The transformation of the communication landscape is a key enabler for intelligent networking in buildings. The trend is clearly moving away from insecure or proprietary protocols towards a multi-layered, secure and semantically rich ecosystem. In this ecosystem, different technologies play to their specific strengths instead of competing with each other.
 

1.1 BACnet in transition: from BACnet/IP to BACnet/SC – security as the foundation

BACnet is the established and undisputed standard in building automation. Its original form, BACnet/IP, which relies on unencrypted broadcast messages for device discovery, is however a significant weakness in the face of modern cyber threats. BACnet Secure Connect (BACnet/SC) addresses this deficit fundamentally by relying on proven IT security mechanisms. It uses Transport Layer Security (TLS) in the current version 1.3 to ensure end-to-end encrypted and authenticated communication between devices.

Implementing BACnet/SC requires an adapted network topology. The previous peer-to-peer model with broadcasts is replaced by an IT-friendly hub-and-spoke architecture. A central "hub" manages the connections, which makes the cumbersome configuration of BACnet Broadcast Management Devices (BBMD) unnecessary and considerably simplifies communication across firewalls. For the huge installed base of around 25 million existing devices, a complete replacement is unrealistic and not economically viable. The pragmatic and recommended path is therefore a step-by-step transition, in which BACnet/SC-capable routers act as secure gateways that connect existing, unencrypted BACnet/IP or BACnet MS/TP segments to an encrypted BACnet/SC backbone.

The biggest challenge in introducing BACnet/SC is less technical than organisational: managing the digital certificates. Every BACnet/SC device needs a valid certificate to prove its identity. These certificates must be created securely, distributed to the devices and renewed regularly. This requires procedural and organisational cooperation between the previously often separate worlds of IT and OT. Since managing certificates and public key infrastructures (PKI) is a classic IT competence, BA planners and the operator's IT department must work closely together from the start of a project to establish a functioning and secure PKI for building automation. This enforced cooperation breaks down silos and leads to uniform security standards across the entire company – a core requirement of new regulations such as the NIS 2 Directive. BACnet/SC thus becomes a catalyst for the urgently needed IT/OT convergence.
 

1.2 OPC UA: the semantic bridge to enterprise IT and Industry 4.0

While BACnet/SC secures communication within building automation, OPC UA (Open Platform Communications Unified Architecture) serves as a vendor- and platform-independent bridge to higher-level management and enterprise IT. The outstanding strength of OPC UA lies not only in secure, service-oriented communication but above all in its information model. It allows data to be transferred not just as plain values but as complex objects with their full context and metadata. A simple value of "21.5" thus becomes the information "current room temperature, measured in degrees Celsius, by sensor T-201 in room 2.04, last maintenance: 15.05.2024".

The "BACnet OPC UA Companion Specification" defines a standardised way of mapping BACnet networks, devices and objects into the address space of an OPC UA server. This allows higher-level systems such as HMI/SCADA, ERP systems or AI applications to access and understand building automation data without having to know the details of the BACnet protocol.

This semantic capability decouples data consumers (analysis tools, AI applications) from data producers (BA devices) and is the key to "plug-and-produce" data intelligence. An AI application for predictive maintenance that receives only a raw data point without OPC UA needs extensive manual engineering to interpret that value. With OPC UA, the server delivers the value together with its full semantic context. The AI application can interpret this context automatically, which drastically reduces engineering effort, avoids errors and allows AI solutions to be rolled out faster and more scalably across different buildings and plants.
 

1.3 REST APIs: service-oriented access for maximum flexibility

Representational State Transfer (REST) APIs are not a protocol in the classic sense but an architectural style based on the proven, universal standards of the internet, in particular HTTP methods such as GET (retrieve data), POST (create data), PUT (update data) and DELETE (delete data). They enable simple, stateless and highly flexible access to data and functions. In building automation they can serve as a direct interface to controllers or management platforms, providing data for a wide range of applications.

