Three layers, one governed platform.
The field layer is being solved: Thread and SRP let sensors register themselves without a proprietary hub. The control layer is settled: BACnet, Modbus, KNX, and DALI run the systems you already own. The layer nobody has standardized is the one above — governed composition between independent systems. That's where CMS Buildings sits.
How a modern building stack is layering out.
Smart buildings are converging on a three-layer shape. Each layer solves a genuinely different problem, and the protocols that win at one layer are the wrong tool at the next.
Field layer
Thread (IEEE 802.15.4) and SRP let low-power sensors and actuators advertise themselves onto the building network directly — self-discovering deployment, no proprietary hub in the middle.
Control layer
BACnet/IP and BACnet/SC, Modbus, KNX, and DALI carry deterministic control and object semantics for HVAC, lighting, metering, and safety. This layer is mature and going nowhere.
Orchestration layer
Correlating across those silos — with access scoping, an audit trail, and AI that can propose but not unilaterally act. This is the layer CMS Buildings occupies.
From broadcast chatter to unicast registration.
Classic zero-configuration networking finds services by shouting. mDNS floods a multicast group; BACnet's Who-Is / I-Am broadcasts across the subnet on UDP port 47808. That works on mains-powered wired gear and falls apart everywhere else.
- SRP (RFC 9665) replaces multicast with unicast DNS Update messages sent to a registrar
- Devices register their own services into a DNS zone — standard PTR, SRV, and TXT records
- Registration is authenticated with SIG(0); transport is secured with DTLS
- Far less radio airtime, which is decisive on battery-powered 802.11 and 802.15.4 networks
- Natively supported in Thread and OpenThread, and resolvable by Android, Windows, Linux, and Apple clients
The practical consequence for a portfolio: wireless occupancy and temperature sensors can be deployed by the hundred and register themselves, instead of being hand-configured into a controller one at a time.
Every protocol solves its own domain, then stops at the boundary.
BACnet defines how HVAC devices talk. KNX and DALI define how lighting and shading are commissioned and controlled. Modbus moves registers. Each is excellent inside its domain and silent outside it — so making a lighting system and a security system cooperate has traditionally meant a bespoke gateway and a hardcoded IP address.
Discovery answers “what exists”
SRP will tell the network a chiller is reachable at an address. It has nothing to say about which chillers ran hot this week, who is allowed to ask, or what happened when someone changed a setpoint.
Control answers “what it means”
BACnet's object model gives an analog input real semantics. That semantic richness stops at the BACnet network boundary — it does not compose with the access system or the tenant billing platform.
Nothing answers “who may compose it”
An emerging approach called CNS/CP proposes named Connection Profiles, with systems declaring provider or consumer roles and composing by context rather than by IP address. It names the gap precisely.
CNS/CP is an emerging approach, not a ratified standard on the footing of RFC 9665 — we describe it here because it articulates the problem well. The gap it names is real today, and the sections below are what CMS Buildings ships against it.
The protocol landscape.
How the discovery, orchestration, and control protocols compare on the dimensions that matter when you are designing a portfolio-wide architecture.
This table describes the industry protocol landscape — it is not a list of protocols CMS Buildings connects to. For what the platform supports today, see API & Connection Nodes.
| Feature | SRP / DNS-SD | CNS/CP | BACnet | Modbus | Thread |
|---|---|---|---|---|---|
| Primary use case | Service discovery & naming | Secure system orchestration | Building automation control | Simple data acquisition | Low-power wireless mesh |
| Discovery model | Unicast DNS Update (dynamic) | Connection Profiles (context) | Who-Is / I-Am broadcast, or DNS-SD | None — manual configuration | SRP / DNS-SD native |
| Data model | DNS records (PTR, SRV, TXT) | Named profiles & metadata | Object-oriented (analog / binary) | Flat registers (coils / holding) | IPv6 packets |
| Transport | UDP / TCP (DNS) | Agnostic (overlay) | UDP/IP, RS-485, Ethernet | TCP/IP, RS-485, RTU | IEEE 802.15.4 (6LoWPAN) |
| Security | DTLS / SIG(0) | Built-in secure profiles | BACnet/SC (TLS 1.3) | None native — relies on network | DTLS / network layer |
| Scalability | High (DNS hierarchy) | Very high (federated) | Medium (broadcast limits) | Low (bus limits) | High (mesh) |
| Standards status | RFC 9665 (IETF) | Emerging — not standards-body ratified | ISO 16484-5 | De facto industry standard | IEEE 802.15.4 / Thread Group |
These protocols are complementary, not competing.
A realistic portfolio deployment uses all three layers at once. Nothing here requires replacing the control layer you already run.
Sensors register themselves
Thread sensors advertise services over SRP onto the local DNS zone as they are installed — no per-device controller configuration.
A gateway translates into BACnet
DNS-SD discoveries are mapped into BACnet device objects, so the existing BMS sees them as ordinary points with no changes to the control layer.
CMS Buildings scopes and normalizes
Points land in governed surfaces with access scope attached, normalized against a schema, and retained across cold, warm, and hot tiers.
Systems compose without hardcoded addresses
The BMS, the security system, and cloud services interact through named, access-scoped queries — not fragile broadcast domains or pinned IPs.
Governed composition, on top of the systems you already run.
Discovery tells you what exists. The orchestration layer establishes what is true, who may ask, and what happened — none of which any field or control protocol was designed to carry.
- Named queries that are simultaneously an API endpoint and an AI tool — one governed answer, identical for every consumer
- Scoped surfaces, so tenant, owner, and vendor each see exactly their slice
- AI can propose changes, but acceptance stays human — there is no accept tool exposed to any model
- An immutable provenance trail covering people and AI actors alike
- Whole capabilities packaged and hosted in your own tenant — a lighting capability wrapping KNX, an HVAC capability wrapping BACnet
- Portable, git-backed configuration you keep running if you stop paying us
See where your portfolio sits across the three layers.
We'll map your existing BMS, field devices, and integration gaps against this architecture — and show what CMS Buildings governs on day one.