Building Automation System
Corpus sync: neutrality remakes, note hygiene, datasheet relocation, transformer-split cross-refs
Showing changes from Rev 4
to Rev 5
in Building Automation System.
−---
−title: Building Automation System
−category: Mechanical / Controls & Testing
−toc_depth: 3
−description: >
− When to use: Networked direct digital control (DDC) systems for HVAC and ancillary mechanical building systems in commercial, institutional, and industrial buildings. Covers the supervisory and management layers, building-level controllers, application-specific controllers, sensors, actuators, equipment interface points, BACnet and Modbus network architecture, server and workstation graphics, scheduling, alarming, trending, and the cybersecurity baseline that protects operational technology. Applicable to new construction, full system replacement, and substantial expansions of existing systems.
−
− Not intended for: Lighting controls (typically governed by a separate lighting control system standard); fire alarm systems (see [[sync/fire-alarm-systems]]) — interface to the BAS for smoke control, fan shutdown, and damper command is addressed here only as an interface, not as fire alarm scope; physical access control, video surveillance, and intrusion detection (governed by a security system standard); medium-voltage substation SCADA; industrial process control systems outside HVAC and ancillary building utilities; control wiring and raceway materials (see [[sync/conductors-and-cables]] and [[sync/raceways-and-conduit]]). Sequences of operation for individual equipment are established on the contract drawings and equipment standards (see [[sync/air-handling-units]], [[sync/hvac-pumps]], [[sync/air-terminal-units]], [[sync/hvac-variable-frequency-drives]], [[sync/hydronic-piping]], [[sync/hvac-ductwork]], [[sync/hvac-water-treatment]], [[sync/testing-adjusting-and-balancing]]); they are not duplicated in this standard.
−---
−
−# Scope {toc}
−
−## This specification covers the materials, configuration, programming, integration, commissioning, and cybersecurity hardening of the building automation system (BAS), a networked direct digital control system for HVAC and ancillary mechanical building systems. {note}
−## The system addressed in this standard is organized in four layers: a server / management layer that hosts the operator interface, historian, and database; a supervisory layer of network controllers that perform integration, scheduling, alarming, and global control logic; a field controller layer of application-specific and programmable controllers that execute the sequence of operations at each piece of mechanical equipment; and a field bus and I/O layer of sensors, actuators, and equipment integration points. {note}
−
−## The default open communication protocol for this standard shall be BACnet, as defined by ANSI/ASHRAE Standard 135 and ISO 16484-5.
−
−## BACnet shall be required at every interface where multi-vendor interoperability is needed.
−
−## Modbus (RTU and TCP) is permitted as a secondary protocol for integrating specific equipment that lacks a native BACnet interface.
−
−## Proprietary protocols are permitted only within a single manufacturer's product family below a BACnet boundary.
−
−## The system shall be designed so that the operator interface, the supervisory layer, and all primary equipment integration are accessible via BACnet objects regardless of the field bus protocol used inside any individual subsystem.
−
−## Scope Boundaries {toc}
−
−### This standard covers cybersecurity provisions that constitute the minimum baseline for operational technology in a commercial building — network segregation from the production data network, account management, patching discipline, and audit logging — derived from the practices of NIST SP 800-82. {note}
−### Sequences of operation are established on the contract drawings and in the equipment standards; this standard governs the platform that executes those sequences. {note}
−### Control wiring materials and raceway methods are governed by [[sync/conductors-and-cables]] and [[sync/raceways-and-conduit]]. {note}
−
−### Power supply to BAS panels shall be Class 2 unless otherwise indicated and shall comply with NFPA 70 Article 725.
−
−### Interface to the fire alarm system for fan and damper command shall comply with NFPA 72 and is addressed here only at the interface; the fire alarm system itself is governed by [[sync/fire-alarm-systems]].
−
−# Referenced Standards {toc}
−
−## Equipment, materials, and installation shall comply with the latest adopted edition of the following standards.
−## Where the contract documents, the adopted building code, or a referenced standard conflict, the more stringent requirement shall govern unless the Engineer of Record directs otherwise in writing.
−
−| Standard | Title |
−|----------|-------|
−| ANSI/ASHRAE 135 | A Data Communication Protocol for Building Automation and Control Networks (BACnet) |
−| ISO 16484-1 | Building Automation and Control Systems (BACS) — Project Specification and Implementation |
−| ISO 16484-2 | Building Automation and Control Systems — Hardware |
−| ISO 16484-3 | Building Automation and Control Systems — Functions |
−| ISO 16484-5 | Building Automation and Control Systems — Data Communication Protocol |
−| ISO 16484-6 | Building Automation and Control Systems — Data Communication Conformance Testing |
−| ASHRAE Guideline 13 | Specifying Direct Digital Control Systems |
−| ASHRAE Guideline 36 | High-Performance Sequences of Operation for HVAC Systems |
−| ANSI/ASHRAE/IES 90.1 | Energy Standard for Buildings Except Low-Rise Residential Buildings |
−| ANSI/ASHRAE 62.1 | Ventilation and Acceptable Indoor Air Quality (includes Demand-Controlled Ventilation provisions) |
−| ANSI/ASHRAE 188 | Legionellosis: Risk Management for Building Water Systems |
−| NIST SP 800-82 | Guide to Operational Technology (OT) Security |
−| NFPA 70 | National Electrical Code (Articles 725 — Class 2 control circuits, 800 — Communications) |
−| NFPA 72 | National Fire Alarm and Signaling Code (interface to fire alarm) |
−| NFPA 90A | Standard for the Installation of Air-Conditioning and Ventilating Systems |
−| UL 916 | Energy Management Equipment |
−| UL 60730-1 | Automatic Electrical Controls — General Requirements |
−| IEEE 802.3 | Ethernet (BACnet/IP physical layer) |
−| TIA-568 | Commercial Building Telecommunications Cabling Standard |
−| FCC Part 15 | Radio Frequency Devices (Class A unintentional radiator limits for OT equipment) |
−| BTL — BACnet Testing Laboratories | Listed Products and Protocol Implementation Conformance Statements |
−
−# Submittals {toc}
−
−## Action Submittals {toc}
−
−### The Contractor shall submit the following for the Engineer's review and return before procurement and installation:
−
−- Product data sheets for each server, supervisory controller, programmable controller, application-specific controller, sensor, actuator, and network device, identifying manufacturer, model, BTL listing where applicable, BACnet device profile (e.g., B-BC, B-AAC, B-ASC), and the BACnet Interoperability Building Blocks (BIBBs) supported
−- A BACnet Protocol Implementation Conformance Statement (PICS) for every BACnet device on the system
−- System architecture diagram showing the server / management layer, supervisory controllers, field controllers, BACnet/IP backbone, MS/TP segments, Modbus segments, and any proprietary subsystem boundaries, with physical media identified for each segment
−- Network addressing plan including BACnet device instance numbers (unique across the entire system), BACnet network numbers per segment, IP addressing for BACnet/IP devices, and MS/TP MAC addresses with token-passing master count per segment
−- Complete point list for the project, organized by equipment, listing each point's name, BACnet object type and instance, engineering units, default value, alarm limits, COV increment, and source (hardware input, calculated, integrated)
−- Graphics intent: representative floor plans, system schematics, and equipment graphics demonstrating the visual style, navigation hierarchy, and dynamic point overlays to be used
−- Schedule and alarm strategy document defining alarm classes, priority levels, suppression rules, routing destinations, and the operating-hours schedule structure
−- Trend log plan listing the points to be trended, trend interval, retention period, and on-controller versus server storage
−- Cybersecurity plan addressing account management, password policy, network segregation, patch management, removable media policy, remote access method, and audit logging — at a level of detail consistent with NIST SP 800-82 baseline practices
−- Integration submittal for each non-BACnet integration (Modbus, proprietary): communication parameters, register or object map, gateway model, and a sample of integrated points exposed as BACnet objects to the supervisory layer
−- Sequence-to-program correspondence: a mapping document showing how each item of the published sequence of operations is implemented in controller logic, with the program block or function name responsible for each step
−- Riser diagram of BAS field wiring showing controller locations, cable types and lengths, conduit segments, and termination points
−- Catalog cuts and product data for all damper actuators, valve actuators, sensors, and end devices proposed under this scope where not already submitted under the equipment standard that delivers them
−
−```datasheet
−label: Action Submittals Required
−type: checkbox
−options:
− - "System architecture diagram (server, supervisory, field, bus segments)"
− - "BACnet PICS for every BACnet device"
− - "Product data for all controllers, sensors, actuators, gateways"
− - "Network addressing plan (device instances, network numbers, IP, MAC)"
− - "Complete point list by equipment"
− - "Graphics intent (floor plans, schematics, equipment graphics)"
− - "Schedule and alarm strategy document"
− - "Trend log plan"
− - "Cybersecurity plan (NIST SP 800-82 baseline)"
− - "Integration submittal for each non-BACnet subsystem"
− - "Sequence-to-program correspondence map"
− - "Field wiring riser diagram"
−default: "System architecture diagram (server, supervisory, field, bus segments)"
−```
−
−### Submittals shall be coordinated across all controllers, network infrastructure, and integrated equipment before any item is submitted; piecemeal submittals that require multiple resubmissions due to internal inconsistency will not be accepted.
−
−## Closeout Submittals {toc}
−
−### The Contractor shall provide the following at substantial completion before the building automation system is accepted:
−
−- Operation and maintenance manuals with controller programming guides, parameter reference, server software user guides, and recommended preventive maintenance intervals
−- As-built drawings reflecting installed routing, controller locations, sensor and actuator locations, and any field deviations from the submitted design
−- A complete copy of all controller programs, graphics files, schedules, alarm definitions, trend log configurations, and server database in the manufacturer's native backup format and in a portable form (BACnet PICS-compatible export where available)
−- A point database export in a spreadsheet-readable format, listing every point with its final calibrated range, engineering units, alarm limits, and final tag name
−- Calibration records for every measured sensor (temperature, humidity, CO2, pressure, flow) showing calibration date, reference instrument used, as-found reading, and as-left reading
−- Network commissioning report documenting actual BACnet/IP traffic, MS/TP token-pass times, and any segment loading issues observed
−- Cybersecurity closeout: list of all user accounts with role assignments, list of all installed firmware and software versions with patch dates, copy of the configured backup schedule, and a signed acknowledgement that all default and vendor-default passwords have been changed
−- Functional test reports for every system, signed by the Contractor's commissioning technician and by the Commissioning Authority where one is engaged
−- Training records documenting Owner personnel trained, dates, and topics covered
−
−```datasheet
−label: Required Closeout Submittals
−type: checkbox
−options:
− - "Operation and maintenance manuals"
− - "As-built drawings"
− - "Complete copy of controller programs, graphics, schedules, alarms, trends, database"
− - "Point database export (spreadsheet-readable)"
− - "Sensor calibration records (as-found / as-left)"
− - "Network commissioning report"
− - "Cybersecurity closeout (accounts, versions, backup schedule, password acknowledgement)"
− - "Functional test reports for every system"
− - "Training records"
−default: [Operation and maintenance manuals, As-built drawings, Sensor calibration records (as-found / as-left), Functional test reports for every system]
−```
−
−# Quality Assurance {toc}
−
−## Manufacturer Qualifications {toc}
−
−### The BAS shall be furnished by a manufacturer with a minimum of ten years of continuous experience producing direct digital control products for commercial HVAC applications.
−
−### The manufacturer shall maintain an ISO 9001 certified quality management system.
−
−### The manufacturer shall commit in writing to maintaining replacement parts, firmware support, and software upgrade paths for the proposed product platform for a minimum of fifteen years from the date of substantial completion.
−
−## Installer Qualifications {toc}
−
−### BAS installation, programming, integration, and commissioning shall be performed by a controls contractor authorized by the system manufacturer for the proposed platform.
−
−### The controls contractor shall have a minimum of five years of documented experience installing systems of similar scope and complexity.
−
−### The controls contractor shall employ programmers and integrators certified by the manufacturer on the specific product line and on BACnet integration.
−
−## BTL Listing {toc}
−
−```datasheet
−label: BTL Listing Requirement
−type: radio
−options:
− - "BTL listing required for all BACnet devices (recommended)"
− - "BTL listing required for supervisory and primary equipment controllers; PICS sufficient for end devices"
− - "PICS sufficient — BTL not required (legacy systems, small projects only)"
−default: "BTL listing required for all BACnet devices (recommended)"
−```
−### All BACnet devices shall be listed by the BACnet Testing Laboratories (BTL) for the claimed device profile and BIBBs.
−
−### A device that is described as "BACnet-compatible" but is not BTL-listed shall not be accepted unless its BACnet PICS has been submitted and the Engineer has accepted the device in writing for the specific role.
−
−### BTL listing is the only practical assurance that a device will interoperate at the protocol level with other BACnet products on the project. {note}
−
−
−## NRTL Listing {toc}
−
−### All BAS controllers, power supplies, gateways, and panels shall be listed by a Nationally Recognized Testing Laboratory to UL 916 (Energy Management Equipment) or UL 60730-1 as applicable.
−
−### Equipment that derives its power from a Class 2 source shall be listed for Class 2 operation per NFPA 70 Article 725.
−
−## Single-Source Responsibility {toc}
−
−### The supervisory, field, and integration layers of the BAS shall be furnished and installed by a single controls contractor under a single point of responsibility.
−
−### Where any portion of the system is delivered with packaged equipment (factory-mounted controllers on chillers, packaged rooftop units, or air handling units, or third-party submeters and indoor air quality monitors), the controls contractor shall be responsible for integration of those subsystems into the central BAS via the submitted communications interface.
−
−### The controls contractor shall verify that all required points are visible and operable at the operator workstation.
−
−## Pre-Installation Conference {toc}
−
−### A pre-installation conference shall be held before any BAS field work begins.
−
−### Attendees shall include the controls contractor, the mechanical contractor, the electrical contractor, the Owner's information technology representative, and the Commissioning Authority where one is engaged.
−
−### The agenda shall include coordination of network ports and IP addressing with the Owner IT organization, identification of separately powered subsystems and emergency power requirements, conduit and cable routing for field buses, location of controller panels in mechanical rooms, and the cybersecurity provisions that constrain remote access during construction and after substantial completion.
−
−# Environmental and Service Conditions {toc}
−
−## Ambient Conditions {toc}
−
−```datasheet
−label: Controller Installation Environment
−type: select
−options:
− - "Indoor — conditioned mechanical or electrical room"
− - "Indoor — unconditioned mechanical penthouse or above-ceiling plenum"
− - "Outdoor — weatherproof enclosure, sheltered (rooftop)"
− - "Outdoor — weatherproof enclosure, fully exposed"
− - "Wet, washdown, or corrosive process areas"
−default: "Indoor — conditioned mechanical or electrical room"
−```
−### BAS controllers and panels installed indoors in conditioned mechanical rooms shall be suitable for continuous operation in ambient temperatures from 32°F to 122°F (0°C to 50°C) and relative humidity from 10% to 90% non-condensing.
−
−### Controllers installed in unconditioned spaces — mechanical penthouses, parking garages, rooftops in weatherproof enclosures, exterior light court walls — shall be rated for the actual ambient extremes anticipated at the location, and any required heaters or supplemental cooling shall be included in the submittal.
−
−### Controllers in damp or wet locations shall be installed in NEMA 4 or NEMA 4X enclosures with the controller protected from condensation.
−
−### Field experience shows that controller failures in unconditioned spaces are concentrated in the condensation season (heating to cooling changeover and vice versa) and that enclosure heaters or anti-condensation strips significantly improve reliability where condensation is plausible. {note}
−
−
−## Power Supply {toc}
−
−### BAS field controllers and end devices are typically powered from 24 VAC Class 2 transformers per NFPA 70 Article 725. {note}
−
−```datasheet
−label: BAS Panel Emergency / Standby Power
−type: radio
−options:
− - "Normal power only"
− - "Standby generator (life safety equipment branches only)"
− - "Standby generator (all BAS equipment)"
− - "Uninterruptible power supply at server and supervisory layer (recommended)"
− - "UPS at supervisory layer plus generator for full system"
−default: "Uninterruptible power supply at server and supervisory layer (recommended)"
−```
−### Multiple devices may share a single transformer where the total connected VA load does not exceed 80% of the transformer rating.
−
−### Supervisory controllers and gateways may require 120 VAC or low-voltage DC; all power supplies shall be sized for at least 25% reserve capacity above the connected load to accommodate future expansion.
−
−### A minimum of an uninterruptible power supply sized for 30 minutes of run time shall be provided for the server and any supervisory controllers that host global scheduling, alarming, or critical sequences.
−
−### Loss of supervisory power during a utility blip should not cause a system-wide restart; UPS protection is the minimum standard.
−
−
−## Seismic Requirements {toc}
−
−### Where required by the applicable building code, BAS panels and server cabinets shall be seismically certified or restrained per ASCE 7 and IBC for the project Seismic Design Category.
−
−### Where the BAS is part of a facility designated as essential or where the BAS controls life-safety mechanical equipment (smoke control fans, stair pressurization), seismic certification of the controller assembly shall be provided.
−
−# System Architecture {toc}
−
−## Layered Architecture {toc}
−
−### The BAS shall be organized in four layers, each connected to the next by a defined communications interface:
−
−1. **Server / management layer.** Hosts the operator interface, graphics, historian (trend) database, alarm database, configuration backup, and user account directory. May be on premises or hosted in a private cloud, with the connection between server and supervisory layer protected as a control system interface (see Cybersecurity below).
−2. **Supervisory layer.** Network controllers (BACnet Building Controllers, B-BC) that perform global control, scheduling, alarming, historical trend collection from field controllers, and inter-system integration. Supervisory controllers shall continue to execute their assigned logic when isolated from the server layer; the server is a presentation and historian layer, not a control layer.
−3. **Field controller layer.** Application-specific controllers (B-ASC) and advanced application controllers (B-AAC) at each piece of equipment — air handling units, terminal units, central plant equipment, exhaust fans, pumps. Each field controller executes the sequence of operations for the equipment it serves and continues to do so when isolated from the supervisory layer (stand-alone operation).
