WO2008032014A1

WO2008032014A1 - Devices, systems and methods relating to management of a building' s internal environment

Info

Publication number: WO2008032014A1
Application number: PCT/GB2007/003251
Authority: WO
Inventors: Philip Bromfield; Graham Richard Whiting
Original assignee: Trend Control Systems Limited
Priority date: 2006-09-13
Filing date: 2007-08-28
Publication date: 2008-03-20
Also published as: GB0904578D0; GB2456688B; GB2456688A; GB0618039D0

Abstract

A system arranged to control the internal environment of a building includes a data network. The network comprises a plurality of networked devices associated with control of the building' s internal environment and a network-address server for supplying a network address to each networked device. A first device of the plurality of networked devices is configured to request from the network-address server a network address for said first device, and if no network address is supplied, supply itself with a fail-over network address. The first device is configured to broadcast to other networked devices within the network, if no network address is supplied, a signal or signals indicating that the network-address server has failed. A second device of the plurality of networked devices is configured to respond to the signal or signals broadcast by the first device by acquiring a fail-over network address compatible with the network address supplied by the first device to itself.

Description

Devices_/ Systems and Methods Relating to Management of a Building' s Internal Environment

Field of the Invention

This invention relates to Building Management Systems (BMSs) , that is systems for controlling the environment within a building. More particularly, although not exclusively, the present invention relates to networked BMSs. Even more particularly, although not exclusively, the present invention relates to networked BMSs that are associated with network address servers.

Background Art

The environment within a building changes in response to changes in outside weather conditions and to local changes within the building. A BMS typically monitors services including heating, air-conditioning and ventilation, and controls them in an attempt to provide an environment suitable for those within the building, whilst ensuring operation at or near optimal efficiency and economy. A good BMS attempts to satisfy operating requirements whilst taking into account environmental conditions and energy usage. A BMS also usually provides information to building managers or the like, to keep them informed of the status of the building' s services and environment .

A BMS comprises a plurality of elements, typically comprising the following.

Field device monitors monitor the environment within the building or outside it. In most installations, a plurality of monitors is provided inside the building, each monitoring one or more parameters of its own area of the building. Field device actuators provide direct control of one or more devices for changing the building's internal environment, either globally (the whole building) or locally to the actuator.

Controllers receive monitoring signals from field device monitors and, depending on those signals and according to predetermined operating parameters, send control signals to field device actuators to change the building' s internal environment .

Supervisors provide human-network interfaces to allow viewing or adjustment of system parameters. They often provide analysis and maintenance tools.

Networks provide interconnections between field devices, controllers and supervisors, allowing BMS elements to communicate with each other. The communications may be local (within a building) , across a wide-area network (WAN) or across the Internet to web browsers or other similar interfaces. Networks can thereby enable access to BMS data from within the building, at other buildings within a company or group, or anywhere in the world. Networks can be constructed using any suitable physical connections, for example electrical cables (for example Category 5e cables) , optical fibres, wireless communications (using free-space electromagnetic waves, for example optical, infra-red, micro- or radio waves), or any suitable combination thereof.

Until a few years ago, BMS networks were generally constructed using proprietary protocols, each typically developed by BMS manufacturers for their own particular systems. In the past few years, the growth of the Internet has made desirable the implementation in BMS networks of the TCP/IP protocol standard (on which the Internet is based) . However, BMSs have relatively low tolerance of network failure: loss of communication with one or more devices (e.g. field devices, controllers or supervisors) on a network can seriously impair operation of the BMS, and hence cause undesirable internal environmental conditions to develop in the building or parts thereof. A problem that can be particularly significant for BMS networks relates to IP addresses. The TCP/IP protocol system requires logical addresses to be assigned to devices linked by TCP/IP network. These logical addresses, usually referred to

5 as IP addresses, provide a networked device in a first network with an address that can be recognised in other networks (which may not recognise the physical addressing system used in the first network) .

IP addresses can be manually assigned to different

LO network devices. That addressing approach is referred to as "static" IP addressing. It has the advantage that each device is able to participate in the IP network almost as soon as the device is switched on. However, it has several disadvantages, including the fact that each device must be individually

L5 configured with its IP address, not only when it is first installed, but often also when significant changes are made to the network architecture (for example if the device is moved to a different part of the network) .

