Latest / NOXTalks / The Clock Your BAS is Running On

Transcript

The Clock Your BAS is Running On · NOXTalks

0:07
SPEAKER_01: Welcome to Nox Talks, the AI-generated podcast exploring the groundbreaking ways technology shapes our built environment.
0:14
SPEAKER_01: Today we're diving into the clock your building automation system is running on.
0:18
SPEAKER_01: And why so many buildings only discovered they had one when Windows 10 reached end of support.
0:24
SPEAKER_01: Here's the uncomfortable pattern.
0:26
SPEAKER_01: Too many operators treat the BAS like furniture.
0:30
SPEAKER_01: Install it, commission it, and then forget it.
0:34
SPEAKER_01: It sits in the plant room, quietly running the HVAC, and nobody asks how old the operating system underneath it is.
0:41
SPEAKER_01: Then October 14th, 2025 arrived and normal support ended for mainstream Windows 10 releases.
0:47
SPEAKER_01: Extended security updates and certain LTSC editions created exceptions, but only for owners who knew exactly which edition they were running and had a documented patching path.
0:58
SPEAKER_01: That deadline forced facilities teams to examine systems they'd rarely treated as lifecycle assets.
1:04
SPEAKER_01: It exposed something bigger than one operating system.
1:07
SPEAKER_01: It exposed a budgeting blind spot.
1:09
SPEAKER_01: Think about how the IT department handles a laptop fleet.
1:13
SPEAKER_01: There's a refresh cycle.
1:15
SPEAKER_01: Three years, maybe four, and it's a funded line item.
1:19
SPEAKER_01: Planned, boring, predictable.
1:21
SPEAKER_01: Now compare that to the head-end computer supporting the BAS.
1:25
SPEAKER_01: Some industry sources put the optimal controls refresh window around seven to ten years.
1:31
SPEAKER_01: But that's a planning rule of thumb, not a universal expiration date.
1:36
SPEAKER_01: Servers, software, supervisory controllers, and field devices can all run on different clocks, and yet many buildings still have no formally funded controls refresh plan.
1:47
SPEAKER_01: Obsolescence gets treated as an emergency when it hits, not as a lifecycle line item you saw coming five years ago.
1:54
SPEAKER_01: Ashray has addressed legacy control systems for years, and Guideline 13, the 2024 edition on specifying building automation systems includes dedicated guidance on them.
2:06
SPEAKER_01: One controls provider, Al Boreo Energy, recently used more than 10 years as a practical screening threshold for legacy risk.
2:14
SPEAKER_01: That doesn't mean a 10-year-old system is broken or that age alone demands replacement.
2:19
SPEAKER_01: It means the system deserves a closer look, because it still works and it's still supportable, are two very different statements.
2:27
SPEAKER_01: A system can run flawlessly right up until the day a controller fails, and the replacement turns out to be a special order, a used part off an auction site, or a full rebuild.
2:39
SPEAKER_01: And support isn't one thing, it's a stack.
2:41
SPEAKER_01: Current software with security patches, replacement hardware you can actually source, technicians still trained on the platform, manufacturer guidance that still exists, compatibility with the newer equipment you'll inevitably connect, lose any layer, and the risk compounds quietly.
2:58
SPEAKER_01: Niagara operators know the story well.
3:01
SPEAKER_01: Tritium ended sales of Niagara AX licenses and legacy JACE replacements, and stop fixes for defects and cybersecurity issues on July 1st, 2021.
3:13
SPEAKER_01: Sites still relying on those legacy platforms have been operating beyond the normal vendor support path for years.
3:19
SPEAKER_01: So here's the reframe.
3:20
SPEAKER_01: The BAS isn't furniture.
3:23
SPEAKER_01: It's an operational technology asset built on IT components, and the Windows 10 scramble won't be the last one.
3:29
SPEAKER_01: Somewhere in the life of your current system, another operating system will sunset, another controller line will be discontinued, another protocol stack will age out.
3:39
SPEAKER_01: The question isn't whether it happens again, it's whether it lands as a planned project or a panic.
3:45
SPEAKER_01: Three practical moves.
3:47
SPEAKER_01: First, run a legacy checklist now before anything fails.
3:51
SPEAKER_01: What operating systems and versions support the head-end, workstations, databases, and appliances?
3:58
SPEAKER_01: And is each one on a current vendor support or documented extended support path?
4:04
SPEAKER_01: Are replacement parts getting harder to find?
4:06
SPEAKER_01: Has your service provider mentioned limited inventory?
4:09
SPEAKER_01: And the big one, if the system failed tomorrow, would recovery mean a repair or a rebuild?
4:16
SPEAKER_01: Second, get facilities, IT and cybersecurity working from the same lifecycle plan, with joint ownership and documented responsibility.
4:25
SPEAKER_01: When the control's budget sits entirely under facilities, the IT and security portions go invisible, right up until they become urgent.
4:33
SPEAKER_01: Third, build a multi-year modernization roadmap instead of waiting for the failure.
4:38
SPEAKER_01: Staged upgrades, starting with the highest risk components, whether that's software and servers, supervisory controllers, or field devices, spread cost across budget cycles and minimize disruption through the transition.
4:53
SPEAKER_01: Vendors will happily sell the upgrade.
4:56
SPEAKER_01: The discipline of phasing and funding it, that belongs to the owner.
5:00
SPEAKER_01: Because here's the powerful part.
5:02
SPEAKER_01: Every BAS has several clocks running.
5:05
SPEAKER_01: The operating system, the databases, the licenses, the controllers, the vendor support behind all of it.
5:12
SPEAKER_01: Owners who track those clocks choose when the money is spent and on what.
5:16
SPEAKER_01: Owners who ignore them let a failed hard drive, a discontinued controller, or someone else's end of support calendar choose for them.
5:25
SPEAKER_01: The only real decision is who's reading them.
5:43
SPEAKER_00: In the channels of life.