−4. **Field bus and I/O layer.** Sensors, actuators, switches, and equipment communications interfaces wired to field controller inputs and outputs, or networked on a field bus (BACnet MS/TP or, for specific integrations, Modbus RTU).
−
−```datasheet
−label: Primary Communications Protocol
−type: radio
−options:
− - "BACnet (ASHRAE 135 / ISO 16484-5) — default and required at multi-vendor interfaces"
− - "BACnet with Modbus permitted for specific equipment integrations"
− - "Proprietary closed protocol with BACnet gateway at supervisory layer"
−default: "BACnet with Modbus permitted for specific equipment integrations"
−```
−
−```datasheet
−label: Supervisory Network Backbone
−type: select
−options:
− - "BACnet/IP over dedicated BAS Ethernet VLAN"
− - "BACnet/IP over shared building Ethernet with VLAN segregation"
− - "BACnet/Ethernet (ISO 8802-3 frame format) — legacy systems only"
− - "BACnet/SC (Secure Connect) — modern TLS-protected BACnet over IP"
−default: "BACnet/IP over dedicated BAS Ethernet VLAN"
−```
−
−```datasheet
−label: Field Bus Protocol (Equipment Networks)
−type: select
−options:
− - "BACnet MS/TP (RS-485, twisted shielded pair)"
− - "BACnet/IP at the field controller (where each field controller is on Ethernet)"
− - "Modbus RTU (RS-485) — equipment integration only"
− - "Mix — BACnet MS/TP for primary devices, Modbus RTU for specific equipment"
−default: "Mix — BACnet MS/TP for primary devices, Modbus RTU for specific equipment"
−```
−
−### BACnet/SC (Secure Connect) is the preferred backbone for new systems where the supervisory layer must traverse any network shared with non-BAS traffic, because it provides TLS encryption and mutual authentication between BACnet devices that the underlying BACnet/IP standard does not. {note}
−
−### Where BACnet/SC is not yet supported on all required devices, BACnet/IP on a physically or VLAN-segregated network with no routed access from the production data network is the acceptable alternative.
−
−## BACnet/IP Network {toc}
−
−```datasheet
−label: BACnet/IP Network Topology
−type: select
−options:
− - "Star — Ethernet switch in each electrical/mechanical room, fiber or copper home runs to a central BAS switch"
− - "Ring — fiber ring with redundant path between primary switches"
− - "Hybrid — fiber backbone with star drops"
−default: "Star — Ethernet switch in each electrical/mechanical room, fiber or copper home runs to a central BAS switch"
−```
−```datasheet
−label: BACnet/IP Physical Media
−type: select
−options:
− - "Category 6 UTP copper to all devices within 90 m of switch"
− - "Category 6A UTP copper (10G-ready, recommended for new installations)"
− - "Multimode fiber (OM3/OM4) between buildings or to remote switches"
− - "Singlemode fiber (OS2) for runs exceeding 300 m or for future expansion"
−default: "Category 6A UTP copper (10G-ready, recommended for new installations)"
−```
−### The BACnet/IP backbone shall be a dedicated Ethernet network for BAS use, physically separate from or VLAN-segregated from the building's production data network.
−
−### No general-purpose office or guest traffic shall traverse the BAS network.
−
−### Routing from the production network to the BAS network shall be controlled by a firewall configured for the principle of least privilege, with rules documented and reviewed annually.
−
−### BACnet/IP cable runs shall comply with TIA-568 for Ethernet, including 100 m maximum copper channel length and approved patch panel terminations.
−
−### Cable installation in plenum spaces shall use plenum-rated cable.
−
−### The BACnet/IP network shall not share switches or VLANs with security camera, voice, or guest networks; if physical switches must be shared, the BAS VLAN shall be configured with strict access control lists.
−
−
−
−## BACnet MS/TP Network {toc}
−
−### BACnet MS/TP shall be used for field controller-to-supervisory communications where individual controllers do not justify the cost of an Ethernet drop.
−### MS/TP runs on RS-485 twisted shielded pair, supports up to 127 master nodes per segment in the addressing range, and is practical at data rates of 38.4 kbps or 76.8 kbps. {note}
−
−```datasheet
−label: MS/TP Data Rate
−type: select
−unit: kbps
−options:
− - "9.6 — legacy compatibility only"
− - "19.2 — legacy compatibility only"
− - "38.4 — common, conservative"
− - "76.8 — recommended for new installations"
− - "115.2 — supported by some platforms, verify all devices"
−default: "76.8 — recommended for new installations"
−```
−```datasheet
−label: MS/TP Maximum Devices Per Segment
−type: select
−options:
− - "32 devices per segment (conservative — best response)"
− - "50 devices per segment (typical)"
− - "64 devices per segment (heavily loaded)"
− - "127 devices per segment (theoretical maximum — degraded response)"
−default: "32 devices per segment (conservative — best response)"
−```
−### Lower data rates increase token-pass time and degrade response on heavily loaded segments. {note}
−
−
−
−### A field-loaded MS/TP segment with token-pass times above 200 ms produces noticeably sluggish response at the operator workstation and may cause priority array writes to time out. {note}
−
−### The conservative loading of 32 devices per segment yields token-pass times well under 100 ms on typical platforms at 76.8 kbps and is the recommended practice for new construction.
−
−### Where higher densities are required, the segment shall be tested under load before final acceptance.
−
−### MS/TP cable shall be 22 AWG shielded twisted pair, with the shield grounded at one end only (typically at the supervisory controller).
−
−### Daisy-chain topology is required; star or branch topologies are not permitted.
−
−### End-of-line terminating resistors (120 Ω) shall be installed at both physical ends of each segment.
−
−### Cable lengths exceeding 1,200 m on a single segment shall be split with a repeater.
−
−## Modbus and Proprietary Integration {toc}
−
−### Modbus RTU and Modbus TCP integration is permitted where a specific item of equipment provides Modbus as its native protocol and a BACnet interface is not available or carries a significant cost premium. {note}
−### Examples include certain submeters, power monitoring devices, generator controllers, indoor air quality stations, and some chiller controllers. {note}
−
−```datasheet
−label: Gateway Implementation
−type: radio
−options:
− - "Embedded gateway in the supervisory controller (preferred for small integrations)"
− - "Standalone gateway appliance (recommended for larger integrations with many points)"
− - "Software gateway hosted on BAS server (verify performance and recovery behavior)"
−default: "Standalone gateway appliance (recommended for larger integrations with many points)"
−```
−### The Modbus device shall be integrated through a gateway that maps Modbus registers to BACnet objects at the supervisory layer, so that the operator workstation sees a uniform BACnet device tree regardless of the underlying protocol.
−
−### Proprietary closed protocols are permitted only within a single manufacturer's product family below the supervisory layer (for example, a manufacturer's proprietary field bus connecting a packaged chiller's onboard controller to the chiller's auxiliary devices).
−
−### The boundary between the proprietary subsystem and the BAS shall be BACnet, and all required points shall be exposed as BACnet objects.
−
−
−## Stand-Alone Operation {toc}
−
−### Every controller in the system shall continue to execute its assigned sequence of operations when isolated from the layer above it.
−
−### Loss of the BACnet/IP backbone shall not cause an air handling unit's MS/TP controller to stop controlling the unit.
−
−### Loss of the supervisory controller shall not cause connected VAV terminal units to stop modulating their dampers and valves.
−
−### The system shall be designed and verified so that any single network failure produces a degradation of monitoring and global integration, not a loss of mechanical control.
−
−### This is a foundational design requirement, not an option. {note}
−
−## Time Synchronization {toc}
−
−```datasheet
−label: Time Synchronization Source
−type: radio
−options:
− - "NTP server provided by Owner IT organization (preferred where IT can provide)"
− - "Dedicated NTP appliance on BAS network (where BAS is isolated from production)"
− - "BAS server as authoritative time source (small systems)"
−default: "Dedicated NTP appliance on BAS network (where BAS is isolated from production)"
−```
−### All controllers and the server shall be synchronized to a common time source.
−
−### The server shall be configured as a Network Time Protocol (NTP) client to a known reliable source — either a local NTP server provided by the Owner IT organization or, where the BAS network is isolated, a stratum-2 NTP server provided by the Contractor on the BAS network.
−
−### Supervisory and field controllers shall synchronize from the server.
−
−### Time drift between any controller and the server shall not exceed 30 seconds at any time.
−
−### Trend timestamps that drift significantly are useless for fault diagnosis. {note}
−
−
−# Server and Operator Workstation {toc}
−
−## Server Platform {toc}
−
−```datasheet
−label: Server Hosting
−type: select
−options:
− - "Physical server on premises (BAS-owned hardware)"
− - "Virtual machine on Owner-provided hypervisor (with IT coordination)"
− - "Private cloud hosting by BAS manufacturer (verify Owner cybersecurity policy)"
− - "Hybrid — supervisory hardware on premises, archive and reporting in cloud"
−default: "Virtual machine on Owner-provided hypervisor (with IT coordination)"
−```
−```datasheet
−label: Server Operating System
−type: select
−options:
− - "Server-class Windows OS, currently supported version"
− - "Linux distribution, currently supported LTS version"
− - "Manufacturer-provided appliance OS"
−default: "Manufacturer-provided appliance OS"
−```
−### The BAS server shall host the operator interface, graphics, alarm and event database, historical trend database, schedule definitions, user account directory, and configuration backup.
−
−### The server may be physical or virtual, on-premises or hosted in a private cloud, provided the cybersecurity and connectivity requirements of this standard are met.
−
−### The server operating system shall be a currently supported version with active security update channels.
−
−### Operating systems past their vendor end-of-life shall not be deployed.
−
−### The Contractor shall identify the operating system version in the submittal and shall be responsible during the warranty period for applying vendor security patches in coordination with the Owner IT organization.
−
−
−
−## Database Backup {toc}
−
−```datasheet
−label: Server Backup Strategy
−type: select
−options:
− - "Daily backup to local network attached storage, 30-day retention"
− - "Daily backup to off-site cloud storage, 90-day retention"
− - "Daily local backup plus weekly off-site backup, 90-day retention combined"
− - "Continuous replication to a standby server (high-availability systems)"
−default: "Daily local backup plus weekly off-site backup, 90-day retention combined"
−```
−### The server shall be configured to automatically back up the BAS database — controllers programs, graphics, schedules, alarm definitions, user accounts, and configuration — to a separate storage location at least daily.
−
−### The backup retention shall be a minimum of 30 days.
−
−### The backup process shall be tested by performing a full restore on a test system at substantial completion and the result documented.
−
−
−## Operator Workstation {toc}
−
−### The preferred operator interface for new systems is a web browser thin client accessed from standard endpoint workstations. {note}
−
−```datasheet
−label: Operator Workstation Type
−type: select
−options:
− - "Web browser thin client (no installed software, supported on standard endpoint workstations)"
− - "Manufacturer-installed thick client on dedicated workstation"
− - "Mobile/tablet client for field engineering"
− - "All of the above"
−default: "Web browser thin client (no installed software, supported on standard endpoint workstations)"
−```
−### A thin client interface allows the Owner's IT organization to manage workstations consistently and allows authorized users to access the system from any compliant endpoint, subject to the cybersecurity provisions of this standard. {note}
−
−### Dedicated workstations may be installed in operations centers where always-on display is required.
−
−
−## User Accounts and Roles {toc}
−
−```datasheet
−label: Authentication Method
−type: radio
−options:
− - "Local accounts on BAS server with strong password policy"
− - "Active Directory / LDAP integration with the Owner organization (preferred)"
− - "SAML or OAuth federation with the Owner identity provider"
− - "Local accounts plus optional multi-factor authentication for engineer and administrator roles"
−default: "Active Directory / LDAP integration with the Owner organization (preferred)"
−```
−### The system shall support role-based access control with at least the following standard roles: operator (read and acknowledge alarms, view trends and graphics), supervisor (operator role plus override capability and schedule edits), engineer (full configuration and program editing), and administrator (engineer role plus user account management).
−
−### Each named individual shall have a personal account; shared accounts are not permitted.
−
−### Where the Owner organization operates a directory service, BAS user accounts should integrate with that service so that account lifecycle (provision, deactivate, password reset) is managed centrally.
−
−### Centralized account management is particularly important for promptly removing access when personnel leave the organization — a local-account-only system frequently retains orphaned accounts for former employees and contractors. {note}
−
−### Multi-factor authentication is required for any account with engineer or administrator privileges on systems accessible from outside the BAS network.
−
−
−# Graphics and Operator Interface {toc}
−
−## Graphics Hierarchy {toc}
−
−```datasheet
−label: Graphics Style
−type: select
−options:
− - "Photorealistic equipment with three-dimensional appearance"
− - "Schematic line drawing with dynamic point overlays"
− - "Combination — photorealistic plant rooms, schematic terminal equipment"
−default: "Schematic line drawing with dynamic point overlays"
−```
−### The operator interface shall be organized as a navigable hierarchy: a building or site landing page, floor plans, equipment system schematics (e.g., chilled water plant, hot water plant, an air handler), and individual equipment graphics with all monitored and controlled points.
−
−### Navigation between levels shall be by mouse click on labeled hot spots on each page; navigation by menu shall be available as an alternative path.
−
−### Schematic line graphics generally produce more usable operator interfaces than photorealistic graphics; the purpose of an equipment graphic is to convey the current state of the system to a trained operator in seconds — the airflow path, water flow path, status of each piece of equipment, and any active alarms, and photorealistic decoration adds visual noise without conveying state. {note}
−
−### Where photorealism is used (commonly for client demonstration purposes), the dynamic point overlays shall be clearly readable and shall not be obscured by decorative elements.
−
−
−## Required Graphic Pages {toc}
−
−### At minimum, the following graphic pages shall be provided:
−
−- A site or building landing page identifying the building, current outdoor conditions, system status summary (running / off / alarmed), and the count of active alarms
−- Floor plans for each floor showing the location of major equipment and zones, with hotspots to navigate to zone-level detail
−- A graphic for each central plant system (chilled water plant, hot water plant, condenser water plant), showing all equipment, valves, pumps, sensors, setpoints, and current readings with engineering units
−- A graphic for each air handling unit, terminal unit, exhaust fan, energy recovery device, or other equipment item, showing all monitored and controlled points
−- A graphic for each major integrated subsystem (chiller controller, boiler controller, packaged equipment) showing the points integrated and the current state
−- A weather/outdoor conditions graphic showing outdoor air dry-bulb temperature, relative humidity, dew point, and wet-bulb temperature, with trend window
−- A schedules page listing all defined schedules, current state of each schedule, and the equipment controlled
−- An alarms page showing active alarms, recently acknowledged alarms, and a search interface for the alarm history
−
−## Setpoint and Override Behavior {toc}
−
−### Setpoint adjustments and equipment overrides from graphics shall write to the appropriate BACnet object's priority array at a defined priority level.
−
−### Operator manual overrides shall write at priority 8 (Manual Operator).
−
−### Schedule and supervisory writes shall use priorities 14–16 as appropriate.
−
−### Releasing an override shall release the priority slot, returning control to lower-priority programs.
−
−### The graphic shall display when a point is currently being overridden and at what priority, so that operators can determine why a point is not following its programmed sequence.
−
−## Engineering Units and Localization {toc}
−
−```datasheet
−label: Display Units
−type: radio
−options:
− - "I-P (°F, in. w.g., gpm, CFM)"
− - "SI (°C, Pa, L/s, m³/h)"
− - "Operator selectable per user account"
−default: "I-P (°F, in. w.g., gpm, CFM)"
−```
−### All displayed values shall include engineering units in either I-P (inch-pound) or SI units as selected for the project.
−
−### Mixed units within a single graphic shall be avoided.
−
−### Temperature shall be displayed to one decimal place; pressures to two decimal places where the magnitude is below 10, otherwise to one decimal place; flows to no more decimal places than the meter resolution actually supports.
−
−
−# Scheduling {toc}
−
−## Schedule Structure {toc}
−
−```datasheet
−label: Schedule Types Supported
−type: checkbox
−options:
− - "Daily schedule (Monday–Sunday with distinct profiles per day)"
− - "Weekly recurring schedule"
− - "Holiday and exception schedules (overrides daily/weekly)"
− - "Calendar schedule (yearly recurring events, fiscal-year alignment)"
− - "Event-driven schedules (triggered by external input)"
− - "Demand response schedules (utility signal triggers a reduced-load schedule)"
−default: "Holiday and exception schedules (overrides daily/weekly)"
−```
−### The system shall support occupancy schedules with at least daily, weekly, yearly, and holiday components.
−
−### Each schedule shall produce a discrete output (typically the BACnet Schedule object) consumed by the controllers it serves.
−
−### The same schedule may serve multiple controllers — for example, a "Main Building Occupied" schedule may drive air handler occupancy modes, terminal unit zone setpoints, and exhaust fan operation.
−
−
−## Optimum Start and Stop {toc}
−
−```datasheet
−label: Optimum Start/Stop
−type: radio
−options:
− - "Optimum start and stop on all scheduled equipment"
− - "Optimum start only (no optimum stop)"
− - "Optimum start and stop on AHUs only (not on terminal units)"
− - "Not implemented (fixed pre-start/post-stop times in schedule)"
−default: "Optimum start and stop on all scheduled equipment"
−```
−### Where required by ASHRAE 90.1 or the applicable energy code, the system shall implement optimum start and optimum stop for the air handling units and terminal units serving each occupancy schedule.
−
−### Optimum start calculates the earliest pre-occupancy startup time required to bring zones to occupied setpoint by the start of occupancy, based on indoor and outdoor conditions and a learning algorithm that adjusts the start time daily. {note}
−
−### Optimum stop terminates active heating or cooling before the end of occupancy, coasting the zone through the final occupied period. {note}
−
−
−## Holiday and Calendar {toc}
−
−### The system shall support at least 50 holidays and exception days per year.
