What is KNX?
KNX is an open, vendor-independent communication standard for building automation, published as ISO/IEC 14543-3 and EN 50090, that lets sensors, switches and actuators from different manufacturers control lighting, climate, shading, security and energy management together without a central controller. Every KNX device has its own microcontroller and reacts to messages (telegrams) sent over a shared medium, usually a two-wire bus cable. KNX is used in homes, offices, schools, hotels, hospitals and industrial buildings, mainly in Europe. Because KNX installations are increasingly connected via IP to the office network, a BMS or the cloud, KNX is also part of OT and of OT convergence.
🕰️ Where does KNX come from?
KNX succeeded three European building buses. The best known is EIB (European Installation Bus, also called Instabus), for which Siemens and other manufacturers founded the EIB Association (EIBA) in 1990. Alongside it were the French BatiBUS and EHS (European Home Systems). In 1999 the three organisations merged their work into the KNX Association, a non-profit association under Belgian law.
| Year | Milestone |
|---|---|
| 1990 | EIB Association (EIBA) founded |
| 1999 | EIBA, BatiBUS Club and EHSA merge into the KNX Association |
| 2002 | First KNX specification published |
| 2003 | KNX becomes European standard EN 50090 (CENELEC) |
| 2006 | KNX becomes international standard ISO/IEC 14543-3 |
| 2018 | KNX Data Secure standardised in EN 50090-3-4 |
| 2019 | KNX IP Secure standardised in ISO 22510 |
| 2021 | ETS6 engineering tool released |
KNX is also published as CEN EN 13321-1 and as the Chinese standard GB/T 20965, and the BACnet standards ANSI/ASHRAE 135 and ISO 16484-5 contain a mapping between KNX and BACnet. According to the KNX Association, more than 500 manufacturers together offer over 8,000 certified products. Well-known names include ABB, Busch-Jaeger, Gira, Hager, Schneider Electric, Siemens and Theben. Thanks to certification, a push button from one brand works with a dimming actuator from another.
🔧 How does KNX work technically?
KNX is a distributed system: there is no central processor running all the logic. When pressed, a push button sends a telegram to a group address, and every actuator listening to that group address performs the corresponding action. The links between buttons, sensors and actuators are loaded into the devices themselves during commissioning. If one device fails, the rest of the installation keeps working.
KNX supports four transmission media:
| Medium | Characteristics | Typical use |
|---|---|---|
| TP (twisted pair) | 9,600 bit/s, CSMA/CA, power (SELV, around 30 V DC) and data on the same pair | Standard in new build and renovation with new cabling |
| PL (powerline) | PL110: 110 kHz, 1,200 bit/s over the existing 230 V mains | Renovation without extra cables, now rare |
| RF (radio) | 868.3 MHz, frequency shift keying | Wireless switches and sensors, extensions |
| IP (KNXnet/IP) | UDP port 3671 over Ethernet or Wi-Fi | Backbone, connection to BMS and visualisation |
Two modes matter for KNXnet/IP. Tunnelling is a point-to-point connection between a PC or visualisation and an IP interface, mainly used for commissioning and diagnostics. Routing links multiple IP routers via IP multicast; the address 224.0.23.12 is reserved for this.
🧱 How is a KNX installation structured?
KNX uses a hierarchical topology with line, tree and star branches; closed rings are not allowed on TP. Each device gets a physical address in the form area.line.device, for example 1.2.15. An installation can have up to 15 areas of 15 lines each, enough for more than 57,000 devices.
In practice, these limits apply to a TP line segment:
| Limit | Value |
|---|---|
| Devices per line segment | 64 (with line repeaters up to 4 segments per line) |
| Total cable length per segment | 1,000 m |
| Distance power supply to device | max. 350 m |
| Distance between two devices | max. 700 m |
| Areas × lines | 15 × 15 |
Besides physical addresses, KNX uses group addresses, usually in three levels (main group/middle group/sub group), for example 1/0/3 for “lighting ground floor, meeting room, switching”. A sound group address plan is the most important design document in a KNX project.
An installation is designed and programmed with ETS (Engineering Tool Software) from the KNX Association; the current version is ETS6. ETS downloads physical addresses, parameters and group addresses into the devices and stores the project file that the owner should receive at handover.
🏢 What is KNX used for?
| Application | Examples |
|---|---|
| Lighting | Switching, dimming, scenes, time schedules, presence detection, links to DALI gateways |
| Climate control (HVAC) | Room controllers, zone control, ventilation, control of fan coils and underfloor heating |
| Shading | Blinds and shutters based on sun position, wind and temperature |
| Security | Intrusion signalling, panic functions, smoke detector signalling |
| Energy management | Consumption metering, smart switching, links to PV, EV chargers and M-Bus meters |
KNX can integrate smoke detectors and intrusion detection for signalling and scenes, but it does not replace a certified fire alarm or intruder alarm system, which remains essential for safety. Core functions run locally and do not depend on an internet connection.
🌐 How do you connect KNX to other systems?
