What is a building automation system? A building automation system (BAS) is the network of sensors, controllers and software that schedules, monitors and adjusts a commercial building’s HVAC, and often its lighting, from one central point. In 2018 about 16% of US commercial buildings had one, covering 42% of floorspace.
Key Takeaways
- 16.0% of US commercial buildings and 42.1% of floorspace had a BAS in 2018, per our tabulation of EIA’s 2018 CBECS microdata.
- Size decides it: 10.0% of buildings of 1,001 to 10,000 sq ft had a BAS in 2018, against 80.7% of those over 500,000 sq ft, per the same EIA data.
- 94.5% of 2018 buildings with a BAS used it for cooling; only 33.5% used it for lighting (EIA CBECS).
- PNNL’s 2019 Army Re-tuning guides rank three BAS control fixes at between 8% and 10% annual energy savings each.
- A 2010 BAS retrofit of a 20,500 sq ft building cost about $20K and saved roughly 22%, per a PNNL case study.
- Washington requires direct digital control for new air systems serving more than three zones at 10 hp and larger, per WAC 51-11C-40349.
What is a building automation system?
A building automation system is a central control network for a commercial building’s mechanical equipment. It runs HVAC on schedules, holds setpoints, logs trends and raises alarms, so one operator can manage equipment across many floors. That central layer is a key difference between commercial and residential HVAC.
EIA’s survey defines it broadly: a BAS “may also be referred to as BAS, smart building controls, an energy management and control system, or EMCS.” It commands each air handling unit, every VAV box controller and the central plant.
In large buildings that plant is often a chiller plant with pumps and towers; in small ones, a row of rooftop units.
BAS vs BMS vs EMS: is there a difference?
BAS vs BMS is a naming difference, not a technical one. Federal surveys and the largest makers use building automation system, building management system and energy management and control system for the same class of product, so compare what a system controls and which protocols it speaks, not the label.
| Source | Term used | Applied to |
|---|---|---|
| EIA, 2018 CBECS | BAS, smart building controls, EMCS | One survey item for all three |
| PNNL | BAS; energy management and control system | Central HVAC controls |
| Johnson Controls | Building automation system | Metasys |
| Schneider Electric | Building management system software | EcoStruxure Building Operation |
| Honeywell | BMS front end | ComfortPoint Niagara 4 Supervisor |
| Siemens | Building automation | Desigo |
Because the labels overlap, ask any bidder whether a product can command equipment or only read meters. That question separates a control system from a dashboard.
How does a building automation system run HVAC?
A building automation system runs HVAC in layers. Field devices sense and act, unit controllers run each machine, a supervisory controller links them, and a front end gives operators schedules, trends and alarms. A shared protocol, most often BACnet, carries data between layers.
- Field devices: temperature, pressure and airflow sensors, damper actuators and valves.
- Unit controllers: direct digital control (DDC) boards on air handlers, rooftop units and terminal units.
- Supervisory controller: shares outdoor air temperature, occupancy and holiday schedules.
- Front end: where operators edit setpoints, read trend logs and acknowledge alarms.
ASHRAE describes BACnet as a protocol “designed specifically to meet the communication needs of building automation and control systems.” Published in 1995 as ANSI/ASHRAE Standard 135, it carries input and output values, schedules, alarms, trend logs and control logic between devices from different makers.
Modbus shows up too: a CISA advisory dated October 1, 2026 describes Johnson Controls controllers for HVAC and lighting “supporting open protocols such as BACnet and Modbus.” Honeywell says one Niagara 4 network controller integrates as many as 200 DDC controllers.
The layering is the same whether the zone end is a fan coil unit or a packaged rooftop unit; only points and sequences change.
Which buildings have a building automation system?
Large buildings have a building automation system; small ones mostly do not. In 2018, 16.0% of the 5.9 million US commercial buildings had a BAS, but they held 42.1% of floorspace. Our tabulation of EIA’s 2018 CBECS microdata shows the gradient.
| Building size (sq ft) | Buildings (thousand) | Buildings with a BAS | Floorspace with a BAS |
|---|---|---|---|
| 1,001 to 10,000 | 4,192 | 10.0% | 10.8% |
| 10,001 to 50,000 | 1,367 | 24.0% | 26.6% |
| 50,001 to 100,000 | 218 | 48.2% | 48.9% |
| 100,001 to 200,000 | 93 | 65.2% | 65.2% |
| 200,001 to 500,000 | 40 | 68.2% | 67.7% |
| Over 500,000 | 9 | 80.7% | 81.5% |
| All buildings | 5,918 | 16.0% | 42.1% |
Buildings under 50,000 sq ft are 94% of the stock in the same data. PNNL’s 2012 scoping study found the same pattern in older CBECS data: “Buildings that use BASs are typically large (>100,000 sf).” Most small buildings run on programmable or smart thermostats instead.
