The Building Automation System Refresh: Why Your BAS Is Probably Older Than You Think

Earlier this week we introduced the broader question every Silicon Valley facility director is quietly wrestling with: how do you plan technology refresh cycles across a building portfolio that spans everything from 1998 office parks to 2022 lab-office hybrids? Today we're narrowing in on the single system that most often gets neglected until it fails catastrophically: the building automation system, or BAS.

Most property teams we work with in Santa Clara, San Jose, and Sunnyvale are running BAS platforms that were installed during a tenant improvement project a decade or more ago, then patched, re-pointed, and occasionally "integrated" with a new piece of equipment without anyone stepping back to assess whether the core system still makes sense. The result is a control layer that technically functions but can no longer talk to modern VAV boxes, can't support remote diagnostics your engineering vendor wants to run, and is one obsolete card away from a controls contractor telling you the part is no longer manufactured.

This post walks through how to actually evaluate your BAS, when a refresh is justified versus a targeted upgrade, what it costs in real 2026 numbers, and how to sequence the work without shutting down a fully leased building.

How to Tell Your Bas Has Aged Out

The clearest signal isn't age in years: it's whether the system is still on a supported communication protocol. If your building is still running proprietary protocols from legacy Andover Continuum, older Johnson Metasys N2, or first-generation Alerton BACtalk installations, you are already outside the support window most manufacturers maintain, and every service call becomes a scavenger hunt for parts on secondary markets.

A second signal is your controls contractor's response time. If your current vendor takes longer than 48 hours to diagnose a controller fault because they need to source a compatible technician who still remembers the old programming environment, that's a workforce problem as much as a technology one: the people who know these systems are retiring, and Silicon Valley's controls labor market has consolidated hard around BACnet/IP and Niagara-based platforms in the last five years.

Third, look at your utility bills relative to your peak demand charges from PG&E. A BAS that can't do true demand-limiting, optimal start/stop, or fault detection diagnostics is leaving 10-15% of HVAC energy spend on the table in a typical mid-rise office building: money that a modern front end with analytics would recover within 24-36 months on a system that size.

Finally, check whether your BAS can even support what your tenants are now asking for. Post-2023 lease negotiations in this market increasingly include requests for real-time indoor air quality dashboards, tenant-facing comfort apps, and after-hours HVAC self-scheduling through a portal. A head-end system from 2011 simply doesn't have the API architecture to deliver any of that without a bolt-on system that adds another point of failure.

Refresh Versus Rip-and-Replace: Making The Call

Not every aging BAS needs full replacement, and jumping straight to rip-and-replace is the most common overspend we see in this category. The decision usually comes down to three layers: field controllers, the network/communication backbone, and the front-end software/server.

If your field-level controllers (the boxes actually driving VAV dampers, chiller staging, and AHU sequences) are on an open BACnet MS/TP or BACnet/IP protocol, you likely don't need to touch them. You can often do a front-end migration only (swapping the aging supervisory software and server for a modern platform like Niagara N4, Distech, or a current-generation Johnson Metasys build) while leaving field controllers in place. This is typically 35-45% of the cost of a full replacement and can be completed building-by-building without touching occupied floors' mechanical rooms.

If, however, your field controllers are proprietary and end-of-life (no firmware updates, no replacement parts, manufacturer has issued an end-of-support notice), you're forced into a fuller replacement at the floor level, which means new controllers at every VAV box and AHU: a much bigger scope that touches ceiling tiles on every occupied floor.

A useful middle path we've deployed in several San Jose R&D campuses is a phased hybrid: replace the front end and network backbone first (gets you modern analytics, remote access, and cybersecurity patching immediately), then replace field controllers system-by-system over 24-36 months as each mechanical system comes up for its own scheduled maintenance or capital replacement. This spreads capital expenditure across budget cycles and avoids a single disruptive shutdown.

