAS system to be entirely separate from the in-house networks for security purposes.

These all have impacts on what devices are provided, where they are installed, and how the network is physically laid out. Because there is massive flexibility in how IP networks can be constructed, it is important that everyone is on the same page, ensuring that there are no security issues on the customer’s end and no network communications issues on the BAS end.

2. Consider installation for communications integrity and redundancy

Ring topologies, where a set of controllers are connected via CAT6 cables in a loop back to a managed ethernet switch, provide network redundancy in the event that the network wiring is cut, damaged, or a controller is removed entirely. Early discussions during the design phase of a project will ensure you have the most robust system.

3. Cybersecurity, Cybersecurity, Cybersecurity!!!

This is a vast subject unto itself and is a vitally important risk element of specifying an IP-based building automation system. The inherent cybersecurity projections of the BAS under consideration must be investigated, and specified in detail in division 23 & 25 specifications, including the use of BACnet/SC. Look for a future BIoT Buzz posting on this topic.

1. Don’t install controllers beyond their maximum allowable distance

Installation of BACnet/IP controllers, while more flexible in many regards, has distance limitations compared to serial communications. Ethernet runs are not recommended to extend beyond 300 meters. This can be avoided with clever network layout or remedied with fiber-to-ethernet media converters, but it’s a design consideration that wasn’t previously much of a concern with serial communications.

2. Don’t forget network (CAT6) cabling and network switches in your system design

BAS hardware that is based on BACnet/IP networks, whereby the client mandates a dedicated CAT6 network and associated network switches for the BAS, will require the BAS vendor to include the costs of network wiring and network switches in their pricing and scope of work. Additionally, the network switches must be selected based on the desired network topology — daisy chain, star, hybrid, or ring. Network switches must be specified based on the desired network topology of design to eliminate surprises during the subsequent construction phase.

3. Utilize isolation routers

Make sure your BAS provider includes isolation routers such as the Automated Logic OFISO-E2, in order to isolate the building automation network from the broader customer network. This creates a robust security layer (firewall) designed to significantly reduce the risk of unauthorized access and mitigate various cyber threats.

BACnet-IP controllers are particularly ideal in any new construction where network topology can be built from the ground up. However, BACnet/IP also has advantages for BAS retrofits, where existing IT and network infrastructure can be utilized.

BACnet-IP controllers are also advantageous in small applications. A smaller single system added to a new building can be controlled with just an IP-based controller, compared to the previous configuration that included an IP-based router that then connected via BACnet/ARCnet or BACnet/MSTP to an equipment controller.

Implementing BACnet-IP and BACnet/SC-based controllers takes careful research, thought and planning. Expertise with IP network topology, routers, switches, cabling, and cybersecurity are absolutely essential to ensure maximum client benefit, preventing cyber-attacks, and eliminating vulnerabilities. Utilizing a BAS vendor who specializes in BAS, but also has the requisite network and cybersecurity expertise, will ensure the best long-term outcomes.