BMS / PLC / EPMS — NETWORK OPERATIONS
CODE · SYS-NORMAL
join: <funnel-url>
DELIVERYROLESTACK

LIVE SYSTEM STATUS

PACKET / EVENT LOG

STC Engineering Summit

BMS-PLC-EPMS Networking Presentation

A Brief Overview of Network Engineering Implementation and Design

By Eric Case and Patrick Mckenna

A packet is a circuit.

SOURCEBMS / EPMS / HMI DEVICEcontroller / meter SRC ADDR DST ADDR PROTOCOL PORT PAYLOAD TIMEOUT SYN SYN/ACK ACK DATA TIMEOUT

One simple truth.

Every alarm, command, trend, trip, reset, and register value is information moving through a path.

If you can explain the path, you can design the network. If you cannot explain the path, troubleshooting becomes guessing.

Question for the whole session: how does information move from a field device to the operator?

One value moving through the facility.

What is inside an OT packet?

Source

Who sent it: supervisor, PLC, EPMS server, gateway, HMI.

Destination

Who should receive it: one device, local subnet, subscribed group.

Addressing

MAC moves on local Ethernet. IP moves across routed networks.

Port/protocol

UDP 47808, TCP 502, TCP 44818, UDP 2222, TCP 102.

Payload

Register read, point value, Who-Is, I-Am, command, event.

Timing

Retry, timeout, scan interval, stale value, event order.

Traffic behavior decides the design.

Unicast

SOURCE R1 R2 R3 R1 ONLY

One source to one destination. Modbus TCP polling, HMI to PLC, server to meter.

Broadcast

SOURCE R1 R2 R3 ALL RECEIVE

One source to everyone on the local segment. BACnet discovery lives here.

Multicast

SOURCE R1 R2 R3 SUBSCRIBED GROUP

One source to selected subscribers. GOOSE-style fast event publishing.

Polling vs event

POLLING EVENT

Polling asks repeatedly. Event traffic publishes when something changes.

Ping proves reachability. It does not prove the application path.

Role model = latency model.

Client / server

CLIENT SERVER CAN'T INITIATE

The EPMS client asks. The meter is the server. TCP sessions matter.

Master / slave

MASTER S1 S2 S3

Serial Modbus has one master. GW-02 has two faces: TCP server, RTU master.

Peer-to-peer + discovery

A B C D

BACnet devices discover each other. Peer-to-peer is WHY BACnet broadcasts.

Publish / subscribe

PUBLISHER TOPIC SUBSCRIBER

GOOSE publishes events to subscribed IEDs. Fast multicast, not a poll.

Same room, four different rulebooks for who's allowed to talk.

Modbus — master/slave poll

MASTER SLAVE READ RESPONSE

Nothing happens unless the master asks. Constant, metronomic traffic.

BACnet MS/TP — token passing

A B C D

Peers take turns. Only the token holder may transmit — no master, no collisions.

EtherCAT — on the fly

MASTER D1 D2 D3

One frame flows through every node in a single pass — each device reads and writes on the fly.

OPC UA — report by exception

CLIENT SERVER SUBSCRIBE NOTIFY

Client subscribes once. Server stays silent until the value changes — not a constant poll.

The mechanic you pick decides latency, bandwidth, and failure behavior — a design decision, not an implementation detail.

Physical media sets the rules underneath the protocol.

Ethernet copper

Switch ports, VLANs, MAC tables, IP devices, local patching.

Fiber

Long runs, building backbones, electrical isolation, switch uplinks.

RS485 trunk

Serial bus, daisy-chain topology, termination, biasing, unit IDs.

Gateway uplink

Old serial field devices become visible to modern IP systems through one bridge.

Devices they must recognize on sight.

BMS supervisorBACnet/IP controllerBACnet MS/TP controllerBACnet router PLCRemote I/OHMIEngineering workstation EPMS serverPower meterProtective relayModbus TCP/RTU gateway Managed switchLayer 3 routerFirewall / DMZTime server

BMS / BACnet topology choices.