Budgeting and Sequencing Without Disrupting Tenants

For a mid-size Silicon Valley office building (say 150,000 to 250,000 square feet) a front-end-only BAS migration currently runs $180,000 to $320,000 depending on point count and whether you're integrating chillers, generators, and lighting controls into the same platform. A full field-level replacement across that same building typically lands between $850,000 and $1.4 million, which is why most owners we advise stretch the field-controller portion across multiple fiscal years rather than treating it as one capital event.

Sequencing matters as much as budget. We recommend starting with central plant and rooftop equipment controls first, since that work happens in mechanical rooms and on the roof: zero tenant disruption, and it's usually where the biggest energy savings and reliability gains live anyway. VAV box and terminal unit controller replacement, which does require entering occupied ceiling space, gets scheduled floor by floor during any existing tenant improvement work, off-hours access windows, or natural vacancy during lease turnover. This is the single biggest lever for minimizing tenant complaints: piggybacking controller swaps onto TI construction that's already displacing furniture and generating noise means you're not creating a second disruption event.

Don't overlook commissioning cost in the budget. A new BAS that isn't properly recommissioned against actual sequences of operation, not just the sequences on paper from 2009, will underperform and generate nuisance alarms for the first six months. Budget 8-12% of project cost for a commissioning agent, and insist on a 90-day post-occupancy tuning period written into your controls contractor's scope, not treated as a follow-up service call you have to chase down later.

Cybersecurity and Compliance Considerations That Should Drive Timing

A factor that didn't exist for most BAS decisions a decade ago is cybersecurity exposure, and it's now often the deciding factor in accelerating a refresh rather than deferring it. Older BAS front ends frequently run on unsupported Windows Server versions, sit on flat networks with no segmentation from tenant IT, and use default or shared credentials that haven't been rotated since installation. In a region with the density of tech tenants Silicon Valley has, a compromised BAS is a real vector, not a theoretical one, and several building owners we work with have had tenant IT security teams flag their BAS during lease renewal due diligence, which is not the conversation you want to have mid-negotiation.

California's Title 24 energy code updates also increasingly assume demand-responsive controls capability, occupancy-based ventilation, and fault detection diagnostics as baseline expectations for major renovations: meaning if you're pulling permits for any significant mechanical work, your existing legacy BAS may not even meet the control sequence requirements needed to close out the permit, forcing an unplanned and rushed controls upgrade at the worst possible moment in a project timeline.

Building this into your refresh planning means treating cybersecurity segmentation (a dedicated VLAN for BAS traffic, updated firmware policies, credential management) as a line item in the same capital request as the controls hardware, not a separate IT project that gets deprioritized later. Owners who bundle these decisions get better pricing from integrators and avoid the awkward situation of a brand-new BAS still running on an insecure network architecture.

Conclusion

A building automation system refresh is rarely glamorous, and it's easy to keep patching a legacy platform for another budget cycle. But the math on energy waste, unsupported hardware, tenant expectations, and cybersecurity exposure all point the same direction: the longer a legacy BAS runs past its protocol's supported life, the more expensive and disruptive the eventual replacement becomes. Treating it as a phased, budgeted, multi-year plan rather than an emergency response is what separates buildings that upgrade smoothly from ones that get stuck negotiating emergency parts sourcing during a August heat wave.

Later this week, we'll look at how this same refresh logic applies to physical security and access control systems, and close out the series with a full roadmap for sequencing all these technology decisions across a multi-building portfolio.

Cta

If your BAS hasn't been assessed against current protocol standards and cybersecurity baselines, MAFM's technology audit team can benchmark your existing system and build a phased refresh budget tailored to your building's occupancy and lease cycle: contact us to schedule a walkthrough.

Internal Links

Link to Monday's series-opening post on planning technology refresh cycles across a portfolio, and forward-reference Thursday/Friday's posts on security system upgrades and the full multi-system roadmap.

External Links

ASHRAE Guideline 13 (Specifying Building Automation Systems) and the California Energy Commission's Title 24 Building Energy Efficiency Standards documentation.