Updated Standard
ASHRAE’s BACnet Standard Could Increase Cybersecurity
From ASHRAE Journal Newsletter, Nov. 10, 2020
In total, 17 addenda, 17 interpretations and 94 errata were incorporated into the standard to make ANSI/ASHRAE Standard 135-2020, BACnet—A Data Communication Protocol for Building Automation and Control Network.
New capabilities in the 2020 version of the BACnet standard include lighting and elevator device profiles that provide a standardized description for these types of devices, along with audit reporting and logging to capture auditable actions.
The 2020 edition also includes BACnet Secure Connect, a BACnet datalink layer that is fully compatible with all existing BACnet datalinks and provides an interoperable and secure path for BACnet communications.
Michael Osborne, P.Eng., Member ASHRAE, chair of Standing Standard Project Committee 135, discusses the latest update to the BACnet Standard.
1. What do engineers need to know about the 2020 edition of the standard?
In the last four years, SSPC 135 has added many significant features and even more subtle improvements to the standard. Some of the features include audit reporting, lighting and elevator profiles and a secure datalink. Some improvements include clarifying schedule BACnet Interoperability Building Blocks (BIBBs) and improving BACnet Web Services.
In total, 17 addenda, 17 interpretations and 94 errata were incorporated into the standard to make Standard 135-2020.
2. What are some of the most significant changes/additions to this edition of the standard?
To me, the most significant three additions to the standard are audit reporting, the new lighting and elevator BIBBs and profiles and BACnet Secure Connect.
3. How will BACnet Secure Connect (BACnet/SC) affect engineers/industry professionals on a building-level and on a community-level?
BACnet/SC adds interoperable cybersecurity to the IP level of a building automation system. BACnet/SC is designed to work with existing infrastructure to allow a building automation system (BAS) to be strategically updated without incurring a large initial cost outlay or, if desired, BACnet/SC can be deployed across the entire system.
BACnet/SC is coming to a product near you. BACnet/SC was added to the standard in such a way as to allow BTL Listed BACnet devices to add BACnet/SC while not incurring excessive retesting costs.
Cybersecurity is not free. Engineers and facility managers will need to understand the consequences of adding cybersecurity to a BAS system. They will also need to understand how to deploy BACnet/SC and how to support and expand it to maintain a secure and viable system.
4. What were some challenges the SSPC faced when updating Standard 135? How did the committee solve those challenges?
Of the 17 addenda to Standard 135-2016, the most significant effort was BACnet/SC.
Understanding cybersecurity and understanding the complexities of providing a secure solution to a BAS system were significant challenges. Developing an interoperable, extensible and deployable solution was an even bigger challenge.
Many members invested significant time and effort to research cybersecurity and how it could be deployed in both new and existing BAS systems. Other members brought expert insights to the committee meetings to assist in understanding the complexities of cybersecurity. In the end, it took the committee over five years and three public reviews to publish BACnet/SC.