Building Automation

What is building automation?

Building automation is the automatic measurement, control, supervision and optimisation of a building’s technical installations, such as heating, ventilation, cooling, lighting, sun shading and access, using sensors, controllers and a central management system. Standards and European regulations call this BACS (building automation and control systems) or GACS. The aim is a healthy and comfortable indoor climate using as little energy as possible, and a facility manager who sees faults before occupants notice them. Because these systems are increasingly connected to the office network and the cloud, building automation is a full part of OT and of OT convergence.

🧠 What does a building automation system do?

A building automation system takes routine decisions off people’s hands: it turns down ventilation in an empty meeting room, dims lighting when there is enough daylight and switches off heating outside office hours. Typical functions include:

At its core is always a closed control loop: a sensor measures, a controller compares the measurement with the setpoint, and an actuator such as a valve, fan or dimmer corrects it, often using a PID algorithm. The HVAC installation is usually the largest and most energy-intensive part of the system.

🔧 What layers make up building automation?

Building automation is commonly divided into three layers, a model that also appears in the ISO 16484 series of standards and maps well onto the Purdue Model used in industry:

So the BMS is not the same thing as building automation, but its top layer: the software the facility manager uses to oversee the whole building. The control loops themselves run in controllers at the automation level and keep working if the BMS server fails. That separation is also a design principle: critical functions must not depend on the network above them.

🔗 Which protocols are used in building automation?

Building automation has its own family of open protocols, each with its own speciality. A single building often uses three or four at once, connected through gateways.

BACnet is the leading standard at management level; BACnet/IP uses UDP port 47808 by default. Classic BACnet, KNX, LON and Modbus were designed for closed networks and offer little or no authentication and encryption. The secured variants are BACnet Secure Connect (BACnet/SC, with TLS and certificates) and KNX Secure (AES-128), which consists of KNX IP Secure and KNX Data Secure.

🏭 Where is building automation used?

Building automation is found in almost every large building, but its importance varies greatly between environments:

• Offices and schools - comfort and energy savings, with time schedules and presence detection
• Hospitals - air handling for operating theatres, pressure control in isolation rooms and emergency power
• Data centres - cooling and power supply, where an outage directly hits IT services
• Production sites - climate in cleanrooms, warehouses and server rooms, often linked to SCADA and MES
• Public buildings and tunnels - ventilation, lighting and fire protection with a public safety function

In hospitals, data centres and industry, a failure in the building system affects safety or the primary service. The system then belongs to the organisation’s critical infrastructure and deserves the same attention as a production line.

📜 Which laws and standards apply to building automation?

In the Netherlands, building automation is no longer optional. The European Energy Performance of Buildings Directive (EPBD, most recently recast as Directive (EU) 2024/1275) has been transposed through the Dutch Buildings Decree (Besluit bouwwerken leefomgeving, Bbl) into a GACS obligation for non-residential buildings:

EN ISO 52120-1 succeeds EN 15232 and describes, function by function, which level of automation belongs to which class. The class score itself has no legal status: an equivalent justification, for example by a GACS adviser, is also accepted, and measures are only required where technically and economically feasible. The Dutch Cybersecurity Act (Cyberbeveiligingswet), the national implementation of NIS2, does not designate building automation as a separate sector. A hospital, data centre or drinking water company within scope must, however, protect every system that supports its services, and in practice that includes the climate installation.

🔐 Why is building automation a cyber risk?

For years, building systems were set up by installers, out of sight of the IT department. That produced typical weaknesses: default passwords, permanent remote access for the supplier, a flat network without segmentation and controllers that never receive an update. Three examples show what that means for security:

• Target (2013) - attackers got in using credentials from an HVAC contractor that had access to the network, and reached the point-of-sale systems because of poor segmentation.
• DIVD (2022) - the Dutch Institute for Vulnerability Disclosure found BACnet devices with open ports reachable directly from the internet and warned the owners in two rounds, advising them to shield the ports or move to BACnet/SC.
• KNX lockout (2021) - in a German office building, attackers wiped about three-quarters of the KNX devices and locked them with their own key; the lighting had to be switched at the circuit breakers. The underlying weakness, devices without a BCU key set, was registered in 2023 as CVE-2023-4346.

