Not sure if there is a better category for this question

Basically, got thrown into the BAS world 1.5 years ago, started working for Siemens. Got introduced formally to mechatronics, programming, a bit of computer science, etc. And now I'm obsessed with it.

Now working on larger, complicated projects using Siemens BAS system (APOGEE, Insight, PPCL, PXCMs, etc).

I've recently begun trying to suss out any slick tricks or quasi-hacking of these devices.
It's amazing how much of the entire [Siemens] BAS infrastructure is long-since standard CompSci stuff that they borrowed to mash together their platform.

The programming language, PPCL, is a bastardized version of MS BASIC.
The processor in their controllers is an ancient Freescale (Motorola) PowerPC chip (MPC885)

I have a few specific questions about PPCL/the controllers.
One of which - in BACnet, is there any way to evaluate Point/object properties other than Present_Value (85)?
For example, when doing a Point Definition of a BACnet point, or viewing on BoB or such, you can see multiple sub-properties of a point: Out of service, Units, Status Flags, Event State, etc.
but I absolutely cannot find a way to specify any of these in PPCL. I've tried many ideas, and found explicitly in a Siemens user manual that the controllers can only do Present Value.
It's a real shame Siemens pretty much abandoned the platform entirely. Not a single update to PPCL in 15 years. Quite bizarre how limited the controllers now are compared to other, modern competitors. This particular Present Value question being a solid example.

I was hoping someone might have found a clever way around it by now.
Which brings me to my next question:
I figure it's possible to 'hack' these devices like almost any other? Especially since I'm skeptical they really have anything unique going on under the hood.
They use a known CPU architecture platform (PowerPC) with a known instruction set. It has to have firmware on it.
Would it be possible to modify this firmware to change how the controller behaves?
Maybe look for patterns to tweak certain things for fun?

 

I've just glanced at a 20yr old manual from APOGEE and I'm not surprised Siemens dropped PPCL - even in 2000 it appears to me very dated and thus limited in evolutionary terms.

I'm guessing if it has US (united states) processor then firmware would have originated there as well. In which case Siemens would have not been the originator.

Unless you are in Building Services I suggest you follow Siemens example and drop it - there must be (and is) far more interesting technology out there.

 

I've just glanced at a 20yr old manual from APOGEE and I'm not surprised Siemens dropped PPCL - even in 2000 it appears to me very dated and thus limited in evolutionary terms.

I'm guessing if it has US (united states) processor then firmware would have originated there as well. In which case Siemens would have not been the originator.

Unless you are in Building Services I suggest you follow Siemens example and drop it - there must be (and is) far more interesting technology out there.

While I definitely understand where you are coming from and do agree, I also disagree.

Yes, it is an American-originated infrastructure.
An American company, Powers [Process Control], was in the pneumatic controls and valves business and brought their DDC building automation system (BAS) to market in the early 80s. They merged with Mark Controls Corp to become MCC Powers. In 1987, they were bought out by Swiss company, Landis + Gyr. Changed to Landis & Gyr Powers, then Landis & Staefa. Over the next 10 years, they improved the hardware and developed quite an impressive front-end system.
In 1997, Siemens bought out the Swiss company and created their Siemens Building Technologies (SBT) division. Each time they would just peel off the old name and slap the new one on: buildings, equipment, documents, etc.
Even last year, I talked with some techs who had been with the company 35+ years and joked about the early days, "it seemed like almost once a week we were getting uniforms with new names on them!"
It has been SBT ever since. The American HQ still right where the original company started, in Buffalo Grove, IL.
When I'm interested in something, I start to enjoy the history and see where it came from. It's also interesting that pretty much all these names are still around in various ways. It's like they bought the company, split it up into various sections, kept half of it, and sold off the rest.
Powers is still a brand of mixing valves, not owned by Siemens. Landis + Gyr, Landis & Staefa, and Staefa (by itself) are/were [independent?] controls companies.

Except for numbers/specifications (baud rate, memory, processor speed) improving, really nothing else has changed fundamentally with the exception of adding BACnet. The product line that Siemens sells (and installs!) today, right now, is directly linked to what Powers offered in 1985. It really is like buying a 2012 PC and running Windows 95 on it.

The programming language still used in Siemens controllers is PPCL: Powers Process Control Language, introduced by Powers in the early 80s. When doing new installs, Siemens still uses freeze-stats that say POWERS on them. In meta-data of various software files, you can easily find "Siemens Building Technologies - Landis + Gyr Division, Europe"
Clearly a lot of licensing, patents, royalties stuff going on.

Through the buyouts, the essence stayed the same. The change was superficial. The technology was American made, American designed, for the American market.
For ~20 years, it was an American 'organization' that Siemens happened to own, but it operated autonomously of Siemens' German influence... for better or worse.

In 2007, Siemens launched a new product line, that, again, really was just a [major] incremental improvement of the 20+ year old architecture, but still had them at the front of the pack. It was quite an amazing release for that time, and still holds firm as an extremely robust (now what would be seen as) low-level BAS technology.
But, as we established, any R&D in the lineage seems to have died completely soon after. It's rare to find any technical documentation dated after ~2011.
In the last few years, Siemens Europe has 'infected' the American division and is doing like a reverse-merger: "okay, you keep the name, but you throw out ALL your technology, and use ours!" vs the previous "you inherit our name, but we keep your stuff"
In short, the European-ization of SBT is not going well...

Anyway, the "archaic" Siemens platform and PPCL is still...the thing. I work on it every day. Hundreds or thousands of buildings and campuses are still running on the system. For, perhaps, millions of devices still in service, PPCL is the only way to program them. In America, if you had Siemens outfit your brand new building, this is what they would install today.

So I like to tinker and I'm curious if there is a way for me to get more in-depth with this stuff and learn more about it and my industry as a whole.

 

You need to set up a trend for the point, then you can see what the point is reading at different times… like every 10 minutes for an outdoor air temp

 

PPCL programming and Bacnet point properties are two different things.

PPCL has limitations, but is extremely capable of any needed BAS control.
The line programming is more flexible than any function block programming.
Anyone that has dabbled in C would be able to do any needed programming in PPCL.