That problem can be overcome in an IP network by using

JO protocols such as the Dynamic Host Configuration Protocol

(DHCP) . In the DHCP approach, a computer or other device acts as a DHCP server, which provides IP addresses and other network configuration data to devices on the network. According to the DHCP scheme, when a networked device is first

>5 switched on, it broadcasts across the whole (local) network a DHCP Discover message to User Datagram Protocol (UDP) port 68. The message includes the physical address of the networked device. The DHCP server listens on UDP port 68; on hearing a DHCP Discover message, it broadcasts a DHCP Offer message to

SO UDP port 67. The message again includes the physical address of the networked device, and also includes the physical address and IP address of the DHCP server and a proposed IP address for the networked device. The networked device, listening on UDP port 67, responds to the DHCP Offer by

»5 broadcasting a DHCP Request message. That message contains the IP address of the DHCP server and the physical address of the networked device. The DHCP Request message acts as a formal request for assignment of the IP address by the DHCP server, and also as a formal declining of DHCP Offer messages received from any other DHCP server on the network. The DHCP server whose offer is accepted then completes the process by sending a DHCP Ack message, which includes the IP address to be assigned (usually together with other network information) . The DHCP Ack message also contains information on the length of the "lease", the period of time for which the assigned IP address will be valid. The period is configurable, but is usually set to several days (perhaps three to eight days) . (Detailed descriptions of how DHCP is implemented are readily available to persons skilled in the art; for example, see RFC 2131 at http: //www. ietf . org/rfc/rfc2131. txt . ) If for any reason no DHCP server is available when the networked device is switched on, or when its lease runs out, then it will be lost from the IP network, as it will not (or no longer) have a valid IP address. The device will make further attempts to acquire an address, but there may be a considerable delay before that is achieved. For the reasons set out above, that delay can be particularly problematic in a BMS installation.

Problems associated with DHCP server failure have been addressed using an approach known as Zero Configuration Networking or Zeroconf; the approach is also known as

Automatic Private IP Addressing or APIPA and as Internet Protocol Automatic Configuration (IPAC) . The Zeroconf approach provides a DHCP failover mechanism, so that networked devices are able to obtain IP addresses even when DHCP servers have failed. If no DHCP server responds to a networked device's DHCP Discover message, the networked device automatically assigns itself an address from the IP range 169.254.0.1 through to 169.254.255.254, a set of addresses known as "link-local" addresses. The device then broadcasts over the network an Address Resolution Protocol (ARP) query containing the self-assigned IP address (and the device's physical (Media Access Control (MAC) ) address, to see if any other device already has that IP address. If no device responds to the ARP query, the self-assigned address is adopted/ otherwise, the device selects a new link-local address for itself and sends out a further ARP query; the process is repeated until an IP address is found that is not already on the network. (Detailed descriptions of how link- local addresses are implemented are readily available to persons skilled in the art; for example, see RFC 3927 at http : //www . ietf . orq/rfc/rfc3927. txt . )

Devices using link-local addresses can communicate with each other, but cannot communicate with devices having IP addresses outside the link-local range. Following a DHCP failure, in due course all devices will fail-over to link- local addresses, as the devices are rebooted or as their previously assigned IP-address leases expire. However, with leases typically being of several days duration, there is usually a long transition period during which parts of the network using link-local addresses are isolated from parts of the network using DHCP-server-assigned addresses.

The invention aims to provide a method and apparatus that ameliorates or eliminates problems arising in a Building Management System as a result of failure of a DHCP server associated with the BMS' s network.

Disclosure of the Invention

In a first aspect, the invention provides a system arranged to control the internal environment of a building and including a data network, the network comprising: (a) a plurality of networked devices associated with control of the building's internal environment; and (b) a network-address server for supplying a network address to each networked device; a first device of the plurality of networked devices being configured to: (i) request from the network-address server a network address for said first device; and (ii) if no network address is supplied, supply itself with a fail-over network address; wherein the first device is configured to broadcast to other networked devices within the network, when no network address is supplied, a signal or signals indicating

5 that the network-address server has failed; and wherein a second device of the plurality of networked devices is configured to respond to the signal or signals broadcast by the first device and to acquire a fail-over network address compatible with the network address supplied by the first

10 device.