−
−### Holidays shall propagate automatically to all schedules without requiring per-schedule re-entry.
−
−### The Contractor shall load the next two years of US federal holidays at substantial completion; the Owner shall maintain the calendar thereafter.
−
−# Alarming and Events {toc}
−
−## Alarm Classes and Priorities {toc}
−
−```datasheet
−label: Alarm Priority Levels
−type: select
−options:
− - "3 levels (Critical / High / Low)"
− - "4 levels (Critical / High / Medium / Low)"
− - "5 levels (Critical / Urgent / High / Medium / Low)"
− - "Custom priority mapping per Owner requirements"
−default: "3 levels (Critical / High / Low)"
−```
−### The system shall support multiple alarm priority levels — at minimum, critical (immediate response required, life-safety or major equipment), high (response required within shift, significant comfort or equipment risk), and low (informational, response can be scheduled).
−
−### Each defined alarm shall be assigned a priority and a routing destination.
−
−### Critical alarms shall be visible on the landing page of the operator interface at all times until acknowledged.
−
−
−## Alarm Routing {toc}
−
−```datasheet
−label: Alarm Routing Destinations
−type: checkbox
−options:
− - "Operator workstation (always)"
− - "Local alarm console at building engineer office"
− - "Email — building engineering staff"
− - "Email — Owner maintenance management system"
− - "SMS or push notification to on-call staff"
− - "Integration with Owner IT service management (e.g., ServiceNow)"
−default: "Operator workstation (always)"
−```
−### Alarms shall be routable to multiple destinations: the operator workstation, the alarm console at the building engineer's office, e-mail addresses, SMS gateways via the Owner's notification system, and the Owner's alarm management system if one exists.
−
−### Routing shall be configurable per alarm priority and per time of day (e.g., after-hours critical alarms route to on-call paging).
−
−
−## Alarm Suppression {toc}
−
−```datasheet
−label: Alarm Suppression Strategy
−type: select
−options:
− - "Parent-child suppression (when AHU is off, its downstream alarms are suppressed)"
− - "Time-delay suppression (a transient out-of-range condition shorter than N minutes does not alarm)"
− - "Manual maintenance suppression (operator places equipment in maintenance mode)"
− - "All of the above"
−default: "All of the above"
−```
−### The system shall provide alarm suppression rules to prevent alarm floods when a piece of equipment is off (downstream alarms should be suppressed when their parent equipment is not running) and when scheduled maintenance is in progress.
−
−### Suppression rules shall be documented in the alarm strategy submittal.
−
−
−## Required Alarms {toc}
−
−### At minimum, the system shall implement alarms for the following standard conditions.
−### Specific alarm limits shall be tuned during commissioning based on observed system behavior.
−
−- Loss of communications with any field controller (delayed by at least 60 seconds to suppress transient alarms)
−- Sensor out-of-range or sensor fault on any monitored input
−- Setpoint deviation: each control loop alarms when its measured variable deviates from setpoint by more than a defined band for more than a defined time
−- Equipment runtime status fault: commanded equipment is not running, or commanded-off equipment is running
−- Filter pressure drop high
−- Freeze-stat trip (any unit serving outdoor air in freezing climate)
−- Duct smoke detector activation (interface from fire alarm)
−- Critical space environmental out-of-range (temperature, humidity, pressure) for spaces with such requirements
−- Loss of network — supervisory to field bus
−- Server backup failure
−- User account login failure repeated beyond threshold
−
−# Trending and Historical Data {toc}
−
−## Trend Collection {toc}
−
−```datasheet
−label: Trend Sampling Strategy
−type: select
−options:
− - "Change-of-value (COV) for analog points; state change for digital points (efficient storage)"
− - "Fixed polling interval — 1 minute"
− - "Fixed polling interval — 5 minutes"
− - "Fixed polling interval — 15 minutes"
− - "COV with fixed-interval fallback (recommended)"
−default: "COV with fixed-interval fallback (recommended)"
−```
−### The system shall collect trend logs for all designated points at a configurable interval.
−
−### Standard practice for HVAC trending uses change-of-value (COV) collection for analog points, supplemented by polled samples at a fixed interval to ensure a continuous record. {note}
−
−### Digital state points trend on state change.
−
−
−## Trend Retention {toc}
−
−```datasheet
−label: Trend Retention Period
−type: select
−options:
− - "30 days at original resolution; not aggregated"
− - "30 days at original resolution; 1 year at 15-minute aggregation"
− - "90 days at original resolution; 3 years at hourly aggregation"
− - "1 year at original resolution; 5 years at hourly aggregation"
− - "Indefinite, capacity-limited (recommended for large historians on cloud storage)"
−default: "90 days at original resolution; 3 years at hourly aggregation"
−```
−### The historian shall retain trend data for a configurable period, with shorter intervals (one minute) retained for a shorter window and aggregated (15-minute, hourly) data retained for longer.
−
−### Recent high-resolution data supports fault diagnosis; long-term aggregated data supports energy reporting and warranty disputes. {note}
−
−
−## Required Trends {toc}
−
−### At minimum, the following points shall be trended at all times.
−### Additional points shall be trended during commissioning, with the trend definition retained after commissioning is complete:
−
−- Outdoor air dry-bulb temperature and relative humidity
−- All zone temperature setpoints and measured zone temperatures for spaces with separate zone controls
−- All supply air temperatures, return air temperatures, and mixed air temperatures
−- All chilled water and hot water supply and return temperatures, plant differential pressures, and pumping speeds
−- All air handling unit supply fan and return fan speeds, duct static pressures, and damper positions
−- All terminal unit damper positions, reheat valve positions, and zone airflow rates (for VAV systems)
−- Energy meter readings: total electric, total gas, total domestic water, central plant flows and temperatures sufficient to calculate energy consumed per system
−- All alarm history (separate from trend retention; alarm history may be retained longer)
−
−# Sensors {toc}
−
−## General Sensor Requirements {toc}
−
−### All sensors shall be of industrial or commercial HVAC grade with documented accuracy, repeatability, and range that envelopes the range of conditions to be measured.
−
−### Consumer-grade sensors are not acceptable for permanent installation.
−
−### Each sensor shall be selected so that the operating range used in the application falls within the central 60% of the sensor's stated range, where accuracy is typically best.
−
−## Temperature Sensors {toc}
−
−```datasheet
−label: Temperature Sensor Element
−type: radio
−options:
− - "10 kΩ NTC thermistor at 77°F (Type II, Type III, or platform-standard curve)"
− - "1000 Ω platinum RTD (PT1000) — preferred for accuracy and long-term stability"
− - "100 Ω platinum RTD (PT100) — industrial standard, requires three-wire wiring"
−default: "1000 Ω platinum RTD (PT1000) — preferred for accuracy and long-term stability"
−```
−```datasheet
−label: Temperature Sensor Accuracy (Space, Supply Air, Return Air)
−type: select
−unit: °F
−options:
− - "±1.0°F (consumer grade — not acceptable for new installations)"
− - "±0.5°F (commercial standard)"
− - "±0.3°F (precision applications)"
− - "±0.18°F (laboratory and critical space applications)"
−default: "±0.5°F (commercial standard)"
−```
−```datasheet
−label: Mixed Air and Outdoor Air Temperature Sensor Type
−type: radio
−options:
− - "Averaging serpentine element (full cross-section coverage)"
− - "Single-point sensor (not recommended for mixed air; acceptable for outdoor air only)"
−default: "Averaging serpentine element (full cross-section coverage)"
−```
−```datasheet
−label: Outdoor Air Temperature Sensor Location
−type: radio
−options:
− - "Shielded radiation shield on north side of building, away from exhaust outlets"
− - "Roof-mounted with sun shield, away from rooftop equipment exhaust"
− - "Manufacturer-supplied weather station enclosure"
−default: "Shielded radiation shield on north side of building, away from exhaust outlets"
−```
−### Space temperature sensors shall be located on interior walls, 4 to 5 ft above finished floor, away from supply diffusers, exterior walls, sources of heat (lighting, equipment), and direct sunlight.
−
−### Locating a space sensor on an exterior wall or adjacent to a window introduces 2–4°F of bias that destroys the calibration accuracy of the sensor. {note}
−
−### Duct-mounted temperature sensors in mixed air sections shall be averaging type, with a serpentine element traversing the duct cross-section, to prevent stratification error.
−
−### Single-point sensors in mixed air locations report whichever air layer the sensor happens to be in and produce control problems that look like control loop tuning issues but are actually sensor errors. {note}
−
−### Outdoor air temperature sensors shall be installed with a radiation shield to prevent direct solar gain from biasing the reading by 5–10°F during sunny daylight hours.
−
−### A common error is mounting an outdoor air sensor on a south-facing or roof exposure with no shield, which produces a sensor that reads correctly at night and dramatically over-reads during the day, confusing economizer and reset sequences. {note}
−
−
−
−
−
−## Humidity Sensors {toc}
−
−```datasheet
−label: Humidity Sensor Type
−type: radio
−options:
− - "Capacitive polymer (typical commercial)"
− - "Chilled mirror (laboratory grade, calibration reference)"
−default: "Capacitive polymer (typical commercial)"
−```
−```datasheet
−label: Humidity Sensor Accuracy
−type: select
−unit: '% RH'
−options:
− - "±5% RH (consumer grade — not acceptable for new installations)"
− - "±3% RH (commercial standard)"
− - "±2% RH (humidity-controlled spaces)"
− - "±1% RH (critical environments, museum, archive, healthcare clean)"
−default: "±3% RH (commercial standard)"
−```
−### Capacitive polymer humidity sensors drift over time and require periodic recalibration; typical commercial sensors are rated for ±3% RH out of the box but drift to ±5% or worse within 2–3 years if not recalibrated. {note}
−
−### The O&M manual shall include a recommended recalibration interval, and the Owner shall maintain a calibration program.
−
−### Critical humidity-controlled spaces (operating rooms, archive storage, server rooms) shall use ±2% RH or better sensors with documented annual calibration.
−
−
−
−## Carbon Dioxide Sensors {toc}
−
−### Carbon dioxide sensors are used for demand-controlled ventilation per ASHRAE 62.1 and for indoor air quality monitoring. {note}
−
−```datasheet
−label: CO2 Sensor Type
−type: radio
−options:
− - "Non-dispersive infrared (NDIR), single-channel"
− - "Non-dispersive infrared (NDIR), dual-channel with auto-calibration"
− - "Photoacoustic (high accuracy, higher cost)"
−default: "Non-dispersive infrared (NDIR), dual-channel with auto-calibration"
−```
−```datasheet
−label: CO2 Sensor Range and Accuracy
−type: select
−options:
− - "0–2000 ppm, ±50 ppm or ±5% of reading (standard DCV)"
− - "0–5000 ppm, ±50 ppm or ±5% of reading (high-occupancy spaces)"
− - "0–10,000 ppm (laboratory and industrial applications)"
−default: "0–2000 ppm, ±50 ppm or ±5% of reading (standard DCV)"
−```
−### CO2 sensors shall be of non-dispersive infrared (NDIR) type, which provides the long-term stability required for DCV applications.
−
−### Electrochemical CO2 sensors are not acceptable for permanent installation.
−
−### Dual-channel NDIR with auto-calibration (sometimes called ABC, automatic background calibration) substantially reduces drift over the sensor's service life by periodically referencing the sensor to a clean-air baseline. {note}
−
−### The auto-calibration algorithm assumes that the sensor sees clean outdoor air levels of CO2 (approximately 420 ppm in 2026) at least briefly during each calibration cycle; sensors installed in continuously occupied spaces that never reach outdoor baseline may calibrate incorrectly and the auto-calibration shall be disabled in those applications.
−
−
−
−## Pressure Sensors {toc}
−
−```datasheet
−label: Air Pressure Sensor Range and Accuracy (Duct Static)
−type: select
−options:
− - "0–1 in. w.g. range, ±0.5% of full scale (low-pressure VAV systems)"
− - "0–3 in. w.g. range, ±0.5% of full scale (medium-pressure systems)"
− - "0–5 in. w.g. range, ±0.5% of full scale (high-pressure systems)"
− - "0–10 in. w.g. range, ±0.5% of full scale (industrial)"
−default: "0–3 in. w.g. range, ±0.5% of full scale (medium-pressure systems)"
−```
−```datasheet
−label: Water Pressure Sensor Range and Accuracy
−type: select
−options:
− - "0–50 psig, ±0.5% of full scale"
− - "0–100 psig, ±0.5% of full scale"
− - "0–150 psig, ±0.5% of full scale"
− - "0–300 psig, ±0.5% of full scale (high-pressure systems)"
−default: "0–150 psig, ±0.5% of full scale"
−```
−### Differential pressure sensors used for duct static pressure control shall be selected so that the operating point falls within the central 60% of the sensor range.
−
−### A sensor with too wide a range loses resolution at the operating point and produces noisy control; a sensor with too narrow a range pegs at full scale during system transients and provides no usable feedback. {note}
−
−
−
−## Airflow Measurement {toc}
−
−```datasheet
−label: Airflow Measurement Station
−type: select
−options:
− - "Multi-port averaging thermal-dispersion array (insertion grid)"
− - "Multi-point pitot-tube grid with differential pressure transmitter"
− - "Vortex shedding (in-duct)"
− - "Not used — fan curve based airflow inference (less accurate, acceptable for non-critical applications)"
−default: "Multi-port averaging thermal-dispersion array (insertion grid)"
−```
−### Outdoor air airflow measurement is required for demand-controlled ventilation per ASHRAE 62.1 and is the most reliable method of verifying ventilation compliance.
−
−### The measurement station shall be installed upstream of the outdoor air damper at a location with adequate straight duct upstream and downstream to develop a stable velocity profile per the manufacturer's installation requirements.
−
−
−# Actuators {toc}
−
−## Damper Actuators {toc}
−
−```datasheet
−label: Damper Actuator Drive Type
−type: select
−options:
− - "Electronic modulating, 0–10 VDC or 4–20 mA control signal"
− - "Electronic two-position (open/closed) for shutoff and isolation dampers"
− - "Electronic floating-point (three-wire) — legacy compatibility only"
− - "Pneumatic (existing pneumatic systems only)"
−default: "Electronic modulating, 0–10 VDC or 4–20 mA control signal"
−```
−```datasheet
−label: Damper Actuator Fail Mode
−type: radio
−options:
− - "Spring return — outdoor air dampers (fail closed) and freeze-protection critical dampers"
− - "Spring return — return/relief dampers (fail open)"
− - "Non-spring-return — internal isolation dampers without freeze risk"
−default: "Spring return — outdoor air dampers (fail closed) and freeze-protection critical dampers"
−```
−### Spring-return actuators are mandatory for outdoor air dampers in freezing climates and for any damper whose failed-open or failed-closed state must be controlled for freeze, life-safety, or pressurization reasons.
−
−### The added cost of spring return is small compared to the consequences of a powered actuator failing in mid-stroke during a power loss in winter. {note}
−
−### Actuators shall be sized for the damper's seating torque (close-off torque under operating differential pressure) plus a 25% safety margin, not for the running torque.
−
−### Undersized actuators are a chronic field problem that causes dampers not to fully close — particularly outdoor air dampers, which contribute to freeze damage and infiltration losses. {note}
−
−
−
−## Valve Actuators {toc}
−
−```datasheet
−label: Hydronic Valve Actuator Drive Type
−type: select
−options:
− - "Electronic modulating, 0–10 VDC or 4–20 mA"
− - "Electronic two-position (isolation valves)"
− - "Pneumatic (existing pneumatic systems only)"
−default: "Electronic modulating, 0–10 VDC or 4–20 mA"
−```
−
−```datasheet
−label: Valve Actuator Fail Mode (Hot Water Coils)
−type: radio
−options:
− - "Spring return — fail open (heat to coil on power loss, freeze protection)"
− - "Non-spring-return (no freeze risk, acceptable for re-heat coils with separate freeze protection)"
−default: "Spring return — fail open (heat to coil on power loss, freeze protection)"
−```
−
−```datasheet
−label: Valve Actuator Fail Mode (Chilled Water Coils)
−type: radio
−options:
− - "Spring return — fail closed (no cooling on power loss)"
− - "Non-spring-return (acceptable where no humidity or temperature consequence)"
−default: "Spring return — fail closed (no cooling on power loss)"
−```
−
−## Equipment VFD Integration {toc}
−
−### All variable frequency drives serving HVAC equipment shall be integrated to the BAS via the network protocol specified in [[sync/hvac-variable-frequency-drives]].
−
−### The integration shall expose at minimum the standard VFD point set: start/stop command, speed reference, run status, fault status with fault code, output frequency, motor current, motor power, accumulated kWh, accumulated run hours, and bypass status where bypass is provided.
−
−### The BAS shall not write speed reference at the highest priority unless the equipment standard explicitly requires it; the VFD's hardwired analog input or HOA selector shall override BAS command per the safety hierarchy.
−
−# Equipment Integration {toc}
−
−## Air Handling Units {toc}
−
−### The BAS shall control all air handling unit functions as defined in the published sequence of operations on the drawings and in [[sync/air-handling-units]].
−
−### Standard AHU integration shall include the following points at the BAS network: supply, return, mixed, and outdoor air temperatures; supply and return humidity (where humidity control is provided); duct static pressure (VAV systems); supply fan and return fan VFD start/stop, speed, status, and feedback; chilled and hot water coil valve positions; outdoor, return, and exhaust/relief damper positions; freeze-stat status; supply and return smoke detector status (interfaced from fire alarm); filter pressure status; and any unit-specific points required by the sequence of operations.
−
−## Terminal Units {toc}
−
−### Where the project employs VAV or other terminal units per [[sync/air-terminal-units]], the BAS shall provide a field controller at each terminal unit — typically a B-ASC application-specific controller — communicating on the field bus to the zone-level supervisory layer.
−
−### Each terminal unit controller shall implement the published terminal unit sequence and shall expose the following points to the network: zone temperature, zone temperature setpoints (occupied cooling, occupied heating, unoccupied), damper position, airflow rate, reheat valve or stage status, occupancy sensor input where provided, and any CO2 sensor input where DCV is implemented for the zone.