In commercial buildings KNX is rarely the only protocol. Usually KNX handles lighting, shading and room climate at floor level, while a building management system using BACnet supervises the central plant. Gateways provide links to:
- BACnet, Modbus, DALI, M-Bus and LON: for plant, meters and lighting
- BMS and SCADA platforms: for monitoring, alarms and trends
- OPC UA and MQTT: for links to data and cloud platforms
- Zigbee and other smart home protocols: via hubs in homes
With KNX IoT, the KNX Association is working on a variant that communicates directly over IPv6 networks such as Thread, Wi-Fi and Ethernet, using CoAP as the application protocol and CBOR as the message format. The existing group address logic and ETS remain usable.
🔐 How secure is KNX?
Classic KNX was designed for a closed bus cable and has no encryption and no authentication of telegrams. Anyone with access to the bus or to the KNXnet/IP network can read and forge telegrams or reprogram devices. This is not theoretical: in 2021, attackers in a German office building wiped the configuration of about three quarters of the KNX devices and locked them with their own BCU key; the lighting then had to be switched from the distribution board. The underlying weakness, devices without a BCU key set, has been registered since 2023 as CVE-2023-4346; an attacker with physical access to a device can exploit it as well.
KNX Secure is the answer and consists of two parts:
- KNX IP Secure: encrypts traffic over IP (tunnelling and routing), but not the TP side behind the IP router
- KNX Data Secure: encrypts and authenticates telegrams end to end on TP and RF using AES-128 in CCM mode, with a sequence number against replay attacks
Every Data Secure device ships with a unique FDSK (Factory Device Setup Key), often as a QR code. During commissioning ETS replaces it with its own key and stores all keys in a keyring file that the owner must keep safe.
🛠️ How do you secure a KNX installation in practice?
- Inventory: include KNX routers, IP interfaces and visualisation servers in the asset inventory, including firmware versions
- Demand ownership: have the ETS project, the group address plan, the BCU keys and the keyring handed over to the owner at completion
- Set a BCU key on every device that supports it, unique per project, so nobody can reprogram devices unnoticed
- Choose KNX Secure for new installations: IP Secure for the backbone and Data Secure for sensitive functions such as access and intrusion
- Segment: place KNXnet/IP in its own VLAN behind a firewall and only allow UDP 3671 from known systems; see network segmentation
- Restrict remote access: never expose KNX directly to the internet; use managed remote access via a VPN with MFA
- Patch and monitor: include KNX gateways in patch management and preferably choose products developed under IEC 62443-4-1 and compliant with IEC 62443-4-2
Together these measures form defence in depth for the building. In the Netherlands they are particularly relevant: large commercial buildings have needed a building automation and control system (GACS) since 1 January 2026, and organisations covered by the Dutch Cyberbeveiligingswet, the national implementation of NIS2, must also protect the building systems that support their services. IEC 62443 provides the framework for this.
❓ Frequently asked questions
What is the difference between KNX and BACnet?
KNX is mainly a standard for the field and room levels: switches, sensors and actuators for lighting, shading and room climate. BACnet is usually deployed at the level of plant controllers and building management systems. In commercial buildings KNX and BACnet are therefore often combined via a gateway.
Does KNX need a central controller?
No, KNX is a distributed system in which every device contains its own logic and reacts directly to group telegrams. A server or visualisation is optional and adds operation, logic or integrations. If such a server fails, the basic functions of a KNX installation keep working.
Which software do you need to program KNX?
KNX devices are programmed with ETS (Engineering Tool Software) from the KNX Association, of which ETS6 is the current version. ETS works for certified products from all manufacturers. The ETS project file is the most important documentation of a KNX installation and belongs to the owner.
Is KNX secure enough to connect to the network?
Classic KNX has no encryption or authentication, so a KNX installation should never be connected directly to the internet or an open office network. With KNX IP Secure, KNX Data Secure, BCU keys, a dedicated VLAN and a firewall, a secure connection is possible. Remote access should run through a managed VPN.
Can KNX be installed without new cabling?
Yes, KNX RF communicates wirelessly at 868 MHz and suits extensions and renovations without chasing walls. KNX over powerline uses the existing mains wiring but is rarely applied any more. For large new-build projects, KNX TP with its own green bus cable remains the standard.
Does KNX help with the Dutch GACS obligation?
KNX can automate lighting, shading, room climate and meters and feed the data to a building management system, thereby contributing to a GACS. The GACS obligation requires a system that continuously monitors, logs and analyses energy use. In practice KNX therefore plays a role within a broader building management system.
📌 In summary
KNX has been the international standard ISO/IEC 14543-3 for building automation since 2006 and grew out of EIB, BatiBUS and EHS. Devices from hundreds of manufacturers cooperate without a central controller via group addresses, over twisted pair, radio, powerline or IP, and are all programmed with ETS. Classic KNX is unsecured; KNX Secure, BCU keys, segmentation and ownership of the ETS project make it fit for connected buildings.
KNX is the open global standard for smart buildings; if you use KNX Secure, segment the network and own the project and keys yourself, you get flexible building automation without opening a new door for attackers.