Flat BACnet/IP

SupervisorSwitchIP controllers

Works locally because Who-Is broadcast stays inside one subnet. Simple, but the broadcast domain and blast radius grow together.

Routed BACnet/IP + BBMD

SupervisorBBMD-1RouterBBMD-2Controller

Broadcast does not cross the router. BBMD forwards discovery as directed unicast, then re-broadcasts on the far subnet.

BACnet MS/TP trunk

SupervisorBACnet routerRS485 trunkField controllers

The BACnet router bridges IP to serial. RS485 needs trunk wiring, termination, and stable addresses.

BACnet Ethernet

Supervisor802.3 segmentLegacy devices

Older BACnet over Ethernet has no IP layer. Do not design it like BACnet/IP just because the cable looks familiar.

Mixed BMS

SupervisorSwitchRouterMS/TP trunk

Real sites mix IP controllers, routed subnets, and serial trunks. The drawing must show which device routes, bridges, or translates.

Do not start with a product name. Start with the topology: local segment, routed subnet, serial trunk, or legacy media.
LIVE PATHUDP 47808

WHO-IS broadcast stays inside the subnet. Both controllers hear it and answer.

ROUTED PATHBBMD + UDP

BBMD forward crosses the routed boundary as unicast, then re-broadcasts locally.

FIELD TRUNKRS-485 / MS/TP

Token passing gives each controller a turn. The trunk needs polarity, termination, and IDs.

LEGACY SEGMENT802.3 FRAME

802.3 frame uses the shared Ethernet segment directly. A familiar cable does not mean IP.

REAL SITE MIXIP + MS/TP

One information path can change media at the router. The drawing must show where it routes and bridges.

Protocol names hide different stacks.

BACnet/IP

  1. Application
  2. UDP 47808
  3. IP
  4. Ethernet

BACnet/Ethernet

  1. Application
  2. 802.3 frame
  3. NO IP ROW
  4. Ethernet

BACnet MS/TP

  1. Application
  2. Token passing
  3. RS-485

Modbus TCP

  1. Registers
  2. TCP 502
  3. IP
  4. Ethernet

Modbus RTU

  1. Registers
  2. Unit ID
  3. Serial bus

BACnet design: where routing awareness matters.

Modbus design: where gateway awareness matters.

Good design: place devices by role and path.

REACHABLE HOSTS: 0 / 22

Build the conduit.

Bad design makes failures look mysterious.

REACHABLE HOSTS: 0 / 22

Troubleshoot the path, not the symptom.

1Physical

Power, link, fiber, RS485 polarity, termination.

2Addressing

MAC, IP, unit ID, device instance, duplicate address.

3Routing

VLAN, gateway, BACnet router, BBMD, firewall path.

4Protocol

UDP 47808, TCP 502, register map, Who-Is/I-Am, timeout.

5Application

Point mapping, stale values, alarms, schedules, operator view.

Controller pings. BMS can't discover it.
Meter is online. Values are 14 minutes old.
HMI frozen. Is the plant still controlled?
Three systems, three clocks, wrong story.

14:17:03 — a feeder trips. Who knows first?

Six rules.

1Know the delivery type before you troubleshoot the protocol.
2Know who initiates; the meter is the server.
3VLAN is addressing; conduit is permission.
4Broadcasts do not route. BBMD is the designed exception.
5Document every inter-zone path: source, destination, port, direction, and time bound.
6Design the failure state and evidence trail before the failure occurs.

The trip, done right.

Your turn.

Open the Interactive Labs page → LAB tab. Six builds, same parts you just saw.

https://<funnel-url>/audience/
QR placeholderQR
INTERACTIVE LABS · PLACE PARTS · SUBMIT DESIGN
https://<funnel-url>
QR placeholderQR
INTERACTIVE LABS · POLLS · HANDOUT