−
−## Central Plant {toc}
−
−### Chillers, boilers, cooling towers, pumps, and other central plant equipment shall be integrated to the BAS through the network interfaces provided by each piece of equipment.
−
−### The native interface shall be BACnet wherever the equipment supports it; Modbus integration through a gateway is acceptable where BACnet is not native.
−
−### Standard plant integration shall include for each piece of equipment: run status, fault status with fault code, output capacity or speed, all supply and return temperatures and pressures, energy consumption (accumulated kWh, BTU/hr, or fuel input), and any equipment-specific points required by the sequence (refrigerant pressures and temperatures for chillers; combustion settings and flue temperatures for boilers; cycles of concentration and chemical levels for cooling towers per [[sync/hvac-water-treatment]]).
−
−## Water Treatment Interface {toc}
−
−### The BAS shall integrate with the chemical water treatment controllers per [[sync/hvac-water-treatment]] to monitor conductivity, biocide cycle status, makeup flow, and blowdown flow on cooling tower systems and on closed-loop systems where chemical treatment is provided.
−
−### Integration to the water treatment controller is particularly important for ASHRAE 188 compliance documentation, which requires demonstrated tracking of cooling tower operating chemistry and dispersant addition. {note}
−
−## Testing, Adjusting, and Balancing Interface {toc}
−
−### During commissioning per [[sync/testing-adjusting-and-balancing]], the BAS shall provide the TAB agent with operator-level access to override damper, valve, and fan speed setpoints for the duration of balancing.
−
−### After balancing is complete, all overrides shall be released and the as-balanced settings recorded as the system baseline.
−
−## Fire Alarm Interface {toc}
−
−### Interface to the fire alarm system per NFPA 72 shall be by hardwired contacts at the fire alarm control panel, not by network protocol.
−
−### The BAS shall receive smoke detection alarms (typically wired through Form C contacts at each duct smoke detector and at the fire alarm panel) and shall execute the smoke control sequence on the drawings — shutting down fans, repositioning dampers, opening or closing stair pressurization equipment.
−
−### The BAS shall not be the primary smoke control sequence; the fire alarm system shall command the safety sequence directly and the BAS shall mirror that state.
−
−### The interface to [[sync/fire-alarm-systems]] is a hardwired interface only, isolated from the data network.
−
−# Cybersecurity {toc}
−
−## The BAS is operational technology (OT) that controls building systems whose failure can affect occupant safety, productivity, and energy consumption. {note}
−
−## OT systems are increasingly targeted by intruders who exploit poor segregation between IT and OT networks, weak account management, unpatched embedded operating systems, and default credentials. {note}
−
−## The cybersecurity provisions of this standard implement the baseline practices recommended by NIST SP 800-82 for OT environments and shall be considered minimum requirements.
−
−## The Owner's IT/OT security organization may impose stricter requirements that govern.
−
−## Network Segregation {toc}
−
−```datasheet
−label: BAS Network Segregation
−type: select
−options:
− - "Physically separate network (dedicated cabling and switches)"
− - "VLAN-segregated on shared switching infrastructure with documented access control lists"
− - "Software-defined network segmentation (modern campuses with SDN-capable switching)"
− - "Shared with general data network — NOT ACCEPTABLE (only for documenting non-compliant existing installations)"
−default: "VLAN-segregated on shared switching infrastructure with documented access control lists"
−```
−### The BAS network shall not share broadcast domains with the production data network.
−
−### Where physical separation is not practical, VLAN segregation with documented and reviewed access control lists is required.
−
−### The boundary between the BAS network and any other network shall be enforced by a firewall configured for the principle of least privilege — only specific protocols, ports, and source addresses required for legitimate BAS operation shall be permitted, and all rules shall be documented and reviewed at least annually.
−
−
−## Remote Access {toc}
−
−```datasheet
−label: Remote Access Method
−type: select
−options:
− - "No remote access — site-local operation only"
− - "Owner-managed VPN with multi-factor authentication"
− - "Manufacturer-provided cloud connector with strong authentication (verify Owner policy)"
− - "Jump host inside Owner DMZ, MFA required, session recording enabled"
−default: "Owner-managed VPN with multi-factor authentication"
−```
−### Remote access for monitoring, troubleshooting, and software maintenance shall be through an Owner-managed VPN or a Owner-approved jump host with multi-factor authentication.
−
−### Direct internet exposure of BAS servers, supervisory controllers, or workstation web interfaces is not permitted.
−
−### Manufacturer cloud connectors shall not be installed without explicit Owner approval and shall be configured to require authentication on every session.
−
−
−## Account Management {toc}
−
−```datasheet
−label: Password Policy
−type: select
−options:
− - "Minimum 12 characters, complexity required, 90-day rotation, no reuse of last 12"
− - "Owner Active Directory policy (preferred where AD integration is used)"
− - "Phrase-based policy with multi-factor authentication on privileged accounts"
−default: "Owner Active Directory policy (preferred where AD integration is used)"
−```
−### Default and vendor-supplied passwords on every device — server operating system, supervisory controllers, network switches, gateways, programmable controllers, and any device with an authentication interface — shall be changed before the device is placed in service.
−
−### The Contractor shall provide a signed statement at substantial completion that all default credentials have been changed; the Owner's representative shall be entitled to spot-check a sample of devices to verify.
−
−### User accounts shall follow the principle of least privilege: each named user shall have only the role required to perform that user's function.
−
−### Account creation, modification, and deactivation shall follow a documented procedure that includes an audit trail.
−
−
−## Patching and Firmware Updates {toc}
−
−```datasheet
−label: Patching Strategy
−type: radio
−options:
− - "Server OS patched monthly per Owner IT policy; controller firmware patched per manufacturer security bulletins"
− - "Server OS patched quarterly with documented exception review; controller firmware patched annually"
− - "Patches applied only when a specific vulnerability is identified affecting installed equipment (least preferred)"
−default: "Server OS patched monthly per Owner IT policy; controller firmware patched per manufacturer security bulletins"
−```
−### The Owner and the controls contractor shall jointly maintain a patching cadence during the warranty period and the Owner's ongoing service contract thereafter.
−
−### Embedded controller firmware is not patched as frequently as server software but shall be updated promptly when the manufacturer issues a security bulletin affecting installed firmware.
−
−### Firmware updates shall be tested on a non-production controller before being deployed widely on the installed base.
−
−
−## Audit Logging {toc}
−
−```datasheet
−label: Audit Logging
−type: checkbox
−options:
− - "User login and logout events"
− - "Failed login attempts"
− - "Configuration changes (programs, schedules, alarm definitions)"
− - "Setpoint and override write events"
− - "Account creation, modification, deletion"
− - "Backup and restore events"
− - "Patch and firmware update events"
−default: "User login and logout events"
−```
−### Audit logs shall be retained for a minimum of 90 days and shall be readable by the Owner's security operations team in a standard format.
−
−### Where the Owner operates a centralized security information and event management (SIEM) platform, logs shall be forwarded to that platform via syslog or comparable mechanism.
−
−
−## Removable Media {toc}
−
−### Removable media (USB drives, optical media, SD cards) shall not be used on BAS servers, workstations, or programming laptops without explicit Owner authorization.
−
−### Each authorized removable media event shall be logged.
−
−### Software updates and configuration files shall be transferred via the Owner-approved file transfer mechanism rather than via removable media wherever practical.
−
−# Point Counts and System Sizing {toc}
−
−## The total point count is among the most consequential sizing parameters for a BAS — it drives controller hardware sizing, MS/TP segment count, server resource allocation, and licensing where the manufacturer licenses by points. {note}
−
−```datasheet
−label: Point Count Summary — Total Active Points (Hardware + Calculated + Integrated)
−type: range
−unit: points
−drawing_ref: true
−options:
− min: 100
− max: 100000
− setpoints: [100, 250, 500, 1000, 2500, 5000, 10000, 25000, 50000, 100000]
−default: 5000
−```
−```datasheet
−label: Point Type Mix — Hardware I/O Points
−type: range
−unit: points
−drawing_ref: true
−options:
− min: 50
− max: 50000
− setpoints: [50, 100, 250, 500, 1000, 2500, 5000, 10000, 25000, 50000]
−default: 2500
−```
−```datasheet
−label: Point Type Mix — Network Integrated Points
−type: range
−unit: points
−drawing_ref: true
−options:
− min: 50
− max: 50000
− setpoints: [50, 100, 250, 500, 1000, 2500, 5000, 10000, 25000, 50000]
−default: 2500
−```
−## Point counts shall be developed from the equipment schedules and the sequences of operation and verified during shop drawing development.
−
−## System capacity shall include a minimum of 20% spare capacity above the design point count, at every level — spare hardware I/O on field controllers, spare bandwidth on MS/TP segments, spare server CPU and memory, and spare licensing where applicable.
−
−## Spare capacity is required to absorb the routine additions and renovations that follow substantial completion; a system delivered at 100% of its licensed capacity becomes a barrier to building operations changes within the first year of service. {note}
−
−
−
−
−# Field Installation {toc}
−
−## Controller Panel Installation {toc}
−
−```datasheet
−label: Controller Panel Enclosure Rating
−type: select
−options:
− - "NEMA 1 — indoor, clean, dry locations"
− - "NEMA 12 — indoor, dust-tight (typical mechanical rooms)"
− - "NEMA 3R — outdoor, sheltered (rooftop)"
− - "NEMA 4 — washdown, condensation-prone"
− - "NEMA 4X — corrosive environments, cooling towers, coastal"
−default: "NEMA 12 — indoor, dust-tight (typical mechanical rooms)"
−```
−### Field controller panels shall be mounted in clean, dry, accessible locations near the equipment they serve.
−
−### Maintenance access to each panel shall include at minimum a 36 in. clear working space in front and adequate clearance above and to the sides for cable entry and panel door swing.
−
−### Panels shall not be installed in locations subject to vibration without vibration isolation, in damp or wet locations without NEMA 4 or 4X enclosures, or in classified hazardous locations without appropriately listed enclosures.
−
−
−## Wiring Practices {toc}
−
−```datasheet
−label: MS/TP Cable Type
−type: radio
−options:
− - "22 AWG shielded twisted pair, foil shield with drain (plenum-rated where required)"
− - "20 AWG shielded twisted pair (heavily loaded segments or long runs)"
− - "Manufacturer-specified cable (verify against published cable type)"
−default: "22 AWG shielded twisted pair, foil shield with drain (plenum-rated where required)"
−```
−### Control wiring shall be installed per [[sync/conductors-and-cables]] and [[sync/raceways-and-conduit]] and per NFPA 70 Article 725 for Class 2 circuits.
−
−### Control wiring shall not be installed in the same raceway as line-voltage power conductors.
−
−### Minimum separation between Class 2 control wiring and power wiring shall be 12 in. where parallel runs are unavoidable; where crossings are unavoidable, conductors shall cross at right angles.
−
−### Network cables (BACnet/IP, MS/TP) shall be routed separately from variable frequency drive output cables to avoid coupling of PWM switching noise.
−
−### Shield drain conductors shall be terminated to a clean ground at one end only — typically at the supervisory controller — to prevent ground-loop currents from flowing through the shield.
−
−### Both-end grounding of MS/TP shields is a common source of intermittent communications faults that are difficult to diagnose because the symptom appears as random device dropouts. {note}
−
−
−## Sensor and Actuator Installation {toc}
−
−### Sensors shall be installed in accordance with the manufacturer's installation instructions and per the location requirements of this standard.
−
−### Each sensor shall be calibrated against a reference instrument at startup; the as-found and as-left readings shall be recorded on the calibration form.
−
−### Sensors that read more than the specified accuracy off from the reference shall be replaced, not adjusted out by software offset.
−
−### Persistent software offsets disguise sensor drift and undermine future calibration. {note}
−
−### Actuators shall be installed with the actuator shaft coupled to the damper or valve shaft per the manufacturer's instructions, with the coupling tight, the shaft aligned, and the stroke verified by commanding fully open and fully closed from the BAS.
−
−### Damper actuator end-of-stroke positions shall be set so that the damper fully closes and fully opens at the actuator end positions, with no residual leakage when commanded closed and no over-travel when commanded open.
−
−## Identification and Labeling {toc}
−
−```datasheet
−label: Labeling Standard
−type: select
−options:
− - "Engraved phenolic labels, mechanically attached"
− - "Vinyl thermal-transfer labels rated for service environment"
− - "Brass or stainless tags on stainless lacing (corrosive environments)"
−default: "Engraved phenolic labels, mechanically attached"
−```
−### Each controller panel shall be permanently labeled with the panel designation, the equipment or zone it serves, and the BAS device instance number.
−
−### Each cable entering a panel shall be labeled at the panel termination with the cable's source and the circuit it carries.
−
−### Each field-mounted sensor and actuator shall be labeled with its point name as it appears in the BAS database.
−
−### Labels shall be machine-printed and applied to a surface that will remain visible and intact for the service life of the equipment.
−
−
−# Testing and Commissioning {toc}
−
−## Factory Acceptance Test {toc}
−
−```datasheet
−label: Factory Acceptance Test
−type: radio
−options:
− - "Not required — small project, no central plant control panel pre-assembly"
− - "Required — central plant control panel(s) pre-assembled and tested before shipment"
− - "Required and witnessed by Owner or Commissioning Authority"
−default: "Required — central plant control panel(s) pre-assembled and tested before shipment"
−```
−### Where the project includes a complete plant control system fabricated and tested at the controls contractor's facility before shipment, a factory acceptance test (FAT) shall be performed.
−
−### FAT shall verify hardware assembly, power-up of all controllers, communication between controllers and supervisory devices, basic graphic page rendering, and a smoke test of the loaded programs.
−
−### FAT does not replace field functional testing.
−
−
−## Field Functional Testing {toc}
−
−```datasheet
−label: Field Functional Testing Scope
−type: checkbox
−options:
− - "Point-to-point verification — every hardware input and output, sensor calibration, actuator stroke"
− - "Network communication verification — BACnet PICS compliance, MS/TP token-pass, BACnet/IP routing"
− - "Sequence functional test — each step in each sequence on the drawings"
− - "Alarm verification — each defined alarm triggered and routed correctly"
− - "Schedule verification — schedules executed and equipment responds as commanded"
− - "Trend verification — defined trends collecting data and accessible from the historian"
− - "Failure mode test — induce loss of communications and verify stand-alone behavior"
− - "Cybersecurity verification — default passwords changed, network access controls applied"
−default: "Point-to-point verification — every hardware input and output, sensor calibration, actuator stroke"
−```
−### Field functional testing shall verify every point in the system and every sequence in the sequence of operations document.
−
−### Functional tests shall be performed by the controls contractor and witnessed by the Commissioning Authority where one is engaged.
−
−### Each test shall produce a documented test result — pass, fail, or deficiency noted with a corrective action.
−
−
−## Sensor Calibration {toc}
−
−```datasheet
−label: Sensor Calibration Reference
−type: radio
−options:
− - "NIST-traceable certificate, calibration within last 12 months"
− - "Manufacturer factory calibration accepted (within last 6 months)"
− - "On-site comparison to recently calibrated reference"
−default: "NIST-traceable certificate, calibration within last 12 months"
−```
−### Every measured sensor shall be calibrated at startup against a reference instrument of known accuracy traceable to NIST or equivalent national metrology institute.
−
−### Calibration shall be performed at conditions representative of the sensor's normal operating range, not at room temperature only.
−
−### Calibration records shall be retained as a closeout submittal and shall identify each sensor by its system tag, the reference instrument used, the as-found reading, and the as-left reading.
−
−
−## Demonstration and Training {toc}
−
−```datasheet
−label: Owner Training Hours
−type: select
−unit: hours
−options:
− - "8 hours (1 day) — small system, single operator"
− - "16 hours (2 days) — typical commercial building"
− - "24 hours (3 days) — larger system or campus"
− - "40 hours (1 week) — full operator certification program"
−default: "16 hours (2 days) — typical commercial building"
−```
−### The Contractor shall conduct documented training for Owner personnel covering the operator interface, alarm response, scheduling, override and release procedures, basic trending and reporting, and the cybersecurity procedures that constrain Owner operations (account management, removable media, remote access).
−
−### Training shall be delivered after substantial completion and shall include at least two sessions to accommodate shift coverage.
−
−### Training materials including written procedures, recorded sessions, and a quick-reference card for common operations shall be left with the Owner.
−
−### Training shall be tailored to the actual installed system, not delivered from a generic manufacturer slide deck.
−
−
−# Warranty {toc}
−
−```datasheet
−label: System Warranty Period
−type: select
−options:
− - "1 year from substantial completion (parts and labor)"
− - "2 years from substantial completion (parts and labor)"
− - "1 year parts and labor, plus 90 days of software updates and parameter tuning"
− - "Extended — 5 years parts, 1 year labor"
−default: "1 year parts and labor, plus 90 days of software updates and parameter tuning"
−```
−## The warranty shall cover defects in materials and workmanship under normal service conditions for the specified period from the date of substantial completion.
−
−## The warranty shall include a fine-tuning period of at least 90 days following substantial completion during which the controls contractor responds to operational issues — control loop instability, alarm tuning, schedule adjustments, graphics changes — that emerge as the building moves through its first occupancy cycle.
−
−## Tuning during this period shall be at no additional cost; this is among the most valuable warranty provisions in a BAS contract and shall not be omitted.
−
−## The manufacturer shall provide a written commitment that replacement parts, firmware, and software upgrade paths will remain available for the installed product platform for a minimum of ten years from the date of manufacture.