Thus, on detecting failure of the network-address server, the first networked device not only assigns itself a network address, but also alerts other networked devices to the server failure. On receiving an alert, another networked device, and

15 preferably all other networked devices within the building- control data network, responds by acquiring a fail-over network address consistent with the address supplied by the first networked device to itself. The invention may thereby advantageously enable a rapid network-wide transition from

-0 centrally allocated addresses to inter-compatible, fail-over addresses. That synchronised transition, initiated by a broadcast alarm, preferably helps to ensure that different parts of the network use different network addressing protocols only for a significantly reduced period of time,

>5 compared with a system in which transitions only occur as and when networked devices are rebooted or server-allocated addresses expire. It will be understood that a "fail-over network address" is a network address that is acquired other than from the network address server.

IO The second device may acquire its fail-over network address by supplying a compatible network address to itself. The data network may use any suitable network protocol suite; for example it may use TCP/IP. The network-address server may supply network addresses according to any suitable

5 central network addressing protocol; for example, it may be a DHCP server. The fail-over network address supplied by the first device to itself may be supplied according to any suitable peer-to-peer network addressing protocol; for example it may be supplied according to a Zeroconf protocol, APIPA or IPAC; for example it may be a link-local address. The fail- over network address acquired by the second device, and preferably by all other networked devices within the building- control data network, may be supplied according to the same peer-to-peer network addressing _.protocol as that used by the first device. The first networked device and/or the second networked device may broadcast to other networked devices within the network a signal or signals indicating a proposed value for the fail-over network address and provide itself with a network address having that proposed value only if there is no indication from any other network device that that a network address having that proposed value is already in use.

The plurality of networked devices are associated with control of the building's internal environment; they may for example be arranged to monitor or actuate devices arranged to provide services to the building, or they may be arranged to control devices so arranged, or to report on the status of other networked devices or of the building' s internal environment, or to perform any other relevant function. The plurality of networked devices may include at least one networked device selected from the following: a field device monitor, a field device actuator, a controller, and a supervisor.

The system may further comprise at least one device connected to a networked field device monitor and/or a networked field device actuator and arranged to provide at least one service selected from the following: heating, air- conditioning, ventilation, lighting, fire detection, access control and security.

The first networked device and/or the second networked device may be configured to request from the network-address server (whilst using for communication with other networked devices the fail-over network address) a network address for itself; and, if a network address is supplied: (a) broadcast to other networked devices within the network a signal or signals indicating that the network-address server is again operational; and (b) switch to using for communication with other networked devices the network address supplied by the network address server.

Thus, the first networked device, and preferably all other networked devices within the building-control data network, preferably not only respond to failure of the network-address server by broadcasting an alert to other networked devices, but also preferably monitor for recovery of the network-address server. Then, if recovery of the network- address server is detected, the device detecting recovery preferably alerts other networked devices to the recovery. On receiving an alert, another networked device, and preferably all other networked devices within the building-control data network, responds by switching to a server-supplied network address. The invention may thereby advantageously enable a rapid network-wide transition from inter-compatible, fail-over addresses to centrally allocated addresses. That synchronised transition, initiated by a broadcast alarm, preferably helps further to ensure that different parts of the network use different network addressing protocols only for a relatively short period of time.

That the invention preferably enables rapid global switching between server-allocated and fail-over addressing is a particular advantage of the invention. It may be that all networked devices connected by the data network and comprised within the system are configured to switch from using networked addresses supplied by the network-address server to using fail-over network addresses within 30 minutes, preferably within 15 minutes, still more preferably within 2 minutes, of the first device determining that the network- address server has failed. It may be that all networked devices connected by the data network and comprised within the system are configured to switch to using networked addresses supplied by the network-address server from using fail-over network addresses within 30 minutes, preferably within 15 minutes, still more preferably within 2 minutes, of one of the network devices determining that the network-address server is again operational.