As an alternative to the standard REST API, a communication interface based on WebSockets (WS) is often used. It uses the JSON format for data exchange and establishes a persistent connection, which makes communication considerably leaner than the HTTP-based REST approach. A key advantage of this method is the ability to bundle command chains. Instead of sending separate commands for reading (GET) and writing (PUT) data, these operations can be combined in a single JSON message and processed as one transaction. This optimises data throughput and considerably improves system response times.

Typical use cases are connecting tenant mobile apps for controlling the room climate, integrating external web services (e.g. weather forecasts for predictive heating control), or providing data for business intelligence dashboards and meeting room booking systems.

REST APIs democratise application development in building automation. Traditionally, interacting with a controller requires specific knowledge and special libraries for protocols such as BACnet, KNX or Modbus. A REST API, on the other hand, can be used by any web developer with standard tools and skills. This lowers the barrier to entry considerably and enables a broad range of developers – in start-ups, IT departments or among the tenants themselves – to create innovative applications that access building data. This drives a shift from closed, vendor-specific systems towards open platforms that actively support and demand innovation by third parties.

1.4 MQTT: the lightweight protocol for the IoT era

MQTT (Message Queuing Telemetry Transport) is an extremely lightweight publish/subscribe protocol designed specifically for networks with high latency, low bandwidth and potentially unreliable connections. Instead of a client actively polling a server for data, a device publishes a message on a specific topic to a central broker. All devices that have subscribed to this topic receive the message automatically. This event-driven model is highly efficient.

MQTT does not compete directly with BACnet/SC for controlling critical building services. Rather, it ideally complements the protocol landscape for connecting a massive number of simple sensors and Internet of Things (IoT) devices, as increasingly used in smart buildings – for example for recording room occupancy, air quality (CO₂, VOCs) and brightness, or for asset tracking. The data collected in this way is forwarded efficiently to edge gateways or cloud platforms.

The future of BA communication is therefore not monolithic but a hybrid protocol architecture. In this architecture, a robust BACnet/SC or OPC UA backbone for controlling the core building services (heating, ventilation, air conditioning) exists alongside an agile MQTT network for IoT sensors. These two worlds converge on edge devices that speak both protocols and aggregate, filter and contextualise the data for higher-level applications.

Table 1: Comparative analysis of communication standards in building automation

The basic architecture of ProMoS NG can aptly be compared with the modern concept of Docker containers. Just as Docker builds an overall system from individual, isolated containers, ProMoS NG consists of encapsulated, independent programs – the so-called "processes". Each of these processes is configured and started at runtime via specific parameters, and its interfaces to the outside world are provided via clearly defined ports. The decisive difference and advantage of ProMoS NG, however, is that this principle has been implemented natively: instead of requiring an additional virtualisation layer such as Docker, the core idea of encapsulation and resource management has been integrated directly into the ProMoS system itself. This approach avoids the additional resource consumption of a separate container system and results in an exceptionally lean and efficient architecture.

ProMoS NG can, however, also be run as a whole in a Docker/Kubernetes container.

Edge computing is not a niche technology; it is establishing itself as an essential architectural layer in modern building automation. It solves the inherent problems of a purely cloud-centred approach and is the logical place for the convergence of IT and OT technologies, where virtualisation and container technologies unfold their full strength.
 

3.1 From a cloud-centred to a decentralised approach

An approach in which all data from sensors and plants is sent to a central cloud for processing quickly reaches physical and economic limits. The main problems are high latency (delay due to data transport), high bandwidth costs, concerns about data security and data protection, and a lack of resilience if the internet connection is lost.

Edge computing moves computing power, data storage and analysis functions from the central cloud closer to where the data is generated – directly into the building, onto a floor or even onto a single machine. This brings decisive advantages for building automation:

Reduced latency: fast control loops and safety-critical functions can react in real time without the time-consuming detour via the internet.

Lower bandwidth costs: data is pre-processed, filtered and aggregated at the edge. Only relevant results, state changes or summarised key figures are sent to the cloud, which drastically reduces the amount of data to be transferred. Examples are central alarm systems and energy management and monitoring.

Increased data security & data protection: sensitive operational or personal data can be processed locally and does not have to leave the building, which makes it easier to comply with data protection regulations.

Autonomy & resilience: the core functions of the building are fully maintained even if the internet connection fails. The building can continue to operate autonomously.
 