−
−
−## Software Support {toc}
−
−```datasheet
−label: First-Year Software Support
−type: checkbox
−options:
− - "Server operating system security patches"
− - "BAS application software updates and security patches"
− - "Controller firmware updates"
− - "Graphics changes (limited hours per month)"
− - "Schedule and alarm adjustments (limited hours per month)"
− - "Trend log additions (limited hours per month)"
− - "Annual cybersecurity review"
−default: "Server operating system security patches"
−```
−
−# Spare Parts {toc}
−
−```datasheet
−label: Spare Parts Delivered at Substantial Completion
−type: checkbox
−options:
− - "10% spare hardware I/O modules of each type installed"
− - "One spare controller of each model installed"
− - "One spare power supply of each type installed"
− - "One spare network switch of each model installed"
− - "Five spare space temperature sensors"
− - "Two spare humidity sensors of each type installed"
− - "Two spare CO2 sensors of each type installed"
− - "One spare damper actuator of each size installed"
− - "One spare valve actuator of each size installed"
−default: "10% spare hardware I/O modules of each type installed"
−```
−## Spare parts shall be of the same model and firmware revision as the installed equipment.
−
−## Spare controllers shall be retained in original packaging with documented storage conditions.
−
−## Long-term storage of unused controllers in damp or hot conditions degrades electrolytic capacitors and battery-backed memory and shortens the spare's useful service life. {note}
−
−
−# Identification and Labeling {toc}
−
−## Each controller panel shall include a permanent nameplate identifying the panel by its BAS designation, the equipment or zone it serves, the supervisory controller it reports to, and an emergency contact for service.
−
−## Inside each panel door, a current single-line diagram and point schedule shall be permanently mounted in a clear pocket.
−
−## The point schedule shall be updated whenever the panel is modified.
−
−## All BAS network cables — BACnet/IP copper, BACnet/IP fiber, MS/TP cable, Modbus cable — shall be labeled at every termination with cable type, source, and destination.
−
−## Field sensor and actuator cables shall be labeled at the controller termination with the point name as it appears in the BAS database.
−
−## Cable labeling at the controller termination shortens the most common BAS troubleshooting task — finding the cable that connects to a given point — from minutes to seconds. {note}
−
−## A laminated system overview drawing shall be permanently mounted in the main mechanical room or the BAS operator workstation room, showing the supervisory network topology, the location of each controller panel, and the contact information for the controls contractor and the manufacturer's technical support organization.
−
−## This drawing shall be updated at any system change and shall remain current throughout the service life of the system.
+---
+title: Building Automation System
+category: Mechanical / Controls & Testing
+description: >
+ When to use: Networked direct digital control (DDC) systems that supervise and execute control of HVAC and ancillary mechanical building systems. Covers the management, supervisory, field controller, and field bus layers; controller and network conformance; operator workstation and graphics; scheduling, alarming, and trending; field sensors and control actuators; equipment integration points; the operational technology cybersecurity baseline; installation, commissioning, and closeout. Applicable to new construction, whole-system replacement, and expansion of an existing control system.
+
+ Not intended for: Lighting control systems; fire alarm systems (see [[sync/fire-alarm-systems]]); physical security, video surveillance, and intrusion detection systems; medium-voltage substation supervisory control; industrial process control outside building mechanical utilities; control conductors, cable, and raceway materials (see [[sync/conductors-and-cables]] and [[sync/raceways-and-conduit]]). Sequences of operation for individual mechanical equipment are published on the contract drawings and in the equipment standards (see [[sync/air-handling-units]], [[sync/air-terminal-units]], [[sync/hvac-pumps]], [[sync/hvac-variable-frequency-drives]], [[sync/hvac-water-treatment]], [[sync/testing-adjusting-and-balancing]]) and are not restated here.
+---
+
+# Scope {toc}
+
+## This standard covers the products, network architecture, programming, integration, commissioning, and cybersecurity hardening of the building automation system (BAS) that executes and supervises control of the building's mechanical systems. {note}
+
+## The system is organized in four layers, and most of the decisions in this standard attach to one of them. {note}
+
+- **Management layer.** The server and operator clients that host graphics, the historical trend database, the alarm and event database, schedule definitions, the user account directory, and configuration backup.
+- **Supervisory layer.** Network controllers that perform global control logic, scheduling, alarm generation, trend collection from field controllers, and integration of subsystems that do not speak the primary protocol natively.
+- **Field controller layer.** Programmable and application-specific controllers at each item of mechanical equipment that execute that equipment's sequence of operations.
+- **Field bus and I/O layer.** Sensors, actuators, end switches, and equipment communication interfaces wired to controller inputs and outputs or networked on a field bus.
+
+## The following are outside this standard and are governed elsewhere. {note}
+
+- Sequences of operation for individual mechanical equipment, which are published on the contract drawings and in the equipment standards; this standard governs the platform that executes them.
+- Control conductors, cable, raceway, and boxes, which are governed by [[sync/conductors-and-cables]] and [[sync/raceways-and-conduit]]; this standard governs only the electrical characteristics, separation, and termination practices specific to control and network circuits.
+- The fire alarm system itself, which is governed by [[sync/fire-alarm-systems]]; only the interface between the two systems is addressed here.
+- Line-voltage power distribution to BAS panels upstream of the control power transformer or the branch circuit disconnecting means.
+
+## Control circuits supplied by the BAS shall be Class 2 circuits complying with NFPA 70 Article 725 unless the contract documents designate a different circuit class.
+
+## The BAS shall interface with the fire alarm system for fan shutdown, damper command, and smoke control status in accordance with NFPA 72 and the smoke control sequence on the contract drawings.
+
+# Referenced Standards {toc}
+
+## Equipment, materials, software, and installation shall comply with the latest adopted edition of each of the following unless a specific edition is cited.
+
+## Where the contract documents, the adopted building code, or a referenced standard conflict, the more stringent requirement shall govern unless the Engineer of Record directs otherwise in writing.
+
+| Standard | Title |
+|----------|-------|
+| ANSI/ASHRAE 135 | BACnet - A Data Communication Protocol for Building Automation and Control Networks |
+| ANSI/ASHRAE 135.1 | Method of Test for Conformance to BACnet |
+| ANSI/ASHRAE Guideline 13 | Specifying Building Automation Systems |
+| ANSI/ASHRAE Guideline 36 | High-Performance Sequences of Operation for HVAC Systems |
+| ANSI/ASHRAE 223 | Designation and Classification of Semantic Tags for Building Data |
+| ANSI/ASHRAE 231 | Control Description Language |
+| ANSI/ASHRAE 62.1 | Ventilation and Acceptable Indoor Air Quality |
+| ANSI/ASHRAE 188 | Legionellosis - Risk Management for Building Water Systems |
+| ANSI/ASHRAE/IES 90.1 | Energy Standard for Sites and Buildings Except Low-Rise Residential Buildings |
+| ISO 16484-2 | Building Automation and Control Systems (BACS) - Hardware |
+| ISO 16484-3 | Building Automation and Control Systems (BACS) - Functions |
+| ISO 16484-5 | Building Automation and Control Systems (BACS) - Data Communication Protocol |
+| ISO 16484-6 | Building Automation and Control Systems (BACS) - Data Communication Conformance Testing |
+| ANSI/CTA-709.1 | Control Network Protocol Specification |
+| Modbus Application Protocol Specification | Application layer protocol for Modbus serial line and Modbus TCP |
+| NIST SP 800-82 | Guide to Operational Technology (OT) Security |
+| ISA/IEC 62443 | Security for Industrial Automation and Control Systems |
+| NFPA 70 | National Electrical Code (Article 725 - Class 2 and Class 3 circuits; Article 800 - communications circuits) |
+| NFPA 72 | National Fire Alarm and Signaling Code |
+| NFPA 90A | Installation of Air-Conditioning and Ventilating Systems |
+| UL 916 | Energy Management Equipment |
+| UL 60730-1 | Automatic Electrical Controls - General Requirements |
+| UL 50E | Enclosures for Electrical Equipment, Environmental Considerations |
+| NEMA 250 | Enclosures for Electrical Equipment (1000 Volts Maximum) |
+| IEEE 802.3 | Ethernet |
+| ANSI/TIA-568 | Balanced Twisted-Pair and Optical Fiber Telecommunications Cabling Systems |
+| ANSI/TIA-862 | Structured Cabling Infrastructure Standard for Intelligent Building Systems |
+| 47 CFR Part 15 | Radio Frequency Devices (Subpart B - unintentional radiators) |
+| ASCE/SEI 7 | Minimum Design Loads and Associated Criteria for Buildings and Other Structures |
+| ISO 9001 | Quality Management Systems - Requirements |
+
+# Submittals {toc}
+
+## Action Submittals {toc}
+
+### The Contractor shall submit the following for the Engineer's review and return before any BAS product is procured or installed:
+
+- Product data for each server, supervisory controller, programmable controller, application-specific controller, gateway, network switch, sensor, and actuator, identifying manufacturer, model, protocol conformance listing, device profile, and the interoperability building blocks supported
+- Protocol Implementation Conformance Statement for every device that communicates on the primary protocol
+- System architecture diagram showing the management, supervisory, field controller, and field bus layers, every network segment, the physical media of each segment, and the boundary of every subsystem that does not communicate natively in the primary protocol
+- Network addressing plan giving device instance numbers unique across the whole system, network numbers per segment, IP addressing for routed devices, and field bus node addresses with the master node count per segment
+- Point list organized by equipment giving each point's name, object type and instance, engineering units, range, alarm limits, change-of-value increment, and origin as hardware input, calculated value, or integrated value
+- Graphics intent package with representative site, floor plan, system schematic, and equipment pages showing navigation hierarchy and dynamic value treatment
+- Schedule and alarm strategy defining schedule structure, alarm classes and priorities, suppression rules, and routing destinations by priority and time of day
+- Trend plan listing trended points, sampling method, sampling interval, retention, aggregation, and whether each trend is buffered on the controller or on the server
+- Cybersecurity plan addressing network segregation, account management, authentication, patch and firmware maintenance, removable media, remote access, and audit logging
+- Integration submittal for each subsystem that does not communicate natively in the primary protocol, giving communication parameters, the register or object map, the gateway product, and the resulting object list presented to the supervisory layer
+- Correspondence document mapping each step of each published sequence of operations to the controller program block that implements it
+- Field wiring riser diagram showing controller panel locations, cable types, segment lengths, and termination points
+- Sizing calculation for each control power transformer and each uninterruptible power supply, showing connected load and reserve capacity
+
+```datasheet
+label: Required Action Submittals
+type: checkbox
+options:
+ - "Product data for controllers, gateways, sensors, and actuators"
+ - "Protocol Implementation Conformance Statement for each device"
+ - "System architecture diagram with all network segments and media"
+ - "Network addressing plan"
+ - "Point list by equipment"
+ - "Graphics intent package"
+ - "Schedule and alarm strategy"
+ - "Trend plan"
+ - "Cybersecurity plan"
+ - "Integration submittal for each non-native subsystem"
+ - "Sequence-to-program correspondence document"
+ - "Field wiring riser diagram"
+ - "Control power and UPS sizing calculations"
+default:
+ - "Product data for controllers, gateways, sensors, and actuators"
+ - "Protocol Implementation Conformance Statement for each device"
+ - "System architecture diagram with all network segments and media"
+ - "Network addressing plan"
+ - "Point list by equipment"
+ - "Graphics intent package"
+ - "Schedule and alarm strategy"
+ - "Trend plan"
+ - "Cybersecurity plan"
+ - "Sequence-to-program correspondence document"
+ - "Field wiring riser diagram"
+```
+
+### The Contractor shall submit the controller, network, point list, and integration submittals as one coordinated package.
+
+### Where the Engineer determines that a submittal was returned for revision because of an internal inconsistency between items that should have been coordinated before submission, the cost of the Engineer's review of the resubmittal shall be borne by the Contractor.
+
+## Informational Submittals {toc}
+
+### The Contractor shall submit the following for information before the pre-installation conference:
+
+- Qualification statement for the controls contractor listing comparable completed projects, their scope, and their completion dates
+- Certificates held by the individuals assigned as programmer, integrator, and commissioning technician for this project
+- Manufacturer's written commitment covering replacement part availability, firmware support, and software upgrade paths for the proposed platform
+- Proposed programming, tagging, and point naming conventions
+- Proposed commissioning schedule identifying the sequence of point-to-point verification, network verification, and functional testing relative to mechanical startup
+
+```datasheet
+label: Required Informational Submittals
+type: checkbox
+options:
+ - "Controls contractor qualification statement"
+ - "Certificates for assigned programmer, integrator, and commissioning technician"
+ - "Manufacturer platform support commitment"
+ - "Programming, tagging, and point naming conventions"
+ - "Proposed commissioning schedule"
+default:
+ - "Controls contractor qualification statement"
+ - "Certificates for assigned programmer, integrator, and commissioning technician"
+ - "Manufacturer platform support commitment"
+ - "Proposed commissioning schedule"
+```
+
+## Closeout Submittals {toc}
+
+### The Contractor shall submit the following before the building automation system is accepted:
+
+- Operation and maintenance manuals covering the operator interface, controller programming, parameter reference, and the manufacturer's recommended preventive maintenance intervals
+- Record drawings reflecting installed panel locations, sensor and actuator locations, cable routing, and every field deviation from the reviewed submittal
+- Complete configuration backup containing controller programs, graphics, schedules, alarm definitions, trend definitions, user accounts, and the server database, in the manufacturer's native backup format
+- Point database export in a spreadsheet-readable format listing every point with its final range, engineering units, alarm limits, and final tag name
+- Calibration record for every measured sensor giving the calibration date, the reference instrument and its traceability, the as-found reading, and the as-left reading
+- Network performance report giving measured field bus token loop times per segment, measured routed traffic on the supervisory network, and any segment loading deficiency observed with its corrective action
+- Cybersecurity closeout package listing all accounts with their assigned roles, all installed firmware and software versions with their release dates, the configured backup schedule, and a signed statement that every default and vendor-supplied credential has been changed
+- Functional test records for every point and every sequence, signed by the Contractor's commissioning technician and countersigned by the Commissioning Authority where one is engaged
+- Training records identifying the personnel trained, the dates, and the topics covered
+- Restoration test record demonstrating that a full configuration backup was restored to a test platform and produced a working system
+
+```datasheet
+label: Required Closeout Submittals
+type: checkbox
+options:
+ - "Operation and maintenance manuals"
+ - "Record drawings"
+ - "Complete configuration backup in native format"
+ - "Point database export"
+ - "Sensor calibration records with as-found and as-left readings"
+ - "Network performance report"
+ - "Cybersecurity closeout package"
+ - "Functional test records"
+ - "Training records"
+ - "Backup restoration test record"
+default:
+ - "Operation and maintenance manuals"
+ - "Record drawings"
+ - "Complete configuration backup in native format"
+ - "Point database export"
+ - "Sensor calibration records with as-found and as-left readings"
+ - "Cybersecurity closeout package"
+ - "Functional test records"
+ - "Training records"
+```
+
+# Quality Assurance {toc}
+
+## Manufacturer Qualifications {toc}
+
+### The BAS platform shall be the product of a manufacturer that has produced direct digital control products for commercial building mechanical systems continuously for at least the period indicated in the datasheet.
+
+```datasheet
+label: Minimum Manufacturer Production History
+type: range
+unit: years
+min: 3
+max: 25
+setpoints: [3, 5, 10, 15, 20, 25]
+default: 10
+```
+
+### The manufacturer shall operate a quality management system certified to ISO 9001.
+
+### The manufacturer shall commit in writing to the availability of replacement parts, firmware, and software upgrade paths for the proposed platform for the period indicated in the datasheet, measured from the date of substantial completion.
+
+```datasheet
+label: Minimum Platform Support Commitment
+type: range
+unit: years
+min: 5
+max: 25
+setpoints: [5, 10, 15, 20, 25]
+default: 10
+```
+
+## Controls Contractor Qualifications {toc}
+
+### Installation, programming, integration, and commissioning of the BAS shall be performed by a controls contractor authorized by the platform manufacturer for the proposed product line.
+
+### The controls contractor shall have completed installations of comparable scope and complexity for at least the period indicated in the datasheet.
+
+```datasheet
+label: Minimum Controls Contractor Experience
+type: range
+unit: years
+min: 2
+max: 15
+setpoints: [2, 3, 5, 10, 15]
+default: 5
+```
+
+### The individuals assigned as programmer, integrator, and commissioning technician shall hold current manufacturer certification on the proposed product line.
+
+### The controls contractor shall maintain a service organization capable of responding on site within the response time indicated in the datasheet for the duration of the warranty period.
+
+```datasheet
+label: Maximum Warranty Service Response Time
+type: range
+unit: hours
+min: 4
+max: 72
+setpoints: [4, 8, 24, 48, 72]
+default: 24
+```
+
+## Protocol Conformance Listing {toc}
+
+### Protocol conformance testing is performed by an independent testing organization against the protocol's published conformance test method - for BACnet, ANSI/ASHRAE 135.1, administered through the BACnet Testing Laboratories listing program. A Protocol Implementation Conformance Statement is a vendor declaration of the same information; it is not independently verified. {note}
+
+### Supervisory and programmable controllers shall carry the conformance listing indicated in the datasheet for the device profile claimed in the submittal.
+
+```datasheet
+label: Conformance Listing Policy - Supervisory and Programmable Controllers
+type: radio
+options:
+ - "Independent conformance listing required for the claimed device profile"
+ - "Vendor Protocol Implementation Conformance Statement accepted in lieu of independent listing"
+ - "Independent conformance listing required, with Engineer-approved exceptions accepted on written request"
+default: "Independent conformance listing required for the claimed device profile"
+```
+
+### Application-specific controllers, smart sensors, smart actuators, and gateways shall carry the conformance listing indicated in the datasheet.
+
+```datasheet
+label: Conformance Listing Policy - Application-Specific Controllers and End Devices
+type: radio
+options:
+ - "Independent conformance listing required for the claimed device profile"
+ - "Vendor Protocol Implementation Conformance Statement accepted in lieu of independent listing"
+ - "Independent conformance listing required, with Engineer-approved exceptions accepted on written request"
+```
+
+### Where the datasheet permits Engineer-approved exceptions, the Contractor shall submit the device's Protocol Implementation Conformance Statement and identify the specific role the device fills, and shall not install the device until the Engineer has accepted it in writing for that role.
