KMG Clinics: A Pioneer in Implementing BACnet/SC

KMG Clinics: A Pioneer in Implementing BACnet/SC

The highest demands on their building automation infrastructure led KMG Clinics to make a forward-looking decision: the healthcare provider relies on BACnet/SC security technology, including the Universal BACnet Router from MBS GmbH, for cross-site data communication.

Founded in 1991, KMG Clinics is a healthcare company providing medical and nursing care. At around two dozen locations – from Güstrow in Mecklenburg-Vorpommern to Sömmerda in Thuringia – the facilities offer healthcare from a single source: acute care, rehabilitation, and nursing. With its headquarters in Bad Wilsnack (Brandenburg), the healthcare provider places the highest demands not only on medical technology and professional expertise but also on the infrastructure of its building automation.

The group includes eight acute care clinics and two rehabilitation facilities with a high level of building automation. At these ten sites, systems from seven different manufacturers had been in use, some of which were 25 to 30 years old. “To operate this infrastructure in a future-proof way and ensure 1st line support, we decided in 2020 to implement a unified solution,” recalls Frank Niemann, Managing Director of Service Companies, Technology at KMG Clinics.

A Forward-Looking Solution

The plan was to create cross-site data exchange between a new central management control system in a Berlin data center and the ten sites. In the future, no more than two different automation systems were to be in use. It was also essential that technicians could access systems remotely from any location. At the same time, the new solution needed to meet the latest security standards. When the project launched in 2021, the goal was to successively modernize all sites by 2033, with automation priorities defined to be upgraded in parallel.

The concept was developed by EliteBuildingArchiTec Germany GmbH, led by Christian Hofer – a Berlin-based engineering firm specializing in planning, project management, consulting, and development in building automation. The engineers carried out on-site assessments and designed the project. Since many devices in the hospital network already used the BACnet/IP bus protocol, the decision was made to implement the new secure infrastructure: Secure Connect (BACnet/SC).

BACnet/SC uses the TCP protocol – a proven method from network management – combined with real-time TLS 1.3 encryption. This makes internet-based data communication faster and more secure with standard routers. The BACnet/SC topology is also backward-compatible, allowing hybrid operation via a corresponding router. After the tender process, Stolle Industries GmbH in Leipzig was awarded the contract to implement the concept.

Data Exchange: Network and Local

At KMG’s Berlin data center, an overarching building management system from Delta Controls was first installed. However, a technical solution was also needed to ensure that local data exchange would still function if the connection to the central control failed. “Initially, we didn’t even consider that the connection to the central unit could occasionally fail – for example, due to human error, a misconfigured firewall, or provider maintenance,” says Niemann. For an acute care clinic, however, it is essential that functions such as lighting and ventilation remain continuously available – a requirement also mandated by law.

“Since Krefeld-based MBS GmbH gateways were already being used for local data communication, we tested their routers for this purpose,” explains Tino Erler, Project Manager, SI Building Automation. The MBS Universal BACnet Routers (UBR) are essential interfaces for industrial and building automation because they can connect BACnet networks across different technologies. “Since the routers support encrypted BACnet/SC communication, they are ideally suited for building such architectures,” emphasizes Tobias Plath, Head of Global Business Development and Sales, MBS GmbH, Krefeld. Each router can handle up to 50 BACnet/SC connections.

In addition to excellent test results, the professional collaboration between SI Building Automation and MBS contributed to the decision to deploy one UBR-01 router per KMG site. Importantly, it could be integrated into the existing infrastructure without interrupting operations. “Despite running IP and SC devices in parallel, we were able to route the entire IP network into the SC network within minutes – a huge relief,” says Erler. Acting as a hub, the router not only manages local data traffic between devices but also communication with the central control room. In the future, each site will be equipped with a second UBR-01 as a “failover hub,” as specified by the BACnet/SC topology.

Operational Security Comes First

The biggest challenge for SI Building Automation has been creating certificates for encryption, which currently must still be generated and distributed manually. This time-consuming process is expected to be automated, as provided by the BACnet/SC standard starting in 2024.

What other lessons have the stakeholders learned? “It is absolutely essential to involve IT from the very beginning, because without them, operational security of building automation cannot be achieved,” stresses Sebastian Stolle, CEO of SI Building Automation.

In addition, thorough review of existing documentation is crucial for such projects. With systems over 25 years old, documentation is often incomplete or inaccurate. “We even discovered small control cabinets that no one remembered – not even older colleagues,” Niemann notes with a smile. Today, however, the new structure covers the entire installed device base.

Germany’s Largest BACnet/SC Network

With this implementation, KMG Clinics can now claim to operate the first – and as of 2025, the largest – BACnet/SC network in Germany. In 2021, the Güstrow site, with 30 native SC devices, was the first to be connected to the Berlin data center via BACnet/SC – initially as a stand-alone solution. Other sites have since been upgraded, integrated, or are scheduled for conversion according to the rollout plan. From the outset, the network has operated stably and at the highest security level.

As Hofer concludes: “This visionary solution became reality because everyone involved – from planners to executives – shared the determination to think long-term and put operational security first.”