Software can be purchased from manufacturers, distributors, representatives, discount stores, and computer specialty stores. Software price, support, return policies, and distribution vary from vendor to vendor. During installation, most software displays a detailed software license granting use rather than ownership of the software program. This license gives specific restrictions on how the software is to be used. Most high-volume software does not offer direct support, but many software companies offer pay-per-incident and other fee arrangements if desired. Many applications have online discussion groups or message boards, where solutions to problems may be found. With the advent of cloud computing, software subscription services are becoming more common, allowing users to purchase access to software for a period of time rather than purchase a physical product. Besides proprietary software tools, HVAC applications are widely available as open source software. Following are some of the open source licensing types.

Freeware is copyrighted software that is free. The user can run the software, but must obey the copyright restrictions.

Public domain software is available to the public for little or no charge. Public domain software, which is not copyrighted, is often confused with freeware, which is copyrighted. Public domain software can be used without the restrictions associated with copyrighted software.

Shareware is software available for users to try before buying it; after the trial period, users are expected to register or stop using the application. There is usually a nominal registration fee.

Using an existing software package is usually preferable to designing a custom application, which is much more expensive and potentially riskier. This is especially true for large, mission-critical software such as client-server applications. If, after careful evaluation, prepackaged software will not suffice, the choice must be made between in-house and outside development. Custom software can be (1) contracted out to a specialized firm, (2) developed solely by internal staff, or (3) developed by internal staff with consultation help by an outside firm.

Contracting to an outside firm involves hiring a specialized outside party to define, estimate, schedule, and create the software. Funds should be budgeted for the outside organization to support modifications or enhancements not specifically covered in the contract. Contracting outside is suitable for an organization that does not have the resources or expertise to accomplish the project. Disadvantages of this approach include the expense and lack of control over the program. Licensing and ownership issues must be defined in the contract.

Developing the program internally is viable only if the skills and resources are available. Internal projects are easier to control because the people involved are co-located.

Consultation help from an outside firm involves a skilled outside party assisting internal staff, who may have insufficient skill in the area on their own. Outside firms can provide expertise to get a project going quickly. Long-term support and maintenance of the software are done in-house.

Specifications are key to the success of a software project. Calculations, human interface, reports, user documents, and testing procedures should be carefully detailed and agreed on by all parties before development begins. Software testing should be specified at the beginning of the project to avoid the common problem of low quality resulting from hasty and inadequate testing. Design testing should address the human interface, a wide range of input values including improper input, the various functions, and output to screen, disk, or other media. Field tests should include conditions experienced by the final users of the software.

With any development approach, good, understandable documentation is required. If for any reason the software cannot be adequately supported, the program will have to be replaced at substantial cost.

HVAC application software is written in a variety of computer languages. Most commercial software is written in C++, C#, or C, to allow fast speed and efficient use of resources. In addition, there are several programming and scripting languages such as Python, JavaScript, Ruby, Perl, and Swift used for web and mobile computing and customized software applications. The choice of programming language depends on several factors, including the programming paradigm (e.g., compiled versus interpreted, procedural versus functional versus object oriented), operating system, memory requirements, development environment, and user-interface features. The targeted deployment platform (e.g., stand-alone desktop, web-based application, a combination of both) often determines the programming language used. It is also more common to see several programming languages used to develop independent components of a software application and then integrated to deliver an end-user software tool. For example, energy simulation software tools use a procedural programming language to perform the calculations but use a different programming language for multiplatform user-interface development.

In addition, there are special application programming languages, such as MATLAB and R, used for mathematical programming and analysis of large amounts of data.

In the context of HVAC&R, big data tends to refer to the use of predictive analytics, user behavior analytics, sentiment analytics, operational analytics, or certain other advanced data analytics methods that extract value from data. Analysis of data sets can find new correlations to spot use trends, equipment interoperability problems, and so on.