+
+### The device profile claimed for each controller shall be sufficient for the functions that controller performs in this project.
+
+```datasheet
+label: Minimum Device Profile - Supervisory Controller
+type: select
+options:
+ - "BACnet Building Controller (B-BC)"
+ - "BACnet Advanced Application Controller (B-AAC)"
+ - "BACnet Advanced Operator Workstation (B-AWS)"
+ - "Not applicable - primary protocol is not BACnet"
+default: "BACnet Building Controller (B-BC)"
+```
+
+```datasheet
+label: Minimum Device Profile - Equipment Field Controller
+type: select
+options:
+ - "BACnet Building Controller (B-BC)"
+ - "BACnet Advanced Application Controller (B-AAC)"
+ - "BACnet Application Specific Controller (B-ASC)"
+ - "BACnet Smart Actuator (B-SA)"
+ - "BACnet Smart Sensor (B-SS)"
+ - "Not applicable - primary protocol is not BACnet"
+default: "BACnet Application Specific Controller (B-ASC)"
+```
+
+## Electrical Safety Listing {toc}
+
+### Controllers, power supplies, gateways, and assembled control panels shall be listed by a Nationally Recognized Testing Laboratory to UL 916 or UL 60730-1 as applicable to the product.
+
+### Equipment supplied from a Class 2 source shall be listed for Class 2 operation in accordance with NFPA 70 Article 725.
+
+### Digital equipment furnished under this standard shall comply with the unintentional radiator emission limits of 47 CFR Part 15 Subpart B for the class appropriate to the installed environment.
+
+### Control panels assembled off site shall bear the listing mark of the panel-shop listing under which they were built.
+
+## Single-Source Responsibility {toc}
+
+### The management, supervisory, field controller, and integration layers of the BAS shall be furnished, installed, programmed, and commissioned under a single controls contractor.
+
+### Where a controller is furnished factory-mounted on packaged mechanical equipment, or where a third-party subsystem such as a submeter, generator controller, or indoor air quality monitor is furnished under another standard, the controls contractor shall integrate that device into the BAS through the interface identified in the integration submittal.
+
+### The controls contractor shall demonstrate at functional testing that every point required by the point list is visible and operable at the operator workstation regardless of which trade furnished the originating device.
+
+### Where a factory-furnished controller does not expose a point required by the point list, the controls contractor shall notify the Engineer in writing within ten business days of discovering the deficiency and shall propose a means of obtaining the value.
+
+## Pre-Installation Conference {toc}
+
+### A pre-installation conference shall be held before any BAS field work begins.
+
+### Attendance shall include the controls contractor, the mechanical contractor, the electrical contractor, the Owner's information technology representative, and the Commissioning Authority where one is engaged.
+
+### The conference agenda shall cover network port and address assignment with the Owner's information technology organization, identification of the panels served from standby or uninterruptible power, field bus routing and segment boundaries, panel locations and working clearances, and the cybersecurity constraints that apply to contractor access during construction and after substantial completion.
+
+# Environmental and Service Conditions {toc}
+
+## Controller Ambient Ratings {toc}
+
+### Controllers, power supplies, and network devices shall be rated for continuous operation across the ambient temperature and humidity range present at their installed location [[drawing: as indicated on the contract documents]].
+
+### Controllers installed indoors in conditioned spaces shall be rated for continuous operation over at least the temperature range indicated in the datasheet.
+
+```datasheet
+label: Minimum Rated Ambient Temperature - Indoor Conditioned Locations
+type: range
+unit: °F
+min: -20
+max: 40
+setpoints: [-20, 0, 14, 32, 40]
+default: 32
+```
+
+```datasheet
+label: Maximum Rated Ambient Temperature - Indoor Conditioned Locations
+type: range
+unit: °F
+min: 104
+max: 158
+setpoints: [104, 122, 131, 140, 158]
+default: 122
+```
+
+```datasheet
+label: Maximum Rated Relative Humidity, Non-Condensing
+type: range
+unit: '% RH'
+min: 80
+max: 95
+setpoints: [80, 90, 95]
+default: 90
+```
+
+### Controllers installed in unconditioned locations shall be rated for the design ambient extremes at that location, and any enclosure heater or supplemental cooling required to achieve that rating shall be included in the submittal and in the contract price.
+
+### Where a controller enclosure is installed in a location where the surface temperature can fall below the dew point of the surrounding air, condensation control shall be provided.
+
+```datasheet
+label: Condensation Control for Unconditioned Enclosures
+type: radio
+options:
+ - "Thermostatically controlled enclosure heater"
+ - "Anti-condensation heater strip, continuously energized"
+ - "Conformal-coated electronics without supplemental heat"
+ - "Sealed enclosure with desiccant breather"
+ - "None"
+```
+
+### Controller failures in unconditioned spaces concentrate at the seasonal changeover between heating and cooling, when warm humid air reaches surfaces still at the previous season's temperature and condenses on circuit boards and terminal blocks. {note}
+
+## Control Power and Ride-Through {toc}
+
+### Field controllers and end devices shall be supplied from Class 2 control power transformers in accordance with NFPA 70 Article 725.
+
+### The connected load on any control power transformer shall not exceed the fraction of the transformer nameplate rating indicated in the datasheet.
+
+```datasheet
+label: Maximum Control Power Transformer Loading
+type: range
+unit: '%'
+min: 50
+max: 100
+setpoints: [50, 60, 70, 80, 90, 100]
+default: 80
+```
+
+### Power supplies serving supervisory controllers, gateways, and network switches shall be sized with reserve capacity above the connected load as indicated in the datasheet.
+
+```datasheet
+label: Minimum Power Supply Reserve Capacity
+type: range
+unit: '%'
+min: 0
+max: 50
+setpoints: [0, 10, 15, 20, 25, 30, 50]
+default: 25
+```
+
+### Devices sharing a control power transformer shall share a common circuit polarity, and the transformer secondary shall be grounded at one point only.
+
+### The server, supervisory controllers, and the network devices connecting them shall be supplied from an uninterruptible power supply sized for at least the runtime indicated in the datasheet.
+
+```datasheet
+label: Minimum Uninterruptible Power Supply Runtime
+type: range
+unit: minutes
+min: 5
+max: 240
+setpoints: [5, 10, 15, 30, 60, 120, 240]
+default: 30
+```
+
+### The branch circuits and standby power branches serving BAS panels shall be as indicated in the datasheet.
+
+```datasheet
+label: Standby Power Source for BAS Panels
+type: radio
+options:
+ - "Normal power only"
+ - "Standby generator serving panels that control life safety mechanical equipment"
+ - "Standby generator serving all BAS panels"
+ - "Uninterruptible power supply at the management and supervisory layers, normal power at field panels"
+ - "Uninterruptible power supply at the management and supervisory layers, standby generator at all panels"
+```
+
+### A short utility interruption that restarts the supervisory layer costs more operating time than it costs power, because controllers return through their startup sequences, trend buffers upload out of order, and any alarm generated during the outage is annunciated on recovery. {note}
+
+## Seismic Restraint and Certification {toc}
+
+### BAS panels, server cabinets, and floor- or wall-mounted network enclosures shall be anchored and restrained in accordance with ASCE/SEI 7 and the adopted building code for the project Seismic Design Category.
+
+### Where the BAS controls mechanical equipment designated by the Engineer of Record as a designated seismic system, the controller assembly shall carry seismic certification for the required design forces.
+
+### Anchorage details and certification documentation shall be submitted before panel installation.
+
+# System Architecture and Layering {toc}
+
+## Layer Autonomy {toc}
+
+### Every controller shall continue to execute its assigned sequence of operations when isolated from the layer above it.
+
+### Loss of the supervisory network shall not interrupt control of any item of mechanical equipment by its field controller.
+
+### Loss of the server shall not interrupt supervisory scheduling, alarm generation, or global control logic.
+
+### Any single network failure shall degrade monitoring, historical collection, and cross-system coordination only, and shall not cause a loss of local mechanical control.
+
+### Values that a controller receives from another device across the network shall have a defined failure behavior - a last-known-good value with an expiry, a programmed default, or a defined failure mode - and that behavior shall be identified in the sequence-to-program correspondence document.
+
+### A controller that holds a stale network value forever is worse than one that fails to a default, because the failure is invisible - the loop keeps controlling to a number that stopped being true. {note}
+
+## Communication Protocol Selection {toc}
+
+### The open protocol used at every interface where devices from more than one manufacturer must interoperate shall be as indicated in the datasheet.
+
+```datasheet
+label: Open Protocol at Multi-Vendor Interfaces
+type: radio
+options:
+ - "BACnet (ANSI/ASHRAE 135)"
+ - "Control Network Protocol (ANSI/CTA-709.1)"
+ - "Modbus (Modbus Application Protocol Specification)"
+ - "OPC Unified Architecture (IEC 62541)"
+default: "BACnet (ANSI/ASHRAE 135)"
+```
+
+### Every point required by the point list shall be readable and, where the sequence requires it, writable at the supervisory layer through the open protocol selected above, regardless of the protocol used inside any individual subsystem.
+
+### A manufacturer's proprietary protocol may be used below the supervisory layer within a single manufacturer's product family, provided the boundary of that subsystem presents the selected open protocol.
+
+### The operator shall not be required to use a separate application, workstation, or login to see or command any point required by the point list.
+
+### An interoperability requirement that stops at the vendor's own product line is not interoperability; the test that matters at handover is whether a second manufacturer's controller can be added to the network in year six without replacing the supervisory layer. {note}
+
+## Supervisory Network {toc}
+
+### The supervisory network datalink shall be as indicated in the datasheet.
+
+```datasheet
+label: Supervisory Network Datalink
+type: select
+options:
+ - "BACnet/IP over IEEE 802.3 Ethernet"
+ - "BACnet Secure Connect (BACnet/SC)"
+ - "BACnet over IEEE 802.3 Ethernet frames (BACnet/Ethernet)"
+ - "Control Network Protocol over IP"
+ - "Modbus TCP"
+default: "BACnet/IP over IEEE 802.3 Ethernet"
+```
+
+### BACnet Secure Connect carries BACnet over a TLS-protected WebSocket connection with mutual certificate authentication, which addresses two properties that BACnet/IP does not have on its own - the traffic is encrypted, and each device authenticates its peer. Where the supervisory network shares any infrastructure with traffic that is not part of the BAS, those two properties are what distinguish a segregated network from a merely separate address range. {note}
+
+### Where BACnet Secure Connect is selected, the certificate authority, certificate lifetime, and the renewal procedure shall be identified in the cybersecurity plan and turned over to the Owner at closeout.
+
+### The supervisory network topology shall be as indicated in the datasheet.
+
+```datasheet
+label: Supervisory Network Topology
+type: select
+options:
+ - "Star - a switch in each equipment room home-run to a central BAS switch"
+ - "Redundant ring between primary switches with star drops"
+ - "Redundant ring between primary switches, no star drops"
+ - "Single switch serving all supervisory devices"
+```
+
+### The physical media of each supervisory network segment shall be as indicated in the datasheet.
+
+```datasheet
+label: Supervisory Network Physical Media
+type: select
+options:
+ - "Category 6 balanced twisted pair"
+ - "Category 6A balanced twisted pair"
+ - "Multimode optical fiber, OM3"
+ - "Multimode optical fiber, OM4"
+ - "Singlemode optical fiber, OS2"
+ - "Mixed copper horizontal with optical fiber backbone"
+```
+
+### Copper cabling, terminations, and channel lengths shall comply with ANSI/TIA-568, and the installed channel shall be tested and certified to the performance category specified.
+
+### Cable installed in a plenum used for environmental air shall be listed for that use in accordance with NFPA 90A and NFPA 70.
+
+### Network switches serving the BAS shall be managed switches capable of virtual LAN assignment, port-level access control, and log forwarding.
+
+### Unmanaged switches shall not be installed on the supervisory network.
+
+## Field Bus Network {toc}
+
+### The field bus protocol connecting equipment controllers to the supervisory layer shall be as indicated in the datasheet.
+
+```datasheet
+label: Field Bus Protocol
+type: select
+options:
+ - "BACnet MS/TP over RS-485"
+ - "BACnet/IP at each field controller"
+ - "BACnet Secure Connect at each field controller"
+ - "Control Network Protocol over twisted pair"
+ - "Modbus RTU over RS-485"
+ - "Wireless field bus per the manufacturer's published radio specification"
+default: "BACnet MS/TP over RS-485"
+```
+
+### The field bus data rate shall be as indicated in the datasheet, and every device on a segment shall be configured to that rate.
+
+```datasheet
+label: Field Bus Data Rate
+type: range
+unit: kbps
+min: 9.6
+max: 115.2
+setpoints: [9.6, 19.2, 38.4, 76.8, 115.2]
+default: 76.8
+```
+
+### The number of devices on any one field bus segment shall not exceed the count indicated in the datasheet.
+
+```datasheet
+label: Maximum Devices Per Field Bus Segment
+type: range
+unit: devices
+min: 8
+max: 127
+setpoints: [8, 16, 24, 32, 48, 64, 96, 127]
+default: 32
+```
+
+### The measured token loop time on any segment shall not exceed the value indicated in the datasheet under full design load.
+
+```datasheet
+label: Maximum Measured Token Loop Time
+type: range
+unit: ms
+min: 50
+max: 2000
+setpoints: [50, 100, 150, 200, 500, 1000, 2000]
+default: 200
+```
+
+### A token-passing bus gives each master node the bus in turn, so response time at the operator workstation is bounded by how long the token takes to make one lap. Loop time rises with the number of masters and falls with the data rate, which is why segment loading and data rate are the two levers available when response is sluggish. {note}
+
+### Where the segment loading indicated in the datasheet is exceeded, or where the measured token loop time exceeds the specified maximum, the Contractor shall subdivide the segment at no additional cost to the Owner.
+
+### Field bus cable shall be as indicated in the datasheet.
+
+```datasheet
+label: Field Bus Cable
+type: radio
+options:
+ - "22 AWG shielded twisted pair with foil shield and drain conductor"
+ - "20 AWG shielded twisted pair with foil shield and drain conductor"
+ - "18 AWG shielded twisted pair with foil shield and drain conductor"
+ - "Composite cable with a shielded communication pair and a control power pair"
+default: "22 AWG shielded twisted pair with foil shield and drain conductor"
+```
+
+### Field bus segments shall be wired in a daisy chain from device to device.
+
+### Star, branch, and spur topologies shall not be used on an RS-485 field bus segment.
+
+### A terminating resistor matched to the cable characteristic impedance shall be installed at each of the two physical ends of every RS-485 segment, and at no other point on the segment.
+
+```datasheet
+label: Field Bus Terminating Resistance
+type: range
+unit: Ω
+min: 100
+max: 150
+setpoints: [100, 120, 150]
+default: 120
+```
+
+### The total length of any single RS-485 segment shall not exceed the length indicated in the datasheet without an intervening repeater.
+
+```datasheet
+label: Maximum Field Bus Segment Length
+type: range
+unit: ft
+min: 1000
+max: 4000
+setpoints: [1000, 2000, 3000, 4000]
+default: 4000
+```
+
+### The cable shield drain shall be continuous through every device on the segment and shall be bonded to ground at one point only.
+
+### Bonding a shield at both ends puts the two ground potentials in parallel with the drain conductor. The resulting circulating current appears as intermittent communication faults that move around the segment, which is why the symptom is usually reported as random device dropouts rather than as a grounding problem. {note}
+
+## Non-Native Equipment Integration {toc}
+
+### Equipment whose native communication interface is not the selected open protocol shall be integrated through a gateway that presents the equipment's points to the supervisory layer as objects of the selected open protocol.
+
+### The gateway implementation shall be as indicated in the datasheet.
+
+```datasheet
+label: Gateway Implementation
+type: radio
+options:
+ - "Gateway function embedded in the supervisory controller"
+ - "Standalone gateway appliance"
+ - "Gateway software hosted on the BAS server"
+ - "Gateway module furnished with the integrated equipment"
+```
+
+### A standalone gateway keeps the integration on its own hardware, so a failure or a firmware update on the gateway does not disturb the supervisory controller's own logic; an embedded gateway removes a device, a power supply, and a network drop from the installation. The number of integrated points and the criticality of the integrated equipment usually decide between them. {note}
+
+### The integration submittal shall include the register or object map, the polling interval, the timeout and retry parameters, and the behavior of each integrated object when communication with the source device is lost.
+
+### Integrated objects shall be presented with the same naming convention, engineering units, and alarm treatment as natively communicating points.
+
+### Integrated points that are stale shall be marked as unreliable at the supervisory layer rather than presented as current values.
+
+### The Contractor shall verify with the equipment manufacturer that the register or object map submitted matches the firmware revision actually shipped with the equipment.
+
+## Device Addressing and Naming {toc}
+
+### Every device shall be assigned a device identifier unique across the entire system, and the assignment shall follow the addressing plan in the reviewed submittal.
+
+### Network numbers shall be unique across the entire internetwork, and no two segments shall share a network number.
+
+### Point names shall follow a single documented convention applied consistently across every controller, integrated subsystem, graphic, trend, and alarm definition.
+
+### The naming and tagging convention shall be as indicated in the datasheet.
+
+```datasheet
+label: Point Naming and Tagging Convention
+type: select
+options:
+ - "Owner's existing point naming standard"
+ - "Semantic tagging per ANSI/ASHRAE 223"
+ - "Project Haystack tagging"
+ - "Brick schema"
+ - "Controls contractor's documented convention, submitted for Engineer review"
+```
+
+### Where a semantic tagging convention is selected, the tag set applied to each point shall be included in the point database export at closeout.
+
+### The point name shown on the graphic, the point name in the trend definition, the point name in the alarm message, and the label on the field device shall be the same string. {note}
+
+## Time Synchronization {toc}
+
+### All servers, supervisory controllers, and field controllers shall be synchronized to a common time source.
+
+### The time source shall be as indicated in the datasheet.
