Who Holds the Keys to Your KNX System? Two Passwords Worth Asking About Before the Handover

KNX is an open standard. That is the whole reason I install it. Any certified integrator can work on any KNX system, and the day I retire or you fall out with me, your house does not stop being maintainable.

There is one catch, and it sits in two small passwords that most homeowners have never heard of. If nobody can find them, "open" stops meaning much.

The project password

An ETS project is the full record of your system: every device, every group address, every parameter. It is the thing a new integrator opens on day one.

ETS lets the person who built it protect that file with a password. KNX's own support documentation explains what that does. The project cannot be opened or edited without it, and an exported copy is encrypted, so you cannot even get at the contents with a ZIP program.

Then comes the line I would like every client to read: "There is no way to recover your project data if the password is lost, not even via KNX (there are no hidden master keys that would make this possible)." KNX Association confirms the same thing in its FAQ. Can a project password be reset? "No. Unfortunately this is not possible." If it is forgotten, the only option the documentation gives is deleting the project.

One detail worth knowing: the password can only be switched off if the project has no devices in secure mode and no device certificates. So on a KNX Secure installation, you do not get to quietly drop it later.

A caveat on sourcing. The page describing the project password is written for ETS5. I have not found an ETS6 version that says anything different, but I am telling you which one I read.

The BCU key

The second one works at device level. A BCU key is a single password, up to four bytes, entered in hexadecimal. When it is used, every supporting device in the project is locked during the download with that password. The documentation says those devices cannot be read out or changed later without it.

If it is lost, KNX's guidance is that the devices go back to the manufacturer. A forgotten BCU key cannot be changed or reset externally, because that would make the protection pointless.

That is a sensible design. It is also a very expensive thing to discover during a callout, when the system needs a change and the only person who knew the key has left the company.

Why this matters more than the hardware

I think of the project file as the master key book for the building. The devices are the doors. If the book exists and you can open it, any competent integrator can walk in and carry on. If the book is locked and the one person with the combination is unreachable, you have a house full of perfectly good doors and no way to change a lock.

KNX does not cause this. Protection is optional, and it exists for good reasons. But the protection is only as good as who is holding the passwords, and in most residential jobs that is one installer's head and one laptop.

What KNX will and will not rescue

There is one safety net. KNX Association runs a Project Recovery Service for corrupted ETS project files. For files from the latest generation, ETS6, it is free. For older generations the published price is 200 euros for investigation and export, plus 150 euros an hour for further editing, and you need a valid ETS licence to use it.

Read that carefully. It is for files that will not open because they are damaged. Nothing in the documentation I read says it helps with a forgotten password, and the password page says plainly that nothing does.

What I think a handover should include

This is my view, not a KNX rule.

• The ETS project file itself, exported and handed over, not just left on my laptop.

• The project password, written down and given to you in a form you can store safely.

• The BCU key, if one was used, for the same reason.

• A dated record of what was handed over, and to whom.

Then keep two copies, in two places, that are not the same laptop. A fire safe and a password manager both work.

If you are buying a KNX system, ask the integrator one question before you sign: "At the end of the job, what do I get, and can another installer open it?" A good answer takes thirty seconds. A vague one tells you what you need to know.

If you already have a KNX system and do not know whether anyone holds the file, that is worth a quick check. I am happy to talk it through. Just a conversation about what the project needs: wayne@knxlogic.co.za | 082 564 3982 | www.knxlogic.co.za

Sources: KNX Association support documentation: "Project Password", "Can a project password be reset?", "BCU Key", "Project Recovery Service" (support.knx.org).