With the explosive growth of the IoT, there are more connected devices offering more information than ever before. The ability to analyze this data has also vastly improved. Intelligent analytics tools have meant that data sets that previously would have been far too large to analyze for traditional methodologies are now a valuable source of insight into how to improve systems and behaviors. For instance, facility managers are now able to gather information from thousands of data points in a building. The installation of a vast array of information-gathering and intelligence/analytical technologies (e.g., smart sensors, smart meters, smart breakers) to inform operational decisions can be crucial to operator oversight of a facility.

Using data analytics, large volumes of building data can be transformed into actionable information that targets underlying problems and creates opportunities for energy savings. This type of management can save up to 20% annually on maintenance and energy costs by refining service programs and achieving optimal building performance and cost effectiveness. For example, with smart HVAC systems and the right sensors, a building manager can be made aware of system leakages where cool air may be migrating from the building, causing energy loss overnight.

HVAC companies often develop their own mobile application platform for their employees. However, to provide HVAC industry members with tools necessary to the industry, ASHRAE has supported development of several mobile applications. The applications are intended provide members with tools that can be used quickly in the field to check compliance with ASHRAE standards and equipment performance. The following is a brief introduction into some of the most commonly used ASHRAE supported applications.

Psychrometric App. The ASHRAE HVAC Psychrometric App is designed for users to easily view a psychrometric map while out in the field. This app allows users to plot points and processes on a fully customizable psychrometric map. Then, if necessary, results from the points can be shared via e-mail for later use. Figure 2 shows the standard home page of an example psychrometric chart. Cross hairs enable the user to know exactly where the cursor is pointing on the map. To plot, users double-tap on a point in point mode.

Because it is only available on iPad^® or iPhone^®, this application is intended for users who are in the field or in a conversation with a customer when full use of their tools is not available. For this reason, both individual point processes and a PDF of a psychrometric chart can be e-mailed using the e-mail icon.

Figure 2. Psychrometric Chart Example

Duct Fitting Database. This application, based on ASHRAE’s desktop Duct Fitting Database tool, allows users to produce pressure loss calculations for the more than 240 ASHRAE duct fittings from the field. Calculations can be in SI or I-P units and can easily be shared via e-mail for further use or analysis.

90.1 Energy Cost Budget Application. This ASHRAE-sponsored tool enables users to model compliance with ASHRAE Standard 90.1-2010. This application follows the energy cost budget form in the User’s Manual (ASHRAE 2016a) and allows users to enter all available site details and then export the data into the energy cost budget report in Excel^®. This application is web based, and the data can be accessed via any device that has Internet access.

HVAC ASHRAE 62.1. This application allows users to perform calculations from the 2007 and 2013 versions of ASHRAE Standard 62.1,Ventilation for Acceptable Indoor Air Quality. It loosely follows the 62MZCalc.xls Excel^® spreadsheet from the ASHRAE (2016b) 62.1 User’s Manual for each project; however, as with most applications, the capabilities exceed that of manual entry documents. Users can create an unlimited number of projects. Each project can be created quickly, and calculation results can be shared via e-mail for a detailed analysis when the user is no longer in the field.

HVAC PT Chart Application. This application makes quick calculations of refrigerant properties in the field. Users can choose the refrigerant and units they are interested in to obtain refrigerant pressure or temperature.

HVAC Duct Sizer Mobile Application. This application is simple compared to some of the others described here, which involve more intricate calculations. However, it is still useful for easy field calculations: it allows users to size ducts based on airflow and or dimension. To get to these calculations, the user simply follows the appropriate prompt.

Keeping devices that support HVAC control systems secure requires some basic security practices and procedures. These procedures can be used for company-owned devices but are also applicable for personally owned devices.

The best practices for all electronic devices (e.g., PCs, laptops, tablets, phones) are very similar. Listed here are some tips to improve the security posture of these devices.

Users should not connect to untrusted networks or systems. Many control systems have been connected to the Internet to provide convenient, 24/7 operation and maintenance support, remote monitoring capabilities, and data collection for analysis. However, most control systems have not been designed to operate in the cyber-contested environments that have had negative effects on critical infrastructures throughout the world. Until control systems have robust security measures integrated throughout the equipment stack, it is recommended that these systems remain in an isolated network environment that connects only to trusted, secure networks.