+
+```datasheet
+label: Time Synchronization Source
+type: radio
+options:
+ - "Network Time Protocol server provided by the Owner's information technology organization"
+ - "Dedicated Network Time Protocol appliance on the BAS network"
+ - "BAS server acting as the authoritative time source for the system"
+ - "Global navigation satellite receiver on the BAS network"
+```
+
+### Time drift between any controller and the system time source shall not exceed the value indicated in the datasheet.
+
+```datasheet
+label: Maximum Permitted Time Drift
+type: range
+unit: seconds
+min: 1
+max: 300
+setpoints: [1, 5, 10, 30, 60, 300]
+default: 30
+```
+
+### Daylight saving time transitions shall be applied automatically and consistently across every device, and the transition rule shall be configurable without a firmware change.
+
+### Trend records and alarm records from devices whose clocks disagree cannot be placed in sequence, so a fault that propagates across several controllers cannot be traced to its origin. {note}
+
+# Server and Operator Workstation {toc}
+
+## Server Platform {toc}
+
+### The BAS server shall host the operator interface, graphics, the alarm and event database, the historical trend database, schedule definitions, the user account directory, and the configuration backup repository.
+
+### The server hosting arrangement shall be as indicated in the datasheet.
+
+```datasheet
+label: Server Hosting Arrangement
+type: select
+options:
+ - "Physical server on premises, furnished under this standard"
+ - "Virtual machine on an Owner-provided hypervisor"
+ - "Manufacturer-hosted cloud service"
+ - "On-premises supervisory hardware with cloud-hosted archive and reporting"
+```
+
+### The server operating system shall be as indicated in the datasheet.
+
+```datasheet
+label: Server Operating System
+type: select
+options:
+ - "Server-class Windows operating system, currently supported release"
+ - "Linux distribution, currently supported long-term-support release"
+ - "Manufacturer-furnished appliance operating system"
+```
+
+### The server operating system shall be a release for which the vendor is currently publishing security updates, both at the time of installation and at the time of substantial completion.
+
+### An operating system release that has passed its vendor end-of-support date shall not be placed in service.
+
+### Where the operating system release installed at the start of the project reaches end of support before substantial completion, the Contractor shall migrate the system to a supported release before acceptance at no additional cost to the Owner.
+
+### The Contractor shall size the server for the point count, trend volume, and retention specified for this project, and shall submit the sizing basis.
+
+```datasheet
+label: Minimum Server Spare Resource Capacity at Substantial Completion
+type: range
+unit: '%'
+min: 0
+max: 100
+setpoints: [0, 10, 20, 25, 30, 50, 100]
+default: 25
+```
+
+## Database Backup and Restoration {toc}
+
+### The server shall automatically back up controller programs, graphics, schedules, alarm definitions, trend definitions, user accounts, and the server database to a storage location separate from the server itself.
+
+### The backup destination shall be as indicated in the datasheet.
+
+```datasheet
+label: Configuration Backup Destination
+type: checkbox
+options:
+ - "Local network attached storage on the BAS network"
+ - "Owner's enterprise backup platform"
+ - "Off-site cloud storage"
+ - "Standby server maintained by continuous replication"
+ - "Removable media held by the Owner's building engineering staff"
+default:
+ - "Local network attached storage on the BAS network"
+```
+
+### The backup interval shall not exceed the value indicated in the datasheet.
+
+```datasheet
+label: Maximum Configuration Backup Interval
+type: range
+unit: hours
+min: 1
+max: 168
+setpoints: [1, 4, 8, 12, 24, 72, 168]
+default: 24
+```
+
+### Backups shall be retained for at least the period indicated in the datasheet.
+
+```datasheet
+label: Minimum Configuration Backup Retention
+type: range
+unit: days
+min: 7
+max: 1095
+setpoints: [7, 14, 30, 60, 90, 180, 365, 1095]
+default: 30
+```
+
+### The Contractor shall restore a full configuration backup to a test platform before substantial completion, demonstrate that the restored system operates, and submit the record of that test.
+
+### A backup that has never been restored is a hypothesis. The restoration test is the only step in a backup regime that produces evidence, and it is also the step that discovers which pieces of the configuration the backup routine was never capturing. {note}
+
+## Operator Client {toc}
+
+### The operator client types provided shall be as indicated in the datasheet.
+
+```datasheet
+label: Operator Client Types Provided
+type: checkbox
+options:
+ - "Web browser client requiring no installed software"
+ - "Manufacturer-installed application client on a dedicated workstation"
+ - "Mobile or tablet client for field engineering"
+ - "Wall-mounted operator display in the operations center"
+default:
+ - "Web browser client requiring no installed software"
+```
+
+### A browser client shall operate on the current release of at least two independent browser engines without a vendor-supplied plug-in.
+
+### Where a dedicated always-on workstation is provided, it shall be furnished with the display, mounting, and uninterruptible power identified in the submittal.
+
+### The number of concurrent operator sessions supported without additional licensing shall be as indicated in the datasheet.
+
+```datasheet
+label: Minimum Concurrent Operator Sessions
+type: range
+unit: sessions
+min: 1
+max: 100
+setpoints: [1, 2, 5, 10, 25, 50, 100]
+default: 5
+```
+
+### A client that requires installed software puts the Owner's information technology organization in the path of every operator addition and every workstation replacement; a browser client moves that dependency to the browser release cycle instead. Which dependency is easier to live with depends on how the Owner manages endpoints. {note}
+
+## User Accounts and Role-Based Access {toc}
+
+### The system shall enforce role-based access control with distinct roles for viewing, for operating, for configuring, and for administering accounts.
+
+### Each named individual shall be assigned an individual account.
+
+### Shared or generic accounts shall not be configured, except for a single break-glass administrative account whose credential is held under the Owner's documented procedure.
+
+### The authentication method shall be as indicated in the datasheet.
+
+```datasheet
+label: Authentication Method
+type: radio
+options:
+ - "Accounts local to the BAS server"
+ - "Directory service integration by LDAP or Active Directory"
+ - "Federated authentication by SAML"
+ - "Federated authentication by OpenID Connect"
+```
+
+### The scope of multi-factor authentication shall be as indicated in the datasheet.
+
+```datasheet
+label: Multi-Factor Authentication Scope
+type: radio
+options:
+ - "Not required"
+ - "Required for remote access sessions"
+ - "Required for accounts holding configuration or administrative privilege"
+ - "Required for remote access sessions and for accounts holding configuration or administrative privilege"
+ - "Required for all accounts"
+default: "Required for remote access sessions and for accounts holding configuration or administrative privilege"
+```
+
+### Each account shall be granted the least privilege that permits the account holder to perform that holder's function.
+
+### Account creation, modification, and deactivation shall follow a documented procedure that records who requested the change, who made it, and when.
+
+### Where a directory service is used, account deactivation in the directory shall remove BAS access without a separate action on the BAS.
+
+### An account that outlives the person's employment is the most common way a control system is reached by someone who no longer has a reason to reach it, and a system holding only local accounts has no event that triggers its removal. {note}
+
+# Graphics and Operator Interface {toc}
+
+## Graphic Page Hierarchy {toc}
+
+### The operator interface shall be organized as a navigable hierarchy from a site or building landing page, through floor plans and system schematics, to individual equipment pages.
+
+### Every page shall be reachable both by selecting a labeled region on the page above it and through a persistent navigation menu.
+
+### The path from the landing page to any equipment page shall require no more than the number of selections indicated in the datasheet.
+
+```datasheet
+label: Maximum Navigation Depth to Any Equipment Page
+type: range
+unit: selections
+min: 2
+max: 8
+setpoints: [2, 3, 4, 5, 6, 8]
+default: 4
+```
+
+### The graphic style shall be as indicated in the datasheet.
+
+```datasheet
+label: Equipment Graphic Style
+type: select
+options:
+ - "Schematic line drawing with dynamic value overlays"
+ - "Photorealistic equipment rendering with dynamic value overlays"
+ - "Schematic terminal equipment with photorealistic central plant pages"
+default: "Schematic line drawing with dynamic value overlays"
+```
+
+### An equipment graphic exists so a trained operator can read the state of the system - flow paths, equipment status, active values, active alarms - without reading text. Rendered detail that does not change with the system carries no state and competes for attention with the values that do, which matters most on the pages an operator opens during a callout. {note}
+
+### Where photorealistic rendering is used, dynamic values shall remain legible against the rendering at the display resolutions specified for the operator clients.
+
+### Every displayed value shall carry its engineering units.
+
+### Every displayed value shall indicate when it is stale, unreliable, or out of service, and shall not present the last received value as though it were current.
+
+## Required Graphic Pages {toc}
+
+### The Contractor shall provide, at minimum, the following graphic pages:
+
+- A site or building landing page showing current outdoor conditions, a system status summary, and the count of unacknowledged alarms by priority
+- A floor plan for each floor showing major equipment and control zones, with navigation regions to zone detail
+- A page for each central plant system showing every item of equipment, valve, pump, sensor, setpoint, and current reading with engineering units
+- A page for each air handling unit, energy recovery device, exhaust fan, and other central air-side equipment item showing every monitored and controlled point
+- A page or repeating template for each terminal unit showing every monitored and controlled point
+- A page for each integrated subsystem showing the integrated points and the communication status of the subsystem
+- An outdoor conditions page showing dry-bulb temperature, relative humidity, dew point, and wet-bulb temperature with a trend window
+- A schedule page listing every defined schedule, its current state, and the equipment it commands
+- An alarm page showing active alarms, recently acknowledged alarms, and a searchable alarm history
+- A network status page showing every controller, its communication state, and the time of its last successful communication
+
+## Setpoint Adjustment and Override Behavior {toc}
+
+### Setpoint adjustments and equipment commands issued from a graphic shall be written to the controlled object at a defined command priority.
+
+### Operator commands issued from a graphic shall be written at the manual operator priority.
+
+### Scheduled and supervisory program commands shall be written at a priority lower than the operator priority.
+
+### Releasing an override shall relinquish that priority slot and return the object to the highest-priority command still active.
+
+### Every graphic shall indicate when a displayed point is under an active override and at what priority.
+
+### The system shall provide a page listing every point currently held under an override, the priority of each, the account that issued it, and the time it was issued.
+
+### The system shall generate an alarm for any override that remains active longer than the duration indicated in the datasheet.
+
+```datasheet
+label: Maximum Override Duration Before Alarm
+type: range
+unit: hours
+min: 1
+max: 720
+setpoints: [1, 4, 8, 24, 72, 168, 720]
+default: 24
+```
+
+### An override left in place after a service call is indistinguishable from a control failure at the next callout, because the loop reads as if it is ignoring its own sequence. An expiry alarm converts a silent condition into a visible one. {note}
+
+## Engineering Units and Value Resolution {toc}
+
+### The display unit system shall be as indicated in the datasheet.
+
+```datasheet
+label: Display Unit System
+type: radio
+options:
+ - "Inch-pound"
+ - "SI"
+ - "Selectable by operator account"
+default: "Inch-pound"
+```
+
+### A single graphic page shall not mix unit systems.
+
+### Displayed resolution shall not exceed the resolution the source device actually reports.
+
+### Temperature values shall be displayed to the number of decimal places indicated in the datasheet.
+
+```datasheet
+label: Displayed Decimal Places - Temperature
+type: range
+unit: decimal places
+min: 0
+max: 2
+setpoints: [0, 1, 2]
+default: 1
+```
+
+### Displaying more digits than the sensor resolves invites operators to chase changes that are quantization noise, and it makes trend graphs look unstable when the measurement is not. {note}
+
+# Occupancy Scheduling {toc}
+
+## Schedule Structure {toc}
+
+### The schedule types provided shall be as indicated in the datasheet.
+
+```datasheet
+label: Schedule Types Provided
+type: checkbox
+options:
+ - "Weekly recurring schedule with a distinct daily profile for each day"
+ - "Holiday and exception schedules that override the weekly schedule"
+ - "Calendar schedule for yearly recurring events"
+ - "Event-driven schedule triggered by a system input"
+ - "Demand response schedule triggered by a utility signal"
+ - "Temporary occupancy schedule with an automatic expiry"
+default:
+ - "Weekly recurring schedule with a distinct daily profile for each day"
+ - "Holiday and exception schedules that override the weekly schedule"
+ - "Calendar schedule for yearly recurring events"
+```
+
+### Each schedule shall produce a discrete output object that the controllers it serves consume directly.
+
+### One schedule shall be capable of serving multiple controllers and multiple equipment types.
+
+### Schedule changes made by an operator shall be recorded in the audit log with the account, the time, and the previous value.
+
+### The number of independent schedules the system supports shall be at least the value indicated in the datasheet.
+
+```datasheet
+label: Minimum Independent Schedules Supported
+type: range
+unit: schedules
+min: 10
+max: 2000
+setpoints: [10, 25, 50, 100, 250, 500, 1000, 2000]
+default: 100
+```
+
+### A schedule that is copied into each controller instead of shared has to be edited once per controller, and the copies drift; a shared schedule object is edited once and the drift has nowhere to start. {note}
+
+## Optimum Start and Optimum Stop {toc}
+
+### Where the adopted energy code requires optimum start control, the system shall provide it for the equipment the code identifies, regardless of the datasheet selections below.
+
+### The scope of optimum start control shall be as indicated in the datasheet.
+
+```datasheet
+label: Optimum Start Scope
+type: radio
+options:
+ - "Not applied"
+ - "Applied to central air handling equipment"
+ - "Applied to central air handling equipment and terminal units"
+ - "Applied to central air handling equipment, terminal units, and central plant equipment"
+```
+
+### The scope of optimum stop control shall be as indicated in the datasheet.
+
+```datasheet
+label: Optimum Stop Scope
+type: radio
+options:
+ - "Not applied"
+ - "Applied to central air handling equipment"
+ - "Applied to central air handling equipment and terminal units"
+ - "Applied to central air handling equipment, terminal units, and central plant equipment"
+```
+
+### Optimum start shall determine the latest startup time that still brings each zone to its occupied setpoint by the start of occupancy, using measured indoor and outdoor conditions and an adaptive term that adjusts from the previous day's result.
+
+### Optimum stop shall end active heating or cooling before the end of occupancy by an interval that keeps each zone within its occupied comfort band through the remainder of the occupied period.
+
+### The system shall limit the optimum start interval to the maximum indicated in the datasheet.
+
+```datasheet
+label: Maximum Optimum Start Interval
+type: range
+unit: hours
+min: 1
+max: 8
+setpoints: [1, 2, 3, 4, 6, 8]
+default: 4
+```
+
+### An unbounded adaptive start interval will chase an unrelated fault - a failed heating valve, a fouled coil - by starting earlier every day until the equipment effectively runs continuously, and the extra runtime hides the fault it is compensating for. {note}
+
+## Holiday and Calendar Maintenance {toc}
+
+### The system shall support at least the number of holiday and exception days per year indicated in the datasheet.
+
+```datasheet
+label: Minimum Holiday and Exception Days Supported Per Year
+type: range
+unit: days
+min: 10
+max: 365
+setpoints: [10, 25, 50, 100, 365]
+default: 50
+```
+
+### A holiday entered once shall propagate to every schedule that references the holiday calendar without per-schedule re-entry.
+
+### The Contractor shall load the calendar with at least the number of years of dates indicated in the datasheet before substantial completion.
+
+```datasheet
+label: Years of Calendar Dates Loaded at Substantial Completion
+type: range
+unit: years
+min: 1
+max: 10
+setpoints: [1, 2, 3, 5, 10]
+default: 2
+```
+
+### Calendar maintenance beyond the loaded period is the Owner's responsibility, and the training required by this standard shall cover the procedure.
+
+# Alarming and Event Management {toc}
+
+## Alarm Priority Structure {toc}
+
+### The system shall support at least the number of distinct alarm priority levels indicated in the datasheet.
+
+```datasheet
+label: Minimum Alarm Priority Levels
+type: range
+unit: levels
+min: 2
+max: 10
+setpoints: [2, 3, 4, 5, 6, 8, 10]
+default: 3
+```
+
+### Every defined alarm shall be assigned a priority and at least one routing destination.
+
+### The alarm strategy submittal shall state, for each priority level, the response the priority is intended to require and the time frame in which that response is expected.
+
+### Alarms at the highest defined priority shall remain visible on the landing page of the operator interface until acknowledged.
+
+### Acknowledging an alarm shall record the acknowledging account and the time in the alarm history.
+
+### The alarm history shall be retained for at least the period indicated in the datasheet, independent of trend retention.
+
+```datasheet
+label: Minimum Alarm History Retention
+type: range
+unit: days
+min: 30
+max: 3650
+setpoints: [30, 90, 180, 365, 730, 1095, 1825, 3650]
+default: 365
+```
+
+## Alarm Routing {toc}
+
+### Alarms shall be routable to the destinations indicated in the datasheet.
+
+```datasheet
+label: Alarm Routing Destinations
+type: checkbox
+options:
+ - "Operator workstation"
+ - "Local annunciator at the building engineering office"
+ - "Electronic mail to building engineering staff"
+ - "Electronic mail to the Owner's maintenance management system"
+ - "Short message or push notification to on-call staff"
+ - "Owner's information technology service management platform"
+ - "Owner's security information and event management platform"
+default:
+ - "Operator workstation"
+ - "Electronic mail to building engineering staff"
+```
+
+### Routing shall be configurable independently by alarm priority and by time of day.
+
+### Where an alarm is routed off the BAS network, the transport shall use the mechanism approved in the cybersecurity plan.
+
+### The Contractor shall demonstrate each configured routing destination during functional testing by generating a live alarm at each priority.
+
+## Alarm Suppression {toc}
+
+### The suppression mechanisms provided shall be as indicated in the datasheet.