3.2 Use cases at the edge

The edge device, usually a powerful industrial PC or a special gateway, becomes the central intelligence and integration platform in the building:

Data aggregation and protocol translation: it collects data from various field devices that speak different protocols (e.g. Modbus, KNX, M-Bus) and translates it into a uniform, modern format such as OPC UA, JSON API or MQTT for seamless connection to higher-level systems.

Local control and analysis: complex, data-intensive control algorithms that would exceed the computing power of a single DDC can be executed here.

Anomaly detection and AI inference: pre-trained artificial intelligence (AI) and machine learning (ML) models can run at the edge. They can, for example, analyse the vibration data of a pump in real time and report an anomaly long before a person would notice it. Deviations from expected energy consumption or dynamic limit values can also be detected directly at the edge using machine learning.

Retrofitting existing plants: edge devices are the ideal tool for connecting existing plants ("brownfield") that have no modern digital interfaces to the digital world and making them "smart".
 

3.3 Synergies: the perfect interplay at the edge

The true strength of the edge approach unfolds in combination with the technologies described above. Edge applications are ideally provided as Docker containers, which greatly simplifies their management, distribution and updating across hundreds of buildings. The edge node also often acts as a local MQTT broker that manages the communication of the IoT sensors in the building and serves as a secure bridge to the central cloud platform.

This development is leading to a new, three-tier BA architecture. The traditional split into field level (sensors, actuators) and management level (BMS) is complemented by a decisive intermediate layer: the edge level. It runs on powerful IPCs or gateways directly in the building and takes on all the tasks that are too computationally intensive for the field level and too time-critical or data-sensitive for the cloud: real-time analysis, ensuring local autonomy, data filtering and secure protocol gateway functions. This new architecture combines the best of both worlds: the robustness and speed of local processing with the scalability and computing power of the cloud.

The technologies discussed so far – secure protocols, flexible software architectures and decentralised edge computing – are not an end in themselves. They form the necessary foundation for unlocking the true treasure of modern building automation: the data. Artificial intelligence (AI), machine learning (ML) and the digital building twin are the tools that make it possible to gain valuable insights from this data. They transform building automation from a reactive system that waits for commands into a proactive, self-learning and self-optimising organism.
 

4.1 From reactive to predictive: predictive maintenance in building services

Traditional maintenance follows two patterns: preventive (maintenance at fixed intervals, which often leads to unnecessary costs) or reactive (repair after a failure, which leads to expensive downtime). Predictive maintenance makes it possible to carry out maintenance exactly when it is really needed. AI and ML algorithms continuously analyse a wide range of sensor data – such as vibrations, temperatures, pressures, current consumption and running times – and detect subtle patterns and anomalies that indicate an impending component failure.

The benefits are significant: studies and practical examples show a reduction in unplanned downtime of up to 75%, a reduction in maintenance costs of 25–30% and a significant extension of the service life of plant components. Hybrid approaches are particularly powerful. Purely statistical models reach their limits with complex plants such as compressors or chillers. Much more precise predictions are delivered by models that combine physical knowledge of the plant (so-called first-principle models) with data-based ML methods.
 

4.2 Optimising operation through machine learning

Beyond maintenance, ML models can learn from historical and real-time operating data to optimise building operation continuously and autonomously. The use cases are manifold, ranging from self-learning heating curves that adapt dynamically to the actual thermal behaviour of the building and to weather forecasts, through optimising load management to avoid expensive electrical peak loads, to demand-controlled ventilation based not only on CO₂ values but also on predicted occupancy derived from calendar data or Wi-Fi logins.
 

4.3 The digital building twin: the brain of the intelligent building

The digital building twin is much more than a static 3D model. It is the dynamic, virtual representation of a physical building that grows with it and interacts with it over its entire life cycle. It is created by intelligently merging two data worlds:

Static data: geometry, materials and semantic information from BIM models (Building Information Modelling) created during the planning and construction phase.

Dynamic data: real-time measured values from building automation, IoT sensors and usage information.