In a second aspect, the invention provides a method of operating a data network in a system arranged to control the internal environment of a building, the network comprising: (a) a plurality of networked devices associated with control of the building's internal environment; and (b) a network- address server for supplying a network address to each networked device; the method comprising operating a first device of the plurality of networked devices to: (i) request from the network-address server a network address for said first device; and (ii) if no network address is supplied, provide itself with a fail-over network address; wherein the method further comprises operating the first device to broadcast to other networked devices within the network, when no network address is supplied, a signal or signals indicating that the network-address server has failed; and wherein the method further comprises operating a second device of the plurality of networked devices to respond to the signal or signals broadcast by the first device by acquiring a fail-over network address compatible with the network address supplied by the first device to itself.

In a third aspect, the invention provides a device for inclusion in a data network, the data network comprising a network-address server and a plurality of other networked devices and being comprised in a system arranged to control the internal environment of a building, the device being configured to: (i) request from a network-address server a network address for the device; and (ii) if no network address is supplied, supply itself with a fail-over network address; wherein the device is configured to broadcast to others of the plurality of networked devices within the network, when no network address is supplied, a signal or signals indicating that the network-address server has failed.

In a fourth aspect, the invention provides a device for inclusion in a data network, the data network comprising a network-address server and a plurality of other networked devices and being comprised in a system arranged to control the internal environment of a building, the device being configured to respond to a signal or signals, broadcast by another of the network devices and indicating that the network-address server has failed, by acquiring a fail-over network address compatible with a network address supplied by the broadcasting device to itself.

It will be appreciated that features of the present invention described in relation to any aspect of the present invention are equally applicable to any other aspect of the present invention; for example, features described in relation to the system according to the first aspect of the invention are equally applicable to a method according to the second aspect or a device according to the third or fourth aspect.

Brief Description of the Drawings

Certain illustrative embodiments of the invention will now be described in detail, by way of example only, with reference to the accompanying schematic drawings, in which:

Fig. 1 is an example embodiment of a building management system according to the invention; and

Fig. 2 is a statechart showing how networked devices within the network of Fig. 1 manage their IP address information according to an example embodiment of a method according to the invention.

The BMS 5 of Fig. 1 comprises devices for changing and monitoring the building's internal environment. Examples of such devices, shown in Fig. 1, are: air-conditioning units 10, 110; climate sensors 20, 120 for monitoring temperature, humidity and other climate variables; ventilation units 30, 130; and heating units 40, 140. The building control system also comprises a data network comprising networked devices including field device monitors 60, 160, field device actuators 50, 70, 80, 150, 170, 180, controller 200, field device controllers 210, 220, 230 and supervisor 300, all connected over a local-area network (LAN) 400.

The climate sensors 20, 120 are monitored by field device monitors 60, 160 and the other devices in this example are controlled by field device actuators 50, 70, 80, 150, 170,

180. More specifically, air-conditioning unit 10 and climate sensors 20 are interfaced respectively with actuator 50 and monitor 60, which are together controlled by controller 210, which is connected to the LAN 400. Ventilation 30 and heating 40 are interfaced respectively with actuators 70 and 80, which are together controlled by controller 220, which is connected to the LAN 400. Air-conditioning 110 and heating 140 are interfaced respectively with actuators 150 and 180, which are together controlled by controller 230, which is connected to the LAN 400. Climate sensors 120 are monitored by monitor

160, which is connected directly to the LAN 400. Ventilation 130 is actuated by actuator 170, which is also connected directly to the LAN 400. (Monitor 160 and actuator 170 include internal controller function. ) Controllers 210, 220 and 230, monitor 160 and actuator 170 are themselves directly controlled across the network by controller 200 (in an alternative embodiment, control is distributed, such that there is no hierarchy of control; i.e. no controller of controllers, like controller 200) . Controllers 200, 210, 220, 230 receive over the LAN 400 signals from field device monitors 60, 160 and, depending on those signals and according to predetermined operating parameters, send control signals over the LAN 400 to field device actuators 50, 70, 80, 150, 170, 180 to change the building's internal environment. Supervisor 300 provides an interface to allow viewing or adjustment of system parameters by a human operator. Supervisor 300 also provide analysis and maintenance tools for the operator. Also connected to the LAN 400 is network address server 500. Server 500 provides a DHCP service, providing IP addresses to the various networked devices. -

In normal operation, the networked devices communicate with each other by transmitting data labelled with the IP address of the device to which it is directed. However, server 500 is prone to failure. The failure may arise for various reasons; for example, the LAN 400 may extend beyond the devices comprised within the building control system 5, to other networked devices such as personal computers, printers and other devices used in offices in the building. If a problem arises with those other devices which are not in the building control system, it may nevertheless be necessary to take server 500 offline for maintenance.