If circumstances do not allow isolation, then remote connections or any other connections from or into the control system network to other networks should be through a protected communications channel such as a virtual private network (VPN).

It is important to use an appropriate account. Everyday web browsing does not require administrative privileges. Using an account with security privileges that are too high creates greater vulnerability.

Only dedicated devices should be used for control systems. To save money, many devices are used for multiple purposes and are connected across multiple networks. However, this introduces inherent risk that can propagate viruses, ransomware, and other malware across multiple systems. Due to the lack of cybersecurity resilience, it is recommended that users avoid this practice to minimize potential contamination of the control system environment.

Users can take the following steps to increase security:

For detailed guidance, consult the NIST Standard SP 800-63-3, Digital Identity Guidelines.

Software updates are important to install. They are usually provided to fix problems with a current version of the software that may lead to poor performance or put the device at risk. If a device is company owned, there should be guidelines or policy governing updates. If a program is no longer supported and is not being updated, it should be removed from the device.

System updates update the software that runs a device. Devices may be configured to tell users when these are available, if connected to the Internet (not recommended practice). Application updates update a specific application or suite of applications. Many applications inform users of available updates, but some may require periodic checks if connected to the Internet (again, not recommended practice).

Only software from known sources should be installed. Random apps should not be installed, because they may disguise malware. Programs or apps to be installed should also be approved by IT personnel. It is essential to have antivirus software installed (often for little to no cost).

Back-up is also critical; in the event of a ransomware attack (wherein files are encrypted and a price demanded to regain owner access), it is the best method to recover files. Only dedicated devices and software services for control system operations should be used. Avoid software services such as e-mail and personal web browsing. These two services are the primary attack vectors into private systems such as control system networks. Removing these two services will greatly enhance the security of the system.

If web browsing or e-mail cannot be disabled, precautions are recommended.

Numerous software applications are currently used in the cycle of building/facility design, construction, and operations and maintenance. These software applications are tools that support practitioners in their work processes in each of these stages. The extent to which these tools are adopted is based on industry segment, company/firm, and individual practitioner methods. However, the overall trend is toward increased use and more rapid change both in individual tools and in industry practices.

As evidenced by the (incomplete) list of software applications provided, ASHRAE members and other professionals in the buildings industry use a wide variety of computer software applications. Historically, these applications have generally been stand-alone desktop tools, using unique custom, and often proprietary, data models to describe the information they require. Moving from one application to another (e.g., between architectural and mechanical design and energy simulation) has required manual recreation of often similar building information in different formats. This process consumes considerable time and effort and invites error in the different models of the same building.

BIM technologies and procedures have been developed over the past several decades to address this problem. The benefits of automated data exchange between disparate software tools, often referred to as data interoperability, have been recognized for years, but such exchange has still not reached a level of wide adoption. However, BIM has recently been gaining traction, especially in the design and construction stages of the building life cycle.

ASHRAE resources on BIM and data interoperability include the following:

BASs can be applied to achieve several different goals and outcomes, often simultaneously. Example applications include

BAS components are usually arranged and interconnected in a hierarchical structure that can be described in four tiers (Figure 3).

Tier 1 comprises enterprise and site connectivity devices, which includes web servers, user interfaces, trend databases, time schedules, analytics, demand response, load shed protocols, IP Backbone, VLAN, and the Web. This tier is often the point of connection for remote access and for data sharing with external optimization services. This is also the point that represents a cybersecurity risk from outside the network and requires coordination with building network personnel to maintain security while allowing the necessary connectivity.

Tier 2 is the building infrastructure and includes components that bridge Tiers 1 and 2. This may include routers that interconnect building systems such as HVAC and lighting for access to Tier 1. This tier is usually IP based and may also contain network controllers that operate equipment directly, such as a variable speed drive or programmable controllers. This is also the tier where open building control protocols such as BACnet^® or LonWorks^® originate to connect subsystem components.