The lesson is that a building system is both a target (comfort, safety, availability) and a stepping stone to the office or production network.

🧭 How do you set up building automation securely and future-proof?

A practical approach for facility and building managers:

1. Take inventory - build an asset inventory of all controllers, gateways, BMS servers and external connections, including firmware versions and protocols.
2. Take the system off the internet - check for internet exposure and close open BACnet, KNX, Modbus and web ports.
3. Segment - place building management in its own Zone following the zones and conduits model of IEC 62443, separated from office IT and production, with VLANs and a firewall as the only path in.
4. Control supplier access - replace permanent connections with managed remote access over a VPN with MFA and logging, and set requirements in contracts (supplier security).
5. Harden and patch - replace default passwords, set a BCU key per KNX project and hand it over to the owner, and include controllers in patch management.
6. Choose secure protocols - ask for BACnet/SC, KNX Secure and products certified to IEC 62443-4-2 when replacing or building new.
7. Monitor - send alarms and logs to monitoring and include building management in incident response.

Together these measures form defence in depth for the building. The same data then also enables optimisation: a historian stores trends, a CMMS schedules maintenance, and analysis of fan and pump data makes predictive maintenance possible.

📊 How does building automation integrate with other systems?

A modern building exchanges data with several systems:

• SCADA or Historian - for overview and long-term storage at industrial sites
• MES and ERP - energy use per production order or cost centre
• IoT platforms and MQTT brokers - for cloud analytics, dashboards and digital twins
• CMMS - fault alarms automatically become work orders

Every integration is an extra conduit between zones. So record for each integration which data flows in which direction, and choose one-way traffic upwards wherever possible.

❓ Frequently asked questions

What is the difference between building automation and a BMS?

Building automation covers the entire system of sensors, controllers, networks and software that controls building installations automatically. A BMS (building management system) is its top layer: the software the facility manager uses to view alarms, trends and settings centrally. The control loops run in separate controllers and keep working if the BMS fails.

Is building automation mandatory in the Netherlands?

Building automation in the form of a GACS has been mandatory since 1 January 2026 for non-residential buildings with a heating or air conditioning system of more than 290 kW. From 1 January 2030 the obligation applies from 70 kW. The requirement comes from the Dutch Buildings Decree (Bbl) and is based on the European EPBD.

Which protocol is most widely used in building automation?

In building automation, BACnet is the most widely used open standard for HVAC and for connecting to the BMS. KNX dominates in Europe for lighting, sun shading and room control, and DALI for addressable lighting. M-Bus and Modbus are mainly used for meters and peripheral equipment.

What are the energy classes for building automation?

The energy classes for building automation are defined in EN ISO 52120-1, the successor to EN 15232. Class D is non-energy-efficient, class C is standard, class B is advanced and class A is high performance with full optimisation. For the Dutch GACS obligation, existing buildings need at least class C, with class B for the technical building management functions; new buildings must reach class B.

How can building automation be hacked?

Building automation is usually hacked through systems connected directly to the internet, default passwords or permanent access held by an installer. Because classic protocols such as BACnet and KNX have little authentication, an attacker with network access can change settings or lock devices. Segmentation, managed supplier access and secure protocols close most of these routes.

Does IEC 62443 apply to building automation?

IEC 62443 was written for industrial automation, but its principles fit building automation well. Many organisations use the zones and conduits model to design the building network, and vendors increasingly certify building controllers to IEC 62443-4-2. This gives the building the same security level as other OT systems.

📌 In summary

Building automation connects sensors, controllers and a central BMS into a single system that automatically controls climate, lighting, sun shading, access and energy. It works in layers, uses open protocols such as BACnet, KNX, DALI and M-Bus, and has been mandatory for large non-residential buildings in the Netherlands since 2026 under the GACS requirements. It is the foundation of smart buildings and sustainable building operations, and because it is increasingly connected, it deserves the same security as any other OT.

Building automation controls a building’s technical installations automatically for comfort, safety and energy savings; if you inventory it, segment it and manage it as a full OT system, you meet the GACS obligation without turning it into a new way in for attackers.