By linking these data worlds, the digital twin becomes the central "single source of truth" and the brain of the building. It enables a new quality of operational management:

Fault detection and diagnosis: the system can continuously compare the simulated target behaviour (based on the physical model) with the real measured values. Systematic deviations indicate faults, efficiency losses or defects long before they become a problem.

Simulation and what-if analysis: the effects of planned changes – be it a new control strategy, a refurbishment measure or a change of use – can first be simulated and evaluated risk-free on the digital twin before they are implemented at great expense in reality.

Optimised facility management: before a call-out, a technician can move through the building virtually, see the exact location of a defective component, access all relevant data and documentation, and thus plan and carry out maintenance work much more efficiently.

Creating and maintaining a comprehensive digital twin still involves considerable effort today, as there is a lack of end-to-end tools and above all of semantic interoperability between the domains of BIM, building automation and facility management (FM). Research institutions such as the Fraunhofer Institute are working intensively on solutions for automatically creating digital twins from existing data and scans.

The digital twin is the necessary bridge between the flood of raw data and valuable, actionable AI insights. It provides the decisive context. An AI that analyses an isolated temperature value of 25 °C cannot make a meaningful statement. Only the digital twin provides the context: the value comes from sensor "T-RL-204", which measures the heating return for room 204. The BIM model reveals that this is a server room, and the occupancy sensor reports that the room is unoccupied. Only with this overall picture can the AI draw a valuable conclusion: "The heating for an empty, already warm server room is running at full power – this is an expensive anomaly that should be fixed immediately." The digital twin thus turns big data into "smart data".

The technological developments described do not take place in a vacuum. They are driven and legitimised by three powerful external forces: the need for robust cybersecurity, the irreversible pressure for sustainability and the growing desire for a better user experience. These drivers provide the economic and strategic justification for investing in the new technologies and together form the business case for the intelligent building of the future.
 

5.1 Cybersecurity by design: from weak point to secure system

The increasing networking of building automation with the IT world and the internet makes it an attractive target for cyber attacks. The German Federal Office for Information Security (BSI) warns urgently of considerable security problems in practice, including unsecured remote maintenance access, missing or careless patch management, the use of outdated, insecure protocols and poor network documentation. A successful attack can range from loss of comfort (failure of heating or lighting) and financial damage (ransomware) to acute danger to human life, for example through manipulation of fire alarm systems or escape door controls.

At the same time, regulatory pressure is increasing massively. New laws such as the EU NIS 2 Directive and the upcoming Cyber Resilience Act (CRA) oblige operators (especially of critical infrastructure) and manufacturers alike to implement verifiable, state-of-the-art security measures.

A security concept added as an afterthought is doomed to fail. The solution lies in an integral "security by design" approach anchored in planning from the outset. This includes:

Technical measures: the use of inherently secure and encrypted protocols such as OPC UA or BACnet/SC is fundamental. In addition, there is consistent network segmentation using firewalls (separation of the BA and office networks), "hardening" devices by deactivating all unnecessary services and ports, and well-designed role-based authorisation management.

Organisational measures: an established IT/OT risk management process, clear responsibilities, a functioning process for regular software updates and security patches, emergency plans including regular backups, and continuous staff training are just as important as the technology. Technical rules and guidelines such as VDI 3814 and VDMA specification 24774 provide a reliable framework for this.
 

5.2 Sustainability and ESG compliance: building automation as a strategic compliance tool

Investors, legislators and society increasingly demand that companies comply with and report transparently on criteria in the areas of environmental, social and governance – ESG for short. Since buildings in Germany, and also in Switzerland, account for around 35% of final energy consumption and around 30% of CO₂ emissions, they are the absolute focus when it comes to meeting ESG targets, especially in the "environmental" area.

Building automation thus changes from a purely technical trade to a strategic compliance instrument. It is the central nervous system that makes it possible in the first place to record, measure and document the consumption data for electricity, heat, cooling and water required for reliable ESG reporting (e.g. under the Corporate Sustainability Reporting Directive – CSRD). Without digitised, transparent and granular data acquisition, credible reporting is impossible. Beyond reporting, building automation is also the decisive tool for actively controlling and optimising energy consumption and the carbon footprint and for achieving ambitious climate neutrality targets.
 

