Building automation and control systems integrate heating, ventilation, air conditioning, lighting, sensing, and management functions through specialized communication protocols. While this integration enables flexible building operation, it also creates complex cyber-physical environments that are difficult to inspect, secure, and explain to new analysts. This paper presents a practical security and human-centered case study of a BACnet/IP building automation testbed with DALI lighting infrastructure, investigated during a domotics-oriented cybersecurity hackathon in Thun, Switzerland in April 2026. The study combines network-oriented enumeration, object-level inspection, physical rack analysis, and reflective HCI analysis of tool-supported learning. Using Yabe and BACteria, the work documents observable BACnet services, reconstructs structured object hierarchies, identifies room-level lighting-control paths, and maps BACnet objects to DALI group-level infrastructure. The analysis emphasizes that BACS assessment is not only a technical protocol task: it also requires usable tool interfaces, physical observability, interpretable naming conventions, and safe mental models for command priorities. The paper contributes a compact case study of BACnet/DALI exploration in an educational testbed and discusses implications for cybersecurity education, human-centered security tooling, and responsible experimentation in cyber-physical building environments.

翻译：建筑自动化与控制系统通过专用通信协议集成供暖、通风、空调、照明、传感及管理功能。虽然这种集成实现了建筑的灵活运行，但也创造了复杂的网络物理环境，使得检查、安全保障以及向新分析师解释变得困难。本文对配备DALI照明基础设施的BACnet/IP建筑自动化测试平台进行了实用安全与人本案例研究，该研究于2026年4月在瑞士图恩举办的一场面向智能家居的网络安全黑客马拉松期间展开。研究结合了网络导向枚举、对象级检查、物理机架分析以及工具辅助学习的反思性人机交互分析。通过使用Yabe与BACteria，本研究记录了可观测的BACnet服务，重建了结构化对象层次结构，识别了房间级照明控制路径，并将BACnet对象映射至DALI组级基础设施。分析强调，建筑自动化与控制系统的评估不仅仅是一项技术协议任务：它还需要可用的工具界面、物理可观测性、可解释的命名约定以及关于命令优先级的安全心智模型。本文贡献了一个在教育教学平台中探索BACnet/DALI的紧凑案例研究，并讨论了其对网络安全教育、以人为中心的安全工具开发以及在网络物理建筑环境中进行负责任实验的启示。