Building-automation network architecture: field, building, supervisory
Treat the building automation system as three layers that only look like one graphic. The field layer carries sensors, actuators and application controllers — often MS/TP, proprietary, or a constrained IP subnet. The building layer is switched Ethernet that must not be the same best-effort soup as guest Wi-Fi. The supervisory layer is servers, historians, remote access, and the people who patch them. Controls architecture is the drawing of those layers and their gateways. Buying another protocol converter without that drawing adds a silent single point of failure.
How the investigation is actually run
Inventory every trunk with baud or bitrate, every IP subnet, every router or BBMD, and every person who still has a default password on a supervisory server. Then ask the only architecture question that matters: if the supervisory host is powered down, which loops still control the plant. If the answer is “none,” write that as a finding, not as a future wish.
Flat networks fail in characteristic ways: workstation broadcasts colliding with field timing, DHCP on a controller that needed a fixed address, an IT image that spans trees the fieldbus cannot survive. Cloud supervisory with an undocumented outbound path is an operations and a security fact at once. Draw multicast. Draw who is allowed to route objects.
Buy gateways only after the layers exist on paper. A converter that hides a second building behind one object list is a single point of failure with a cheerful datasheet. The report should be a layer drawing a contractor can install and an owner can still understand in five years.
Symptoms of a flat design
One broadcast domain from rooftop to desktop. A workstation scan that collides with MS/TP timing. Firmware updates that take down a chiller plant because the server and the plant controller share an address plan with DHCP. IT discovers the BAS switch and applies an image that spans trees the field cannot tolerate. See BAS, OT and network coordination.
Causes
Vendor typicals that stop at “provide BACnet.” No BBMD plan. No list of which objects are routed. Supervisory in the cloud with an undocumented outbound path. A “flat” VLAN to save a meeting.
Investigation
Inventory trunks, baud, IP subnets, routers, and who holds admin. Map multicast and BBMD. Confirm whether control continues if the supervisory server dies — if it does not, that is an architecture fact, not a support opinion. Tie sequences to the layer that must execute them: from sequence to architecture. Parent service: Division 25.