Among 2018 buildings with a BAS, 93.4% used it for heating and 94.5% for cooling, but only 33.5% for lighting.
How much energy does building automation save?
Building automation energy savings come from programming, not ownership. PNNL ranks individual BAS control fixes at about 5% to 10% of annual energy each, and a PNNL case study measured roughly 22% after a small building got its first BAS.
The PNNL Building Re-Tuning program estimates that 10% to 30% of commercial building energy is wasted through poor operation. Its Army guides describe re-tuning as improving efficiency at no or low cost, “primarily through building automation system (BAS) controls.” Those measure figures are modeled one at a time, so they do not simply add up.
Myth: install a BAS and the savings follow
PNNL says re-tuning gains persist only when BAS overrides stay “limited and short-lived” and failed sensors, controllers and communications get repaired. Johnson Controls advertises savings of “up to 30%” for Metasys; treat any maker figure as a ceiling, not a forecast.
So a BAS belongs inside a commercial HVAC service agreement with trend reviews. It also takes trained operators whose controls skills build on HVAC certification fundamentals.
What do energy codes require from HVAC controls?
Energy codes increasingly mandate the controls a BAS provides, with thresholds that depend on the edition your state adopted. Washington’s commercial code section C403.4.11 (WAC 51-11C-40349, last amended effective September 7, 2024) requires direct digital control (DDC) for:
- New air-handling systems supplying more than three zones with fan system bhp of 10 hp and larger.
- New chilled-water and hot-water plants serving more than three zones at 300,000 Btu/h and larger.
- New VAV boxes and other terminal units where zones on the same system already have DDC.
- Demand response logic in new buildings above 780,000 Btu/h of cooling, shifting setpoints at least 2°F on a utility signal.
Required DDC in new buildings must also gather trending data and graphically display input and output points. Other states adopt the IECC or ASHRAE 90.1 with their own amendments, so confirm the enforced edition during the HVAC permit process.
How much does a building automation system cost?
No federal agency publishes a price series for building automation system cost, so we quote no vendor ranges. The best public benchmark is a PNNL case study: a 2010 retrofit of a 20,500 sq ft building with 11 rooftop units cost approximately $20K installed, about $0.98 per sq ft by our arithmetic.
| Line item (2010 dollars) | Basis | Cost |
|---|---|---|
| Communicating thermostats | 10 at $250 each | $3K |
| Wireless sensors | 60 at $50 each | $3K |
| Sensor integrator | 1 with repeater | $1K |
| Network infrastructure | Switch, network controller, cabling | $6K |
| Labor | Design, engineering, installation | $7K |
| Total | One building | About $20K |
Before the retrofit, units started between 3 a.m. and 5 a.m. The upgrade cut energy roughly 22%, about $5,000 a year, a 4-year simple payback. One building is a reference point, not a quote.
PNNL’s budgeting method works backward from savings. At 10% savings on 10,000 sq ft, about $2,000 a year, a 3-year payback supports $6,000 of controls. At 30% savings on 20,000 sq ft with higher energy prices, a 5-year payback supports $109,000.
How do you secure a BAS network?
Treat a BAS as an industrial control system: segment it from the business network, close unused connections and patch controllers. CISA, the federal cybersecurity agency, issues advisories on building automation controllers, and its control system practices apply directly:
- Identify, minimize and secure all network connections.
- Configure firewalls between the control network and corporate IT.
- Allow no remote persistent vendor or employee connection.
- Test and implement security patches; back up configurations.
Johnson Controls claims IEC 62443-4-2 SL2 compliance for Metasys; ask any bidder for certificates and a hardening guide, not a brochure.
How we researched this
Research date: October 13, 2026. We opened 21 sources and cite 14. The prevalence table is our tabulation of EIA’s 2018 CBECS public microdata (6,436 records, EMCS variable, FINALWT weight); buildings where the question was not applicable count as having no BAS. Our total of 5,918 thousand buildings matches EIA Table B1; we did not compute standard errors, so treat small subgroup shares as approximate.