5.3 Focus on user experience (UX): people at the centre of the building

The paradigm of the building is changing. It is no longer seen merely as a passive shell for work or living, but as an active service and experience space that promotes the well-being, productivity and satisfaction of its users. In the "war for talent" and in the age of hybrid working models, a positive, smooth and personalised user experience is becoming a decisive differentiator and competitive advantage for companies and property owners.

Modern building automation is the key to realising this vision. It enables:

Personalised comfort: instead of a one-size-fits-all solution, temperature, lighting and ventilation can be controlled individually via a smartphone app. Intelligent systems also adapt automatically to users' preferences and actual presence.

Seamless services: building automation integrates with other systems to make everyday life easier. Examples are smart parking and desk booking via an app, indoor navigation to the booked meeting room, automatic notifications or keyless access by smartphone.

Health and well-being: beyond comfort, building automation can actively contribute to health by continuously monitoring air quality (CO₂, VOCs and other air components) and controlling ventilation as needed, or by adapting lighting to the human biorhythm (human centric lighting).

These three drivers – cybersecurity, ESG and user experience – are closely linked and together create a robust business case for investing in modern BA technologies. A good UX, such as a tenant app for climate control, requires the processing of personal data, which in turn calls for the highest level of cybersecurity and data protection. Optimising energy consumption (ESG) must not come at the expense of user comfort (UX); an intelligent building automation system must balance both goals. Investment in a modern, secure and open BA platform can therefore no longer be justified by energy savings alone, but by a multi-dimensional value proposition of risk minimisation (security), compliance and value enhancement (ESG), and increased attractiveness and productivity (UX).

Table 3: Cybersecurity measures matrix for building automation

The technology trends and fundamental drivers analysed come together in a coherent and powerful vision of the future: the Software-Defined Building (SDB). This concept describes the final step in the evolution of building automation, in which the building itself becomes an agile, programmable and intelligent platform.
 

6.1 Definition and concept

Directly modelled on established IT concepts such as software-defined networking (SDN) and the software-defined data centre (SDDC), the SDB describes an architecture in which building functions – heating, cooling, ventilation, lighting, security, access – are completely decoupled from the physical hardware infrastructure. They are provided and orchestrated as virtualised, software-based services. The building changes from a rigid, hardware-defined construct into a "write once, run anywhere" platform that continuously optimises, adapts and extends its functionality. The key benefits are maximum flexibility, agility and efficiency, and an unprecedented ability to adapt to new technologies and changing usage requirements over the entire life cycle.
 

6.2 How the technologies work together in the SDB

The architecture of the Software-Defined Building integrates all the elements discussed above into a logical whole:

The physical level is reduced to the essentials: sensors, actuators and standardised, interchangeable (commodity) hardware such as IPCs and network switches.

The virtualisation level (section II) uses VMs and containers to abstract the underlying hardware and provide flexible runtime environments for the software.

The communication level (section I) ensures secure, reliable and semantically rich data exchange using a hybrid approach of BACnet/SC, OPC UA, MQTT, WebSocket and REST APIs.

The intelligence level (sections III & IV), distributed across edge and cloud resources, executes the actual application logic, the AI models and the analysis functions.

The digital twin (section IV) serves as the central, dynamic data and orchestration model that brings together and contextualises all information.

The service level provides users and operators with the actual functions as modular services (e.g. "room climate service", "energy optimisation service", "security service").
 

6.3 Implications for the industry

The vision of the SDB has profound implications for all players in the market:

New business models: the focus shifts from one-off hardware sales to software- and service-based models. Conceivable are "building as a service" concepts, subscriptions for advanced analysis services or even app stores through which new building functions can be added.

Changing roles and skills: the classic BA integrator must become an IT/OT system integrator with in-depth software and security know-how. The facility manager develops from technician to data and community manager who orchestrates the services and the user experience. Software developers become a decisive resource in the real estate industry.

The need for openness: proprietary, closed systems have no place in this vision. Open interfaces (APIs), support for standards and the ability to integrate into a multi-vendor ecosystem are vital.