BAS-506 Reading Guide
How to use this reading guide
This is the concept-review layer for a 100% online course. Read each module before its lesson, complete the retrieval prompts without looking, then use the linked authoritative sources to verify project-specific editions, requirements, and manufacturer procedures.
Online evidence is not OJL: browser simulations, document cases, and isolated remote equipment build reasoning and documentation skill; supervised field performance is recorded separately.
Protocol mental model, layers, semantics, and demarcation
Why it matters: A protocol name does not define cable, routing, data meaning, writable authority, or physical result; each layer and contract must be proved.
Vocabulary and working scope
Physical medium; electrical/link layer; transport; network; session/security; application; object/register/network variable; client/server; producer/consumer; gateway; owner; demarcation.
Source-to-result trace
- Locate the controlling requirement and establish authority.
- Identify the physical and digital boundaries.
- Preserve as-found state and timestamps.
- Trace the initiating condition through logic, interfaces, equipment, and process response.
- Compare expected and actual evidence.
- Calculate with units and stated tolerance.
- Record action, result, restoration, uncertainty, and owner.
Worked thinking prompt
A temperature reaches a supervisor through a legacy controller, serial gateway, IP network, and BACnet object, but no one owns the scale conversion.
Calculation: Count boundaries and dependencies, map addresses and transforms, and calculate end-to-end update and command-to-proof time.
Retrieval prompts
- What would normal look like in this mode?
- Which two independent observations would strengthen the conclusion?
- What result would disprove the leading hypothesis?
- Which action requires authorization or a qualified person?
- What must be restored and documented?
BACnet objects, properties, services, priorities, and conformance evidence
Why it matters: Object presence does not guarantee optional properties, services, writable behavior, units, priority support, or conformance; verify product claims and observed behavior.
Vocabulary and working scope
Device; AI/AO/BI/BO/AV/BV/MSV; properties; Status_Flags; Reliability; Out_Of_Service; Read/WriteProperty; Who-Is/I-Am; COV; events; schedules; trends; priority array; PICS; BIBBs.
Source-to-result trace
- Locate the controlling requirement and establish authority.
- Identify the physical and digital boundaries.
- Preserve as-found state and timestamps.
- Trace the initiating condition through logic, interfaces, equipment, and process response.
- Compare expected and actual evidence.
- Calculate with units and stated tolerance.
- Record action, result, restoration, uncertainty, and owner.
Worked thinking prompt
A tool reads Present_Value but the object is out of service, units are wrong, and a write at priority 8 never reaches the equipment.
Calculation: Reconcile object and property coverage, active priorities, COV/timing, status, and command-to-proof response.
Retrieval prompts
- What would normal look like in this mode?
- Which two independent observations would strengthen the conclusion?
- What result would disprove the leading hypothesis?
- Which action requires authorization or a qualified person?
- What must be restored and documented?
BACnet/IP, routing, BBMD/FDR, and BACnet/SC
Why it matters: BACnet/IP, BACnet/SC, and IT network reachability are related but distinct; allowed traffic must be explicit and application behavior must be proved.
Vocabulary and working scope
IP/subnet/VLAN; UDP; broadcast; network number; router; BBMD; BDT; FDR; TTL; duplicate network/device; NAT limitations; BACnet/SC; hub; TLS; certificate; migration.
Source-to-result trace
- Locate the controlling requirement and establish authority.
- Identify the physical and digital boundaries.
- Preserve as-found state and timestamps.
- Trace the initiating condition through logic, interfaces, equipment, and process response.
- Compare expected and actual evidence.
- Calculate with units and stated tolerance.
- Record action, result, restoration, uncertainty, and owner.
Worked thinking prompt
Devices discover locally but not across subnets, a foreign-device entry expires, and a proposed BACnet/SC hub has no certificate lifecycle owner.
Calculation: Calculate subnet and route coverage, BDT/FDR entries and TTL, packet/latency behavior, certificate lead time, and failure-domain impact.
Retrieval prompts
- What would normal look like in this mode?
- Which two independent observations would strengthen the conclusion?
- What result would disprove the leading hypothesis?
- Which action requires authorization or a qualified person?
- What must be restored and documented?
BACnet MS/TP and RS-485 token engineering
Why it matters: The token cannot fix the wire; screen discovery never replaces approved cable/topology, polarity, reference, termination, loading, grounding, and physical inspection.
Vocabulary and working scope
Twisted pair; polarity; reference; shield; termination; bias; daisy chain; stub; repeater; MAC; baud; max master; max info frames; token; unit load; error counters; capture.
Source-to-result trace
- Locate the controlling requirement and establish authority.
- Identify the physical and digital boundaries.
- Preserve as-found state and timestamps.
- Trace the initiating condition through logic, interfaces, equipment, and process response.
- Compare expected and actual evidence.