Problems can arise if, whilst the server 500 is inaccessible, the networked devices 160-170, 200-230, and 300 within the building control system need to acquire an IP address for any reason (for example if a device is rebooted or if a lease for an existing IP address expires) . For example, if monitor 160 is rebooted and, due to a problem with server 500, fails to acquire an IP address then it effectively disappears from the TCP/IP network formed over LAN 400. In particular, it loses touch with controller 200, which in prior art networks would then be unable to control air-conditioning unit 10, ventilation unit 30 and heating 40 in response to changing conditions detected by climate sensors 120.

Similarly, loss of an IP address for controllers 200, 210, 220, 230, or any other of the networked devices within the building control data network, can cause prior-art building control systems to fail. However, system 5 includes an example embodiment of a method that enables the building control system to withstand loss of server 500, the consequential loss of IP addresses from networked devices and the consequential disconnection (at the logical address level) of those devices from LAN 400.

In this example embodiment, when a device is in a state in which it needs a dynamically allocated address (i.e. it does not have a static IP address) but it does not have an address, because it has yet to acquire one or because its lease on a previous address has expired, it attempts to obtain an address from the DHCP server 500. If it is unsuccessful in that attempt, it does two things. First, it allocates itself an address without consulting the network-address server but with consultation with other networked devices on the LAN 400, to avoid address duplication. Second, it broadcasts a message to those other networked devices to inform them that it has failed to obtain an IP address by DHCP from the server 500. On receipt of that broadcast, each of the other devices attempts itself to renew its IP address by DHCP from the server 500.

If any of the other devices is not successful, that device itself self-allocates an address (again with peer-to- peer consultation, to avoid duplication) and also indicates to the network its transition to the alternate addressing scheme. Each device periodically tries to obtain an IP address by DHCP from the server, and when it is successful it broadcasts a message informing the other devices on the LAN 400, so that they may each try to obtain an address and, if successful, switch back to DHCP-allocated IP addresses.

Thus, on failure of the network-address server 500, the entire data network of devices within the building control system will make a transition from centrally allocated network addresses to Zeroconf, self-allocated addresses. Similarly, on recovery of the network address server 500, all of the devices will make the transition back to central address allocation. Importantly, when a networked device fails to acquire a centrally allocated address, or when it detects that the network address server 500 is restored, it broadcasts a message across LAN 400 to alert other networked devices of the change, and those other network devices alter their addressing protocol accordingly, so that each has a network address compatible with the network addresses supplied to itself by the first device to detect the fault with server 500. Thus there is a rapid network-wide transition from centrally allocated addresses to inter-compatible, self-allocated addresses. That synchronised transition, initiated by broadcast alarms, helps to ensure that the period during which different parts of the network are using different protocols is significantly reduced, compared with a system in which transitions only occur as and when networked devices are rebooted or dynamically allocated IP addresses expire.

The process as embodied in the example embodiment will now be described in detail. Each networked device 160-170, 200-230 and 300 is programmed to change its connection state according to the statechart of Fig. 2.

Each device can be in one of two top-level addressing modes: ManualAddress±ng 600, in which an operator provides a static IP address, and AαtoAddresslng 700, in which the device is assigned a dynamic IP address.

When in AutoAddresslng mode 700, the device will be in one of two DHCP states: AccpilreDhcpLease 720 (in which an IP address is sought from DHCP server 500, in accordance with RFC 2131) or Dhcpldlβ 730. At the next lowest level within

Dhcpldle 730, two sub-states are available: HaveDhcpAddress 740 and HaveNoDhcpAddress 745.

