Anonymised example. Outstations are OS1 to OS5. Addresses are 192.0.2.x, a documentation range, not a real network. No site name, person, or customer address is shown.
Example onlyFive controllers, Trend IQ3Names and addresses replaced
Findings
The tool raises 2, 7 and 8 on its own, plus overrides, outputs with nothing driving them, and a controller with no alarm destination. The other items show what is visible once the strategy is written out. They are not all raised automatically.
1. Gas status alarms switched off in kitchens and labs
Safety
Where
OS3, inputs I9 to I16
Found
Eight gas status inputs (two kitchens, a food room and five science labs) are wired with their alarms disabled. None feeds the strategy.
Impact
A gas trip raises no BMS alarm.
Action
Confirm another system monitors them. If not, enable the alarms.
Working
I9 to I16 gas status inputs: alarm disabled, no links out
2. Extract sensor reads 65 °C high
Wrong control
Where
OS1, S11 'AHU6 Extract Temp'
Found
The sensor has a +65 °C calibration offset.
Impact
Free cooling on AHU6 can never switch on. Free heating is always on.
Action
Remove the offset. If it masks a sensor fault, fix that instead.
Working
S11 offset +65 °C
F175 'AHU6 Free Cooling' on when S99 'Outside Air Temp' > S11 never true
F174 'AHU6 Free Heating' on when S11 > S99 always true
3. Fire shutdown for AHU1 to AHU4 relies on a network link
Safety
Where
OS4, G137 'Fire Alarm'
Found
AHU1 to AHU4 run only while G137 is on. G137 follows the fire alarm input on OS3, sent over the network with a 30-second delay.
Impact
If the link fails, the AHUs act on the last value received.
Action
Test the fire shutdown, including with the link disconnected.
Working
OS3 I3 'Fire Alarm Status' sent to OS4 byte node B1, bit 6
OS4 G137 follows B1, 30 s on and off delay
G45, G104, G108, G112 (AHU1 to AHU4) need G137 on
Every other night both purges run 22:00 to 02:05. On Tuesdays they run 00:00 to 15:10 on OS1 and all day on OS4.
Impact
Purge fans run during lessons, working against the heating.
Action
Correct the Tuesday times on both schedules.
Working
Z2 Tue 00:00 to 15:10, 22:00 to 24:00 other days 00:00 to 02:05, 22:00 to 24:00
Z3 Tue 00:00 to 24:00 other days 00:00 to 02:05, 22:00 to 24:00
5. Alarm routing missing on three outstations
Alarms
Where
OS1, OS4 and OS5
Found
OS2 and OS3 send alarms to the maintenance contractor. OS1, OS4 and OS5 don't.
Impact
Alarms from AHU1 to AHU4, AHU6 and the air conditioning may reach no one.
Action
Add the alarm destination, or confirm the supervisor collects these alarms.
Working
Contractor alarm destination OS2 yes OS3 yes OS1 no OS4 no OS5 no
6. Default PIN and plain HTTP on every outstation
Security
Where
OS1 to OS5
Found
The default PIN is enabled, there are no user accounts, and the web server runs on port 80 with no HTTPS redirect.
Impact
Anyone on the network with the default PIN can change settings.
Action
Disable the default PIN, add user accounts and enable HTTPS where supported.
Working
Default PIN enabled: 5 of 5 User accounts: 0 HTTPS redirect: off
7. Rear overdoor heaters never run
Comfort
Where
OS1 Z4 'Rear Overdoor Heaters'
Found
The schedule has no occupied periods on any day. The front heaters run weekdays, about 07:00 to 21:00.
Impact
A cold entrance, and likely complaints.
Action
Confirm this is deliberate. If not, set the times.
Working
Z4 'Rear Overdoor Heaters' no periods, Mon to Sun
8. Two temperature sensors set to %
Data
Where
OS1, S4 and S6 (reference temperatures)
Found
Both have their units set to %.
Impact
Displays, logs and alarms show the wrong units.
Action
Change the units to °C.
Working
S4 units % S6 units %
9. 14 wired inputs feed nothing
Housekeeping
Where
OS1, OS2 and OS3
Found
Fourteen inputs are wired to hardware but used nowhere in the strategy, including an extract damper, three boiler valves, a gas valve and three trace heating faults.
Impact
Monitoring was never finished, or the points are redundant.
Action
Monitor what matters. Label the rest as spare.
Working
OS1 2 inputs: extract damper, cold water booster
OS2 4 inputs: three boiler valves, gas valve
OS3 8 inputs: three trace heating faults, three plant alarms, two fan statuses
10. Two schedules are duplicates
Housekeeping
Where
OS3 Z1 'Admin Times'; OS4 Z1 'Teaching'
Found
Both hold identical times.
Impact
A term-time change made to one won't reach the other.
Action
Drive both from one schedule.
Working
Z1 (OS3) = Z1 (OS4), every day
Site map
An example of values passed between controllers in the strategy. Not a live traffic survey.
Addresses stored in the files
The report lists these fields for each controller, when the file contains them. The numbers below are documentation examples.
Outstation
Address
Subnet
Gateway
OS1
192.0.2.11
255.255.255.0
None
OS2
192.0.2.12
255.255.255.0
None
OS3
192.0.2.13
255.255.255.0
None
OS4
192.0.2.14
255.255.255.0
None
OS5
192.0.2.15
255.255.255.0
None
Each file can also include the UDP port, MAC address, supervisor address and alarm destinations configured on that controller. See what that does and does not include.
Description of operation (excerpt)
S11 'AHU6 Extract Temp' thermistor input, °C, I/O module 4 channel 3, offset +65 °C
F174 'AHU6 Free Heating' on when S11 > S99 'Outside Air Temp'; feeds F177, F178
F175 'AHU6 Free Cooling' on when S99 > S11; feeds F180, F181
S99 'Outside Air Temp' received from OS2
Not visible in the files
Live values: whether a fault is active now.
Holiday calendars held on the supervisor.
Signals monitored by other systems, such as gas or fire panels.
Findings support engineering judgement. Verify on site before acting, especially on frost, fire and safety functions.