- Calculate with units and stated tolerance.
- Record action, result, restoration, uncertainty, and owner.
Worked thinking prompt
A trunk has long stubs, mixed baud, duplicate MAC, missing end termination, and one device that appears only after power cycling.
Calculation: Calculate segment/device loading, token rotation estimate, baud-related transfer time, error concentration, and before/after response.
Retrieval prompts
- What would normal look like in this mode?
- Which two independent observations would strengthen the conclusion?
- What result would disprove the leading hypothesis?
- Which action requires authorization or a qualified person?
- What must be restored and documented?
Modbus data model, registers, functions, encoding, and polling
Why it matters: A plausible number is not valid evidence until the complete register contract and physical/process comparison are proved.
Vocabulary and working scope
Client/server; RTU/TCP; unit ID; coils; discrete inputs; input/holding registers; function codes; zero/one-based notation; signed/unsigned; float; word/byte order; scaling; exception; poll.
Source-to-result trace
- Locate the controlling requirement and establish authority.
- Identify the physical and digital boundaries.
- Preserve as-found state and timestamps.
- Trace the initiating condition through logic, interfaces, equipment, and process response.
- Compare expected and actual evidence.
- Calculate with units and stated tolerance.
- Record action, result, restoration, uncertainty, and owner.
Worked thinking prompt
A meter value is 65,536 times too large, two devices share a serial address, and the gateway retries an unsupported function continuously.
Calculation: Convert addresses and raw values, test endian combinations, calculate poll-cycle/load and timeout/retry behavior, and compare engineering plausibility.
Retrieval prompts
- What would normal look like in this mode?
- Which two independent observations would strengthen the conclusion?
- What result would disprove the leading hypothesis?
- Which action requires authorization or a qualified person?
- What must be restored and documented?
LonWorks/LonTalk variables, binding, domains, and diagnosis
Why it matters: LonWorks connections behave like virtual wires; replacing or resetting a node without preserving identity, bindings, domain, configuration, and application can disconnect the system.
Vocabulary and working scope
Node; Neuron ID awareness; domain/subnet/node; network variable; input/output NV; SNVT; SCPT; enumeration; binding; functional profile; network manager; termination; channel; legacy service tool.
Source-to-result trace
- Locate the controlling requirement and establish authority.
- Identify the physical and digital boundaries.
- Preserve as-found state and timestamps.
- Trace the initiating condition through logic, interfaces, equipment, and process response.
- Compare expected and actual evidence.
- Calculate with units and stated tolerance.
- Record action, result, restoration, uncertainty, and owner.
Worked thinking prompt
A replacement node powers up but its output network variables no longer reach three bound controllers.
Calculation: Reconcile node and domain identity, binding counts, update/heartbeat timing, SNVT units/scaling, channel load, and missing-variable coverage.
Retrieval prompts
- What would normal look like in this mode?
- Which two independent observations would strengthen the conclusion?
- What result would disprove the leading hypothesis?
- Which action requires authorization or a qualified person?
- What must be restored and documented?
Proprietary legacy systems: PUP, N2, Teletrol, and documentation-first support
Why it matters: Legacy experience is not permission to experiment; preserve rare documentation, tools, licensing, media, backups, cables, and known-good hardware while protecting customer data.
Vocabulary and working scope
Installed proprietary bus; controller; supervisory tool; address; point type; sequence; polling; bridge; documentation; spare hardware; emulator; owner risk; end of support; read-only capture.
Source-to-result trace
- Locate the controlling requirement and establish authority.
- Identify the physical and digital boundaries.
- Preserve as-found state and timestamps.
- Trace the initiating condition through logic, interfaces, equipment, and process response.
- Compare expected and actual evidence.
- Calculate with units and stated tolerance.
- Record action, result, restoration, uncertainty, and owner.
Worked thinking prompt
A Teletrol controller serves occupied equipment, its last backup is unknown, and a replacement gateway claims generic serial support without a verified point contract.
Calculation: Count assets and unsupported dependencies, score documentation/backup coverage, calculate polling and outage risk, and estimate migration verification effort.
Retrieval prompts
- What would normal look like in this mode?
- Which two independent observations would strengthen the conclusion?
- What result would disprove the leading hypothesis?
- Which action requires authorization or a qualified person?
- What must be restored and documented?
Gateways, transforms, timing, quality, command, and fallback
Why it matters: A gateway is an application with hidden state and blast radius; every transform and failure mode requires source, destination, ownership, test, and rollback.
Vocabulary and working scope
Gateway; protocol conversion; point map; scale; units; enum; quality; stale; timestamp; poll/cache; write path; priority; heartbeat; watchdog; default; failover; health point; ownership.
Source-to-result trace
- Locate the controlling requirement and establish authority.
- Identify the physical and digital boundaries.
- Preserve as-found state and timestamps.