Excluded: vendor price ranges and market reports (no federal series), contractor blogs, and unlabeled maker claims. ASHRAE 90.1 and the IECC are paywalled, so we cite Washington’s adopted text. No Reddit material was used.
Frequently asked questions
What does a building automation system control?
Mostly heating and cooling. Among US commercial buildings with a BAS in 2018, 93.4% used it for heating and 94.5% for cooling, but only 33.5% for lighting, per our tabulation of EIA’s 2018 CBECS microdata. Many systems also log trends and alarms for pumps and plants.
What is the best building automation system?
No independent federal body ranks BAS brands. Large makers include Johnson Controls (Metasys), Siemens (Desigo), Honeywell (Niagara 4 based systems) and Schneider Electric (EcoStruxure Building Operation). Compare BACnet support, local service coverage, cybersecurity documentation and who owns the programming after installation.
Is BACnet the same as a building automation system?
No. BACnet is the communication protocol, published in 1995 as ANSI/ASHRAE Standard 135, that lets controllers from different makers exchange values, schedules, alarms and trend logs. A building automation system is the whole network of sensors, controllers and software, which may use BACnet, Modbus or proprietary protocols.
Do small commercial buildings need a BAS?
Most run without one. In 2018 only 10.0% of commercial buildings from 1,001 to 10,000 sq ft had a BAS, per our tabulation of EIA CBECS data. Yet PNNL’s 2010 case study measured roughly 22% savings when a 20,500 sq ft building with 11 rooftop units added one.
How much does a building automation system cost per square foot?
No federal per square foot series exists. In PNNL’s 2010 case study, controls for a 20,500 sq ft building cost about $20K installed, roughly $0.98 per sq ft by our arithmetic in 2010 dollars. That is one small rooftop unit building, not a price for large VAV or chiller systems.
Can a building automation system be hacked?
Yes. CISA issues security advisories for building automation controllers, including one dated October 1, 2026 for Johnson Controls controllers that run HVAC and lighting. CISA’s control system guidance calls for segmentation, firewalls between control and business networks, patching and no remote persistent vendor connections.
Sources
- U.S. Energy Information Administration. “2018 CBECS Microdata.” https://www.eia.gov/consumption/commercial/data/2018/index.php?view=microdata. Accessed October 2026.
- U.S. Energy Information Administration. “2018 CBECS Table B1.” https://www.eia.gov/consumption/commercial/data/2018/bc/html/b1.php. Accessed October 2026.
- Pacific Northwest National Laboratory. “Building Re-Tuning.” https://www.pnnl.gov/projects/building-re-tuning. Accessed October 2026.
- Pacific Northwest National Laboratory. “Army Re-tuning Implementation Guides,” PNNL-29078, 2019. https://www.pnnl.gov/main/publications/external/technical_reports/PNNL-29078.pdf. Accessed October 2026.
- Pacific Northwest National Laboratory. “Small- and Medium-Sized Commercial Building Monitoring and Controls Needs,” PNNL-22169, 2012. https://www.pnnl.gov/main/publications/external/technical_reports/PNNL-22169.pdf. Accessed October 2026.
- Washington State Legislature. “WAC 51-11C-40349.” https://app.leg.wa.gov/wac/default.aspx?cite=51-11C-40349. Accessed October 2026.
- ASHRAE. “BACnet.” https://www.ashrae.org/technical-resources/bookstore/bacnet. Accessed October 2026.
- BACnet Committee. “About BACnet.” https://bacnet.org/about-bacnet/. Accessed October 2026.
- CISA. “ICSA-26-274-04.” https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-04. Accessed October 2026.
- CISA. “Recommended Cybersecurity Practices for Industrial Control Systems.” https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf. Accessed October 2026.
- Johnson Controls. “Metasys.” https://www.johnsoncontrols.com/building-automation-and-controls/metasys. Accessed October 2026.
- Schneider Electric. “EcoStruxure Building Operation.” https://www.se.com/us/en/product-range/62111-ecostruxure-building-operation/. Accessed October 2026.
- Honeywell. “Niagara 4 and ComfortPoint Open.” https://buildings.honeywell.com/content/dam/hbtbt/en/documents/downloads/SL-53-2558ComfortPointOpenNiagara4.pdf. Accessed October 2026.
- Siemens. “Desigo.” https://www.siemens.com/global/en/products/buildings/automation/desigo.html. Accessed October 2026.
Leave a Reply