Communication protocols
The gateway speaks the protocols your equipment already uses. Monitoring works on all of them; writes are possible only where the protocol supports them safely, always with approval and read-back.
| Protocol | Typical equipment | Monitor | Remote adjustment | Families in the library |
|---|---|---|---|---|
| BACnet/IP (incl. MS/TP through a router, BACnet/SC) | Chillers, air handlers, DDC controllers | ✓ | Yes — by BACnet priority, can be relinquished | 333 |
| Modbus TCP / Modbus RTU (RS-485) | Pump drives, meters, CDUs, PLCs | ✓ | Yes | 1115 |
| OPC UA (signed and encrypted) | PLCs, SCADA systems | ✓ | Yes | 260 |
| KNX | Lighting, building controls | ✓ | Setpoints only | 11 |
| SNMP v1 / v2c / v3 | UPS, PDUs, network equipment | ✓ | Read-only | 113 |
| MQTT (JSON and Sparkplug B) | IoT sensors | ✓ | Read-only | 49 |
| DL/T 645 | Energy meters | ✓ | Read-only | 11 |
| IEC 60870-5-104 | Substations, distribution automation | ✓ | Read-only | 17 |
| IEC 61850 (MMS reports and polling, GOOSE, optional TLS) | Protection relays, fault recorders, PQ analyzers | ✓ | Read-only — no control service | 61 |
| M-Bus (wired) | Water and heat meters | ✓ | Read-only | 16 |
| EtherNet/IP | Rockwell / Allen-Bradley PLCs | ✓ | Numeric setpoint tags, with approval and read-back | 45 |
| DNP3 (IEEE 1815 master) | Power, water and renewable-plant RTUs | ✓ | Read-only — never sends SELECT/OPERATE | 41 |
| Siemens S7 (S7comm / ISO-on-TCP) | S7-300 / 400 / 1200 / 1500 PLCs | ✓ | Read-only — Read Var only | 2 |
| ONVIF | Cameras (video linkage, camera views on the wall) | ✓ | — | 10 |
Life-safety equipment (fire alarm, gas detection, emergency-power linkage) and electrical protection devices are monitored and notified only, whatever the protocol. The catalog check rejects any change that would make such a point writable.
Scan rates are configurable per site, gateway or device: control points typically 100–500 ms (default 200 ms), monitoring points 1–5 s (default 2 s). Control loops close at the gateway.
Network scan and discovery
- BACnet/IP Who-Is broadcast (through BBMDs and routers), reading names, make, model and all objects.
- ONVIF cameras by WS-Discovery; SNMP subnets (SNMPv3 devices are found without credentials; a scan account bound to the subnet reads sysDescr).
- Modbus TCP subnets on port 502 with the given unit IDs, reading device identification (FC43/14) where supported; Modbus RTU unit by unit on serial ports.
- IEC 61850 subnets on port 102: MMS association, nameplate (LLN0 / LPHD) and data model, with read-only points and report control blocks selected automatically. ICD, CID and SCD files (up to 16 MB) can be imported too.
- Scans are read-only, rate-limited (at most 50 addresses per second, one broadcast per protocol), capped (1024 addresses, 4 minutes) and audited.
Device credentials
SNMPv3 users, OPC UA accounts and certificates, MQTT accounts, IEC 104 and IEC 61850 TLS material and camera accounts are entered per device by an engineer. They are write-only, stored encrypted and delivered only to the gateway that serves the device, sealed to that gateway's key. A device that needs credentials and has none is not connected: no default community, no anonymous OPC UA session.