Concurrently with the device being in either the Acqu±reDhcpLease state 720 or the Dhcpldle state 730, the method by which the device acquires a dynamic IP address is determined by whether the device is in a first state DhcpAct±vB 760 or a second state L±nkLocal 770. In DhcpActlve 760 the device seeks to acquire a network address from DHCP server 500. In L±nkLocal 770, the IP address is assigned by the device to itself. Two states are available at the next level within the L±nkLocal state 770. In the state AcgniringLinkLocal 780, the device selects an IP address for itself, in accordance with RFC 3927, checking with other devices on the network that no other device is using the selected IP address and, if not, adopting that IP address. In the state Us±ngL±nklocal 790, the device has adopted a link-local address.

Transitions between the AutoAddressing state 700 and ManualAddressing state 600 are triggered by the events evAutoSelected 800 and evManualSelected 810. Those events result respectively from selection of dynamic or static IP addressing at supervisor 300 or by direct operation on the device in question.

When AutoAddressing 700 is selected (which may be for example when the device is switched on or rebooted) the device begins in state AcqμireDhcpLease 720. In that state, the device broadcasts a DHCP Discover message, seeking a DHCP server. If server 500 is active, an IP address is allocated in the usual manner and that triggers event evLeaseGranted 820, 900, which causes the device to move to state

HaveDhcpAddress 740 within Dhcpldle 730. If no IP address is allocated (for example because server 500 is unavailable) , event evNoLeaseGranted 830, 855 is triggered and the device moves to state HaveNoDhcpAddress 745. Generation of an evRenew 850, 880, 890, 910 event causes the device to return to the AcquireDhcpLease state 720.

When a previously assigned IP address is lost for any reason, (for example after expiry of a lease period determined by settings on the server 500), if the device fails to acquire a new lease, an event evLeaseExpired 840, 860 will be triggered in a device in state HaveDhcpAddress 740, and the device will move to the HaveNoDhcpAddress state 745.

When AutoAddressing 700 is selected, the device also begins in state DhcpActive 760. If event evNoLeaseGranted 830, 855 is generated (in the AcqαireDhcpLease state 720) , or event evLeaseExpired 840, 860 is triggered (in the Dhcpldle state 730), then the device changes state from DhcpActlve 760 to L±nkLocal 770 and triggers the broadcast genNoDhcpAlarm 855, 860, which results in broadcast of an alarm to all other

5 devices in the LAN 400.

Receipt of a genNoDhcpAlarm broadcast 855, 860 (in this or another device in the LAN) triggers an evNoDhcpAlarm event 910, which causes receiving devices to generate an evRenew event 850, 910. That causes the devices to revert to the

0 AqnlxeDECBLease state 720 and attempt themselves to obtain an IP address by DHCP from server 500.

In state L±nkLocal 770, the device begins in state AcqμlrlngLlήkLocal 780. Once it has assigned itself a link- local address that it has determined to be unique, the device

5 generates the event evAcquiredLinkLocal 870 which causes it to change to state Us±xigLinkLocal 790.

After 60 seconds in state Us±ngLinkLocal 790 or if an event evDhcpOKAlarm 890, 900 is triggered as a result of another device on the LAN 400 acquiring a DCHP address, a

:0 evRenew event 850, 880, 890 is triggered on the device which causes the device to move from the Dhcpldle state 730 to the AcqαxreDhcpLease state 720, and thereby attempt again to obtain an IP address by DHCP. If that attempt is successful, and a evLeaseGranted event 830 is thereby triggered, the

:5 device returns to the state DhcpActlve 760 and triggers a broadcast genDhcpOKAlarm 900, which is broadcast to other devices on the LAN 400 (and causes them to transition to state AcqulreDhcpLease 720, in the same manner) .

In this example, all of the BMS devices on LAN 400 make i0 the transition from DHCP addressing to link-local addressing (and vice versa) within two minutes of a first one of the devices becoming aware that server 500 is not providing IP addresses.

It will be understood that, whilst the above description ι5 makes reference to TCP/IP network protocols and the DHCP and link-local approaches to network address allocation, any suitable network protocol may be employed in the invention, as may any suitable method of central address allocation and any suitable method of local address allocation. Where in the foregoing description, integers or elements are mentioned which have known, obvious or foreseeable equivalents, then such equivalents are herein incorporated as if individually set forth. Reference should be made to the claims for determining the true scope of the present invention, which should be construed so as to encompass any such equivalents. It will also be appreciated by the reader that integers of features of the invention that are described as preferable advantageous, convenient or the like are optional and do not limit the scope of the independent claims. Whilst the present invention has been described and illustrated with reference to particular embodiments, it will be appreciated by those of ordinary skill in the art that the invention lends itself to many different variations not specifically illustrated herein. For that reason, reference should be made to the claims for determining the true scope of the present invention.