Figure 3. Tiers of BAS (ASHRAE Guideline 13)

Tier 3 contains application-specific controllers (ASCs) that control equipment or subsystems. ASCs can interconnect to other system components through the building control network but are generally used as the main controller of equipment and may include the point of connectivity to system sensors.

The last tier contains sensors and end devices such as relays and actuators. In general, components on this level do not contain any control logic and are either input or output devices. The advent of network sensors and other devices may alter the structure whereby the devices connect from the last tier directly to Tier 2.

In the past, because all major HVAC equipment required some type of control system, control points were duplicated. Adoption of communication standards has greatly reduced total control costs and increased functionality by providing information (e.g., part-load performance criteria) to users that was previously only available from manufacturer testing. As the functionality of component control increases and associated cost decreases, component-level interaction makes building-wide system integration less critical.

HVAC manufacturers use DDC microprocessors to create powerful, low-cost controls and feature-rich equipment. In the past, many control devices were proprietary and information was not shared between manufacturers. With standard communication protocols, diverse applications such as HVAC, energy, security, lighting, and fire controls in large buildings can use a single integrated control system.

Standard protocols allow application-specific component control systems designed for particular HVAC equipment to be included in building-wide strategies. For example, low-cost componentized DDCs provide operation, safety, maintenance, and even self-diagnostic information and control functions. Making a chiller or a variable-speed drive controller a part of a cohesive, building-wide control system is now possible because of standard protocols.

Standard communication protocols are developed in committee by professional societies, open protocols are created by manufacturers but available for all to use, and proprietary protocols are developed by manufacturers but not freely distributed. User needs should be determined before selecting a particular protocol for a given application. There are two major standard protocols used in HVAC building automation today: BACnet^® and LonWorks^®.

BACnet is the ASHRAE Standard 135 Building Automation and Control Networks Protocol. It provides mechanisms by which computerized equipment for a variety of building control functions may exchange information, regardless of the particular building service it performs. As a result, the BACnet protocol may be used by head-end computers, general-purpose direct digital controllers, and application-specific or unitary controllers. Working groups represented in BACnet include lighting, life safety, elevators, smart grid, security, network security, utility integration, wireless networking, and XML applications. BACnet is based on a four-layer collapsed architecture that corresponds to the physical, data link, network, and application layers of the ISO/OSI (International Organization for Standardization Open Systems Interconnection) model. The application layer and a simple network layer are defined in the BACnet standard.

The physical layer provides a means of connecting devices and transmitting the electronic signals that convey the data. BACnet devices often use Ethernet networking, and can coexist with PCs on the same network.

The data link layer organizes the data into frames or packets, regulates access to the medium, provides addressing, and handles some error recovery and flow control.

Functions provided by the network layer include translation of global addresses to local addresses, routing messages through one or more networks, accommodating differences in network types and in the maximum message size permitted by those networks, sequencing, flow control, error control, and multiplexing. BACnet is designed so that there is only one logical path between devices, thus eliminating the need for optimal path routing algorithms.

The presentation layer provides a way for communicating partners to negotiate the transfer syntax used to conduct the communication. This transfer syntax is a translation from the abstract user view of data at the application layer to sequences of octets treated as data at the lower layers.

The application layer of the protocol provides the communication services required by the applications to perform their functions, in this case monitoring and control of the HVAC&R and other building functions.

LonWorks defines a protocol for interoperability between control and automation devices. Task groups represented in LonMark include HVAC, fire, industrial, lighting, vertical transportation (elevators), automated food service equipment, home/utility, network tools, refrigeration, router, security, semiconductor, sunblinds, system integration, and transportation. Building automation system networks are local area networks, even though some applications must exchange information with devices in a very distant building.

BAS designs have many vectors for manipulation by unauthorized personal. These include physical access to equipment and controls and access through the BAS control networks. Security measures must be weighed against the risk associated with unauthorized manipulation. Physical building security measures are discussed in Chapter 61. ASHRAE Guideline 13 also has guidance on physical and cybersecurity measures.