- Trace the initiating condition through logic, interfaces, equipment, and process response.
- Compare expected and actual evidence.
- Calculate with units and stated tolerance.
- Record action, result, restoration, uncertainty, and owner.
Worked thinking prompt
A gateway continues serving cached normal values after its source bus fails and accepts writes without returning equipment proof.
Calculation: Calculate end-to-end latency, cache/stale thresholds, poll/write load, scale and enum transforms, command/proof timeout, and affected-point blast radius.
Retrieval prompts
- What would normal look like in this mode?
- Which two independent observations would strengthen the conclusion?
- What result would disprove the leading hypothesis?
- Which action requires authorization or a qualified person?
- What must be restored and documented?
Retrofit, coexistence, migration, cutover, cybersecurity, and life safety
Why it matters: Do not modernize by erasing the old truth; baseline, shadow comparison, owner authority, safety/critical interfaces, support window, backup, abort, and rollback precede cutover.
Vocabulary and working scope
Survey; inventory; coexistence; read-only phase; shadow points; pilot; segmentation; remote access; credentials; vulnerability; safety interface; impairment; cutover; rollback; acceptance; owner operations.
Source-to-result trace
- Locate the controlling requirement and establish authority.
- Identify the physical and digital boundaries.
- Preserve as-found state and timestamps.
- Trace the initiating condition through logic, interfaces, equipment, and process response.
- Compare expected and actual evidence.
- Calculate with units and stated tolerance.
- Record action, result, restoration, uncertainty, and owner.
Worked thinking prompt
A hospital wing depends on a legacy interface that also reports smoke-control status, and the proposed gateway replacement changes network behavior.
Calculation: Calculate point and mode coverage, parallel comparison error, outage and rollback time, recovery objective, risk/exception counts, and acceptance pass rate.
Retrieval prompts
- What would normal look like in this mode?
- Which two independent observations would strengthen the conclusion?
- What result would disprove the leading hypothesis?
- Which action requires authorization or a qualified person?
- What must be restored and documented?
Integration commissioning, fault isolation, recovery, as-builts, and defense
Why it matters: Integration is complete only when required reads/writes, quality, timing, alarms/trends/schedules, physical response, failure/fallback, recovery, security, as-builts, and ownership all pass.
Vocabulary and working scope
Readiness; point contract; layer test; normal/fault/restart; packet/log evidence; issue/retest; temporary state; backup; clean restore; topology; addressing; maps; credentials escrow boundary; training.
Source-to-result trace
- Locate the controlling requirement and establish authority.
- Identify the physical and digital boundaries.
- Preserve as-found state and timestamps.
- Trace the initiating condition through logic, interfaces, equipment, and process response.
- Compare expected and actual evidence.
- Calculate with units and stated tolerance.
- Record action, result, restoration, uncertainty, and owner.
Worked thinking prompt
A mixed-protocol lab passes normal reads but fails after gateway restart and leaves one command active at an undocumented priority.
Calculation: Reconcile requirements/tests/issues/retests, calculate availability/latency/RPO/RTO, account for every target and temporary state, and quantify unresolved risk.
Retrieval prompts
- What would normal look like in this mode?
- Which two independent observations would strengthen the conclusion?
- What result would disprove the leading hypothesis?
- Which action requires authorization or a qualified person?
- What must be restored and documented?
Required and deeper reading
- ANSI/ASHRAE Standard 135-2024 scope route
Current published BACnet standard scope and edition route; adopted project edition and addenda govern. - Working with BACnet
Engineering-library reference for objects, properties, services, networks, and evidence-driven troubleshooting. - BACnet for Field Technicians
Field-oriented BACnet identity, MS/TP, IP, routing, command, and troubleshooting context. - BACnet Secure Connect
Official BACnet/SC architecture and secure datalink context; product support and owner PKI policy govern implementation. - Modbus Organization specifications
Official current protocol specifications and implementation guides; use the current serial guide for new work and legacy documents only for installed-system support. - Modbus Application Protocol V1.1b3
Engineering-library working reference for data model, addressing, function codes, exceptions, and register interpretation. - LonMark functional profiles and resource files
Current official network-variable, SNVT, SCPT, enumeration, binding, and interoperability concepts. - LonTalk protocol specification
Engineering-library legacy protocol detail for installed-system support; do not present it as a new-system default. - PUP v8.36 reference
Legacy proprietary integration evidence for installed systems only; protect customer configurations and document limitations. - Teletrol programming guide
Legacy controller/programming evidence for installed-system diagnosis and migration planning. - ASHRAE Guideline 13-2024
BAS architecture, hardware, communications, programming, testing, documentation, cybersecurity, and legacy-system framework. - NIST SP 800-82 Rev. 3
Current OT security guidance for accounts, segmentation, remote access, monitoring, change, and recovery.