Claims

1. A system arranged to control the internal environment of a building and including a data network, the network comprising:

(a) a plurality of networked devices associated with control of the building's internal environment; and

(b) a network-address server for supplying a network address to each networked device; a first device of the plurality of networked devices being configured to:

(i) request from the network-address server a network address for said first device; and (ii) if no network address is supplied, supply itself with a fail-over network address; wherein the first device is configured to broadcast to other networked devices within the network, when no network address is supplied, a signal or signals indicating that the network- address server has failed; and wherein a second device of the plurality of networked devices is configured to respond to the signal or signals broadcast by the first device and to acquire a fail-over network address compatible with the network address supplied by the first device.

2. A system as claimed in claim 1, wherein the second device acquires its fail-over network address by supplying a compatible network address to itself.

3. A system as claimed in claim 1 or claim 2, in which the network-address server is a DHCP server.

4. A system as claimed in any preceding claim, in which the fail-over network address supplied by the first device to itself is a link-local address.

5. A system as claimed in any preceding claim, in which the first device broadcasts to other networked devices within the network a signal or signals indicating a proposed value for the fail-over network address and provides itself with a

5 network address having that proposed value only if there is no indication from any other network device that that a network address having that proposed value is already in use.

6. A system as claimed in any preceding claim, in which the 10 plurality of networked devices includes at least one networked device selected from the following: a field device monitor, a field device actuator, a controller, and a supervisor.

7. A system as claimed in any preceding claim, further

L5 comprising at least one device connected to a networked field device monitor and/or a networked field device actuator and arranged to provide at least one service selected from the following: heating, air-conditioning, ventilation, lighting, fire-detection, access-control and security.

JO

8. A system as claimed in any preceding claim, in which the first networked device and/or the second networked device is configured to, whilst using for communication with other networked devices the fail-over network address, request from

!5 the network-address server a network address for itself; and, if a network address is supplied:

(a) broadcast to other networked devices within the network a signal or signals indicating that the network-address server is again operational; and

10 (b) switch to using for communication with other networked devices the network address supplied by the network address server.

9. A system as claimed in any preceding claim, in which all '5 networked devices connected by the data network and comprised within the system are configured to switch from using networked addresses supplied by the network-address server to using fail-over network addresses within 30 minutes of the first device determining that the network-address server has failed.

10. A system as claimed in any preceding claim, in which all networked devices connected by the data network and comprised within the system are configured to switch to using networked addresses supplied by the network-address server from using fail-over network addresses within 30 minutes of one of the network devices determining that the network-address server is again operational.

11. A method of operating a data network in a system arranged to control the internal environment of a building, the network comprising:

(b) a network-address server for supplying a network address to each networked device; the method comprising operating a first device of the plurality of networked devices to:

(i) request from the network-address server a network address for said first device; and (ii) if no network address is supplied, provide itself with a fail-over network address; wherein the method further comprises operating the first device to broadcast to other networked devices within the network, when no network address is supplied, a signal or signals indicating that the network-address server has failed; and wherein the method further comprises operating a second device of the plurality of networked devices to respond to the signal or signals broadcast by the first device by acquiring a fail-over network address compatible with the network address supplied by the first device to itself.

12. A device for inclusion in a data network, the data network comprising a network-address server and a plurality of other networked devices and being comprised in a system arranged to control the internal environment of a building, the device being configured to:

(i) request from a network-address server a network address for the device; and (ii) if no network address is supplied, supply itself with a fail-over network address; wherein the device is configured to broadcast to others of the plurality of networked devices within the network, when no network address is supplied, a signal or signals indicating that the network-address server has failed.

13. A device for inclusion in a data network, the data network comprising a network-address server and a plurality of other networked devices and being comprised in a system arranged to control the internal environment of a building, the device being configured to respond to a signal or signals, broadcast by another of the network devices and indicating that the network-address server has failed, by acquiring a fail-over network address compatible with a network address supplied by the broadcasting device to itself.