Building Management & Control System (BMCS)

A building management system (BMS, also called a building automation system) monitors and controls the building's mechanical plant and often lighting, metering, hydraulics and interfaces to fire, lifts and security. It is layered: a head end (server, software and operator workstations, now often cloud-hosted), a network, field controllers (direct digital controllers) in plant rooms and on floors, and sensors and actuators at the equipment. Its value lies in the control sequences it runs, the data it holds, and the people who can use it.

Open protocols (BACnet in particular) allow equipment from different manufacturers to work together and allow more than one contractor to service the system. Many older systems are proprietary, so only one contractor can maintain or extend them, and that contractor sets the price of every change.

What shortens life:

• Vendor end of support for controllers and software.
• Proprietary lock-in, which raises the cost of every repair and extension.
• Lost documentation: points lists, control narratives, network diagrams.
• No calibration of sensors.
• Cyber exposure that forces urgent replacement.

Obsolescence

Controllers and software become unsupported: no spare parts, no security patches, no engineers who know the programming. Head ends running on unsupported operating systems are common. A single controller failure can then take plant out of automatic control for weeks.

Sensor drift and failure

Temperature, humidity, carbon dioxide and pressure sensors drift over years; a supply air sensor reading two degrees low makes the chiller work harder all year. Failed sensors default to values that hide the problem.

Overrides and manual operation

Operators put points in manual to deal with complaints or faults, and they stay there. Plants run 24 hours because schedules were overridden; valves are held open; alarms are suppressed. Over time the building runs on overrides rather than sequences.

Poor or lost control sequences

Sequences written for the original design no longer fit after fit-outs and plant changes; they were often never fully commissioned. Heating and cooling fight; outside air is wrong; chillers and boilers stage poorly.

Missing or poor data

Trend logging is not set up, history is lost, meters are not connected. Without data, faults cannot be diagnosed and energy cannot be managed.

Cyber security exposure

BMS connected to the internet for remote access, with default passwords and unpatched software, can be found and controlled by attackers. Building systems have been used as entry points into corporate networks. National cyber security agencies publish guidance on securing building control systems.

Integration failures

Interfaces to fire systems (for smoke mode and plant shutdown), lifts and metering are undocumented and break when either side changes. The first sign may be a failed fire test.

Hardware failures

Controller power supplies and batteries fail, losing programs or clocks; network switches and gateways fail; head end servers fail without backups. Without current backups of controller programs, recovery means reprogramming from scratch.

Ownership of software and passwords

Programming tools, software licences, controller programs and administrator passwords are often held by the installing contractor rather than the owner. Changing contractor then means paying for access to the owner's own system, or replacing it.

At the head end

• Software and operating system versions.
• Alarm list: number of active and suppressed alarms.
• Points in manual override.
• Trend data availability.
• Graphics matching the plant.
• Remote access arrangements and passwords.

In the field

• Controller models and ages; labels.
• Sensors damaged, missing or in poor locations.
• Actuators disconnected or held by cable ties.

In the building

• Plant running at night and weekends.
• Comfort complaints.
• Energy use higher than benchmarks.

In the records

• Points list, control narratives, network diagrams, as-built drawings.
• Maintenance contract and contractor.
• Software licences.
• Calibration records.
• Penetration tests or security assessments.

• No current backup of controller programs or the head end.
• Licences and passwords held only by the contractor.
• Several separate BMS in one building from different eras or tenants.

Sensors that read the same value for weeks are usually failed rather than steady.

Findings are graded by what they demand: safety (can hurt someone now), failure (failed and damaging the building), condition (distress present and progressing), lifecycle (renewal due on age and exposure), deadline (a regulator or ordinance sets the date), check (investigate before sizing works) and nil (cosmetic or stable).

A controls engineer leads, independent of the incumbent contractor where possible, with a cyber security specialist for any system with remote access.

• Inventory of the head end, network devices, controllers, sensors and actuators, with manufacturer, model, firmware and software versions, and vendor support status.
• Trend analysis over at least several weeks: plant start and stop times against occupancy, setpoints, simultaneous heating and cooling, outside air, chilled and hot water temperatures, chiller and boiler staging.
• Override and alarm review: points in manual, suppressed and standing alarms, and why.
• Sensor calibration of key points (supply air, chilled water, outside air temperature and humidity, CO₂, static pressure, flow) against reference instruments.
• Functional testing: command actuators and confirm response at the equipment.
• Documentation review: points list, control narratives, network diagrams, as-built drawings, backups.
• Ownership review: who holds licences, programming tools, source programs and passwords.
• Cyber security assessment: remote access paths, internet exposure, credentials, patch levels, segmentation from corporate networks.
• Integration testing with fire (smoke mode, plant shutdown), lifts, metering and lighting.

The report should give the support status of each layer, the operating faults found in the trends, the security position, the integration status, and a migration plan: recommission, upgrade in stages, or replace.

• Recommissioning: release overrides, restore schedules, calibrate sensors, retune and rewrite sequences to current loads, rationalise alarms. Often the best value of any building services work.
• Head end upgrade to supported software and hardware, with proper backups.
• Staged migration: replace controllers plant by plant with open-protocol controllers, using gateways to keep old and new working together during the transition, rather than a single change-over.
• Specification of the new system around open protocols, owner ownership of licences, programs and passwords, documentation deliverables and training, so that any competent contractor can service it.
• Cyber security hardening: remove direct internet exposure, use secure remote access, change default credentials, patch, segment the building network from corporate IT, log access.
• Analytics: fault detection and diagnostics that read BMS data and flag faults automatically.
• Integration repair and testing with fire and other systems, documented.
• Documentation: points lists, narratives and network diagrams brought up to date.

Audits and trend analysis are lump sums. Recommissioning is priced per system or per plant item. Controller replacement is priced per controller or per point, with field wiring, sensors, actuators and programming. A head end upgrade is a lump sum. Analytics is a recurring subscription. Cyber hardening is a lump sum with recurring monitoring.

Replacement and staged migration are lifecycle; recommissioning and calibration are repairs and maintenance; cyber hardening and fire interface rectification are risk or code compliance driven. The usual shape is two-part: an audit first, then a migration envelope sized from it.

• Australia. AIRAH DA28 is the industry guide to building management and control systems; NABERS Energy ratings depend heavily on control performance; the Australian Signals Directorate's Australian Cyber Security Centre publishes guidance on operational technology security that applies to building systems; fire interfaces are tested as part of essential safety measures.
• United Kingdom. CIBSE Guide H covers building control systems; BS EN ISO 16484 covers building automation and control; the National Cyber Security Centre publishes operational technology guidance; BSRIA publishes BMS specification and commissioning guidance.
• United States. ASHRAE 135 defines BACnet, ASHRAE Guideline 13 guides specifying building automation systems, and Guideline 36 sets high-performance sequences; CISA publishes guidance on securing building and industrial control systems; building performance standards make control performance a compliance matter.

• Points list, control narratives and network diagrams.
• Head end, controller and firmware versions, with vendor support status.
• Backups of controller programs and the head end.
• Who holds licences, programming tools and passwords.
• Maintenance contract and scope.
• Several weeks of trend data for key plant.
• Any cyber security assessment or penetration test.
• Fire and lift interface test records.