+
+```datasheet
+label: Alarm Suppression Mechanisms Provided
+type: checkbox
+options:
+ - "Parent-child suppression of downstream alarms when upstream equipment is commanded off"
+ - "Time-delay suppression of conditions shorter than a configured duration"
+ - "Operator-initiated maintenance mode on a selected item of equipment"
+ - "Startup suppression for a configured interval after an equipment start command"
+ - "Schedule-based suppression during unoccupied periods"
+default:
+ - "Parent-child suppression of downstream alarms when upstream equipment is commanded off"
+ - "Time-delay suppression of conditions shorter than a configured duration"
+ - "Operator-initiated maintenance mode on a selected item of equipment"
+ - "Startup suppression for a configured interval after an equipment start command"
+```
+
+### Every suppression rule shall be documented in the alarm strategy submittal with its trigger, its scope, and its release condition.
+
+### Suppression applied by an operator shall have a configured expiry, after which the suppressed alarms are automatically restored.
+
+### The system shall provide a page listing every alarm currently suppressed, the rule suppressing it, and the time the suppression expires.
+
+### An alarm flood after a single upstream failure trains operators to dismiss the whole batch, which is how the one alarm in the batch that was not a consequence of the upstream failure gets dismissed with it. {note}
+
+## Minimum Alarm Set {toc}
+
+### The system shall implement, at minimum, alarms for the following conditions:
+
+- Loss of communication with any controller or integrated device, after a configured delay
+- Sensor input outside its configured range, or reporting a fault condition
+- Control loop deviation from setpoint beyond a configured band for a configured duration
+- Commanded equipment not proving status, and equipment proving status while commanded off
+- Filter differential pressure above its configured limit
+- Freeze protection device trip on any unit handling outdoor air
+- Duct smoke detection status received from the fire alarm system
+- Environmental conditions outside their limits in spaces designated as critical [[drawing: as indicated on the contract documents]]
+- Loss of a field bus segment at the supervisory layer
+- Configuration backup failure
+- Repeated failed authentication attempts beyond a configured threshold
+- Override active beyond its configured maximum duration
+
+### Alarm limits and delays shall be set to the design values before functional testing and tuned during the tuning period on the basis of observed system behavior.
+
+### Every alarm limit change made after acceptance shall be recorded in the audit log.
+
+# Trending and Historical Data {toc}
+
+## Trend Sampling {toc}
+
+### The sampling method for analog points shall be as indicated in the datasheet.
+
+```datasheet
+label: Trend Sampling Method - Analog Points
+type: select
+options:
+ - "Change of value with a configured increment"
+ - "Fixed interval polling"
+ - "Change of value with a periodic fixed-interval sample"
+```
+
+### The sampling method for binary and multi-state points shall be as indicated in the datasheet.
+
+```datasheet
+label: Trend Sampling Method - Binary and Multi-State Points
+type: select
+options:
+ - "Change of state"
+ - "Fixed interval polling"
+ - "Change of state with a periodic fixed-interval sample"
+default: "Change of state with a periodic fixed-interval sample"
+```
+
+### Where a fixed interval is used for sampling or as a periodic sample, that interval shall be as indicated in the datasheet.
+
+```datasheet
+label: Fixed Trend Sampling Interval
+type: range
+unit: minutes
+min: 1
+max: 60
+setpoints: [1, 5, 10, 15, 30, 60]
+default: 15
+```
+
+### Change-of-value sampling records a point only when it moves by more than its configured increment, which suits values that are steady for long periods and reduces stored volume; a periodic sample added to it produces a heartbeat that distinguishes a value that has not changed from a collection that has stopped. {note}
+
+### Trend data shall be buffered on the controller and uploaded to the historian, and the controller buffer shall hold at least the duration indicated in the datasheet at the specified sampling rate.
+
+```datasheet
+label: Minimum Controller Trend Buffer Duration
+type: range
+unit: hours
+min: 1
+max: 168
+setpoints: [1, 4, 8, 24, 48, 72, 168]
+default: 24
+```
+
+### Trend records uploaded from a controller buffer after a communication interruption shall be inserted into the historian at their original timestamps.
+
+## Trend Retention and Aggregation {toc}
+
+### Trend data shall be retained at its original sampling resolution for at least the period indicated in the datasheet.
+
+```datasheet
+label: Minimum Retention at Original Resolution
+type: range
+unit: days
+min: 7
+max: 1825
+setpoints: [7, 30, 90, 180, 365, 730, 1825]
+default: 90
+```
+
+### The aggregation applied to trend data after the original-resolution retention period shall be as indicated in the datasheet.
+
+```datasheet
+label: Trend Aggregation After Original-Resolution Retention
+type: select
+options:
+ - "None - data is discarded after the original-resolution retention period"
+ - "None - data is retained at original resolution indefinitely, capacity permitting"
+ - "Aggregated to 15-minute intervals"
+ - "Aggregated to hourly intervals"
+ - "Aggregated to daily intervals"
+```
+
+### Where aggregation is applied, the aggregated data shall be retained for at least the period indicated in the datasheet.
+
+```datasheet
+label: Minimum Retention of Aggregated Data
+type: range
+unit: years
+min: 1
+max: 20
+setpoints: [1, 2, 3, 5, 10, 20]
+default: 3
+```
+
+### Aggregated records shall retain the minimum, maximum, and mean of each interval rather than a single sampled value.
+
+### Recent high-resolution data answers questions about a specific fault; long-horizon aggregated data answers questions about consumption, degradation, and contract disputes. The two windows serve different questions, which is why the retention decision for each is made separately. {note}
+
+### The historian shall permit export of any trended point over any retained period in a spreadsheet-readable format without manufacturer assistance.
+
+## Minimum Trended Points {toc}
+
+### The following points shall be trended continuously from substantial completion forward:
+
+- Outdoor air dry-bulb temperature and relative humidity
+- Zone temperature and every active zone temperature setpoint for each separately controlled zone
+- Supply, return, and mixed air temperatures at each air handling unit
+- Duct static pressure and its setpoint at each variable air volume air handling unit
+- Supply and return fan speed command and status at each air handling unit
+- Outdoor, return, and relief damper position at each air handling unit
+- Chilled water and heating water supply and return temperature at each plant and at each coil served by a control valve
+- Differential pressure and its setpoint at each variable-flow hydronic system
+- Pump speed command and status at each variable-speed pump
+- Terminal unit damper position, airflow rate, and reheat output for each terminal unit
+- Chiller, boiler, and cooling tower stage or capacity command and status
+- Metered electricity, fuel, and water consumption, and the flows and temperatures required to compute energy delivered by each central plant
+
+### Points trended for commissioning shall be retained in the trend configuration after commissioning is complete unless the Engineer directs otherwise in writing.
+
+# Field Sensors {toc}
+
+## Sensor Grade and Range Selection {toc}
+
+### Sensors shall be of commercial or industrial grade with published accuracy, repeatability, stability, and range.
+
+### Sensors whose published specifications do not state accuracy over a defined operating range shall not be installed.
+
+### Each sensor shall be selected so that the range of conditions the application actually produces falls within the central portion of the sensor range indicated in the datasheet.
+
+```datasheet
+label: Sensor Operating Band Within Sensor Range
+type: range
+unit: '%'
+min: 40
+max: 100
+setpoints: [40, 50, 60, 70, 80, 100]
+default: 60
+```
+
+### A sensor whose range is far wider than the application loses resolution at the operating point and produces a noisy signal that the control loop then chases; a sensor whose range is too narrow saturates during system transients and returns no usable feedback exactly when the loop most needs it. {note}
+
+### Sensor accuracy statements shall include the transmitter, not the sensing element alone, where the two are separate devices.
+
+## Temperature Sensors {toc}
+
+### The temperature sensing element shall be as indicated in the datasheet.
+
+```datasheet
+label: Temperature Sensing Element
+type: radio
+options:
+ - "10 kΩ negative temperature coefficient thermistor"
+ - "20 kΩ negative temperature coefficient thermistor"
+ - "1000 Ω platinum resistance temperature detector"
+ - "100 Ω platinum resistance temperature detector"
+ - "1000 Ω nickel resistance temperature detector"
+default: "10 kΩ negative temperature coefficient thermistor"
+```
+
+### Resistance temperature detectors of 100 Ω nominal resistance shall be wired in a three-wire or four-wire configuration so that lead resistance is compensated.
+
+### The combined error of the sensing element, its transmitter, and the controller input shall not exceed the value indicated in the datasheet for space, supply air, return air, and hydronic temperature measurement.
+
+```datasheet
+label: Maximum Combined Temperature Measurement Error
+type: range
+unit: °F
+min: 0.18
+max: 2
+setpoints: [0.18, 0.3, 0.5, 1.0, 2.0]
+default: 0.5
+```
+
+### Space temperature sensors shall be mounted on interior partitions, away from supply air discharge, away from concealed piping and ductwork, and out of direct solar exposure.
+
+### Space temperature sensors shall be mounted at the height above finished floor indicated in the datasheet.
+
+```datasheet
+label: Space Temperature Sensor Mounting Height
+type: range
+unit: in.
+min: 15
+max: 66
+setpoints: [15, 18, 24, 44, 48, 54, 60, 66]
+default: 48
+```
+
+### A space sensor on an exterior wall reads a blend of room air and wall surface temperature, and the offset moves with outdoor conditions, so the resulting error cannot be trimmed out with a fixed calibration offset. {note}
+
+### Temperature sensors in mixed air plenums and in any duct cross-section where stratification is expected shall be averaging elements traversing the cross-section.
+
+```datasheet
+label: Averaging Element Coverage
+type: range
+unit: ft of element per ft² of duct area
+min: 0.5
+max: 3
+setpoints: [0.5, 1, 1.5, 2, 3]
+default: 1
+```
+
+### A single-point sensor in a mixed air plenum reports the temperature of whichever stratified layer it sits in. The result reads as a control tuning problem, because the loop is stable but is holding the wrong plenum to the right number. {note}
+
+### Outdoor air temperature sensors shall be installed within a ventilated radiation shield.
+
+### Outdoor air temperature sensors shall be located away from exhaust discharge, from equipment condenser discharge, and from surfaces that receive direct solar exposure.
+
+### An unshielded outdoor sensor in sun reads correctly at night and reads high by a wide margin during the day, which shifts economizer changeover and outdoor-air reset in the direction that costs the most energy. {note}
+
+## Humidity Sensors {toc}
+
+### The humidity sensing technology shall be as indicated in the datasheet.
+
+```datasheet
+label: Humidity Sensing Technology
+type: radio
+options:
+ - "Capacitive thin-film polymer"
+ - "Resistive polymer"
+ - "Chilled mirror hygrometer"
+default: "Capacitive thin-film polymer"
+```
+
+### The combined error of the humidity sensor and its transmitter shall not exceed the value indicated in the datasheet over the operating range of the application.
+
+```datasheet
+label: Maximum Combined Humidity Measurement Error
+type: range
+unit: '% RH'
+min: 1
+max: 5
+setpoints: [1, 2, 3, 5]
+default: 3
+```
+
+### Humidity sensors serving spaces where humidity is actively controlled shall be selected for the tighter of the accuracy required by the sequence of operations and the value indicated in the datasheet.
+
+### The Contractor shall state the manufacturer's published drift rate and recommended recalibration interval for each humidity sensor in the operation and maintenance manuals.
+
+```datasheet
+label: Recommended Humidity Sensor Recalibration Interval
+type: range
+unit: months
+min: 6
+max: 60
+setpoints: [6, 12, 18, 24, 36, 60]
+default: 12
+```
+
+### Polymer humidity elements drift with cumulative exposure to high humidity and to airborne contaminants, so a sensor that met its published accuracy at installation will not still meet it after several seasons without recalibration or replacement. {note}
+
+## Carbon Dioxide Sensors {toc}
+
+### Carbon dioxide sensors serving demand-controlled ventilation shall meet the sensor requirements of ANSI/ASHRAE 62.1 for that application.
+
+### The carbon dioxide measurement technology shall be as indicated in the datasheet.
+
+```datasheet
+label: Carbon Dioxide Measurement Technology
+type: radio
+options:
+ - "Single-beam non-dispersive infrared"
+ - "Dual-beam non-dispersive infrared"
+ - "Photoacoustic non-dispersive infrared"
+ - "Electrochemical"
+default: "Dual-beam non-dispersive infrared"
+```
+
+### The measurement range of each carbon dioxide sensor shall be as indicated in the datasheet.
+
+```datasheet
+label: Carbon Dioxide Sensor Measurement Range, Upper Limit
+type: range
+unit: ppm
+min: 2000
+max: 10000
+setpoints: [2000, 3000, 5000, 10000]
+default: 2000
+```
+
+### The combined error of the carbon dioxide sensor and its transmitter shall not exceed the value indicated in the datasheet, or the percentage of reading indicated in the datasheet, whichever is greater.
+
+```datasheet
+label: Maximum Carbon Dioxide Measurement Error, Absolute Term
+type: range
+unit: ppm
+min: 20
+max: 150
+setpoints: [20, 30, 50, 75, 100, 150]
+default: 50
+```
+
+```datasheet
+label: Maximum Carbon Dioxide Measurement Error, Proportional Term
+type: range
+unit: '%'
+min: 1
+max: 10
+setpoints: [1, 2, 3, 5, 10]
+default: 5
+```
+
+### Automatic background calibration shall be configured as indicated in the datasheet.
+
+```datasheet
+label: Automatic Background Calibration
+type: radio
+options:
+ - "Enabled with the manufacturer's default baseline interval"
+ - "Enabled with the baseline interval set for the occupancy pattern of the space served"
+ - "Disabled"
+```
+
+### Automatic background calibration assumes the sensor is exposed to near-outdoor carbon dioxide concentration at some point within each baseline interval, and it re-references the sensor to that minimum. In a space that is occupied continuously, the assumed minimum never occurs and the algorithm re-references to an elevated concentration, so the reading drifts downward over successive cycles. {note}
+
+### Automatic background calibration shall be disabled on sensors serving spaces that are occupied continuously, and the Contractor shall identify those sensors in the point database export.
+
+## Pressure Sensors {toc}
+
+### The measurement range of each differential pressure sensor used for duct static pressure control shall be as indicated in the datasheet.
+
+```datasheet
+label: Duct Static Pressure Sensor Range, Upper Limit
+type: range
+unit: in. w.g.
+min: 0.5
+max: 20
+setpoints: [0.5, 1, 2, 3, 5, 10, 20]
+drawing_ref: "as indicated on the mechanical drawings and equipment schedules"
+```
+
+### The measurement range of each hydronic pressure and differential pressure sensor shall be as indicated in the datasheet.
+
+```datasheet
+label: Hydronic Pressure Sensor Range, Upper Limit
+type: range
+unit: psig
+min: 15
+max: 600
+setpoints: [15, 30, 50, 100, 150, 300, 600]
+drawing_ref: "as indicated on the mechanical drawings and equipment schedules"
+```
+
+### The accuracy of each pressure sensor shall not exceed the percentage of full scale indicated in the datasheet.
+
+```datasheet
+label: Maximum Pressure Sensor Error, Percent of Full Scale
+type: range
+unit: '%'
+min: 0.1
+max: 2
+setpoints: [0.1, 0.25, 0.5, 1.0, 2.0]
+default: 0.5
+```
+
+### Duct static pressure sensing taps shall be located at the position established by the sequence of operations and the reset strategy [[drawing: as indicated on the mechanical drawings]].
+
+### Hydronic pressure sensors shall be installed with an isolation valve and a means of removing the sensor without draining the system.
+
+### Sensor tubing runs shall be as short as practical, shall be pitched to drain, and shall be supported so that they cannot be crushed or disconnected during maintenance access.
+
+## Airflow Measurement Stations {toc}
+
+### Where the sequence of operations requires measured outdoor airflow, an airflow measurement station shall be provided.
+
+### The airflow measurement technology shall be as indicated in the datasheet.
+
+```datasheet
+label: Airflow Measurement Technology
+type: select
+options:
+ - "Multi-point thermal dispersion array"
+ - "Multi-point pitot array with differential pressure transmitter"
+ - "Averaging annular pitot element with differential pressure transmitter"
+ - "Vortex shedding element"
+ - "Fan inlet cone differential pressure measurement"
+ - "Airflow inferred from fan speed and pressure using the manufacturer's published fan performance data"
+```
+
+### The accuracy of each airflow measurement station shall not exceed the percentage of reading indicated in the datasheet across the range the application produces.
+
+```datasheet
+label: Maximum Airflow Measurement Error, Percent of Reading
+type: range
+unit: '%'
+min: 1
+max: 15
+setpoints: [1, 2, 3, 5, 10, 15]
+default: 5
+```
+
+### Each airflow measurement station shall be installed with the upstream and downstream straight duct lengths published by its manufacturer for the mounting condition present.
+
+### Where the published straight-duct lengths cannot be achieved, the Contractor shall notify the Engineer before installation and shall propose either a flow conditioner or an alternative measurement location.
+
+### Airflow measurement stations shall be accessible for cleaning without removing ductwork.
+
+# Control Actuators {toc}
+
+## Damper Actuators {toc}
+
+### The control signal used by modulating damper actuators shall be as indicated in the datasheet.
+
+```datasheet
+label: Modulating Damper Actuator Control Signal
+type: select
+options:
+ - "0-10 VDC analog"
+ - "2-10 VDC analog"
+ - "4-20 mA analog"
+ - "Floating three-wire"
+ - "Pulse-width modulated"
+ - "Networked digital command on the field bus"
+ - "Pneumatic"
+default: "0-10 VDC analog"
+```
+
+### Two-position damper actuators shall be furnished for isolation and shutoff dampers whose sequence requires only open and closed positions.
+
+### The fail-safe mechanism for outdoor air, relief, and freeze-exposed dampers shall be as indicated in the datasheet.
+
+```datasheet
+label: Fail-Safe Mechanism - Outdoor Air, Relief, and Freeze-Exposed Dampers
+type: radio
+options:
+ - "Mechanical spring return"
+ - "Stored-energy electronic fail-safe"
+ - "None - actuator holds last position on loss of power"
+default: "Mechanical spring return"
+```
+
+### The fail-safe mechanism for interior isolation and zone dampers shall be as indicated in the datasheet.
+
+```datasheet
+label: Fail-Safe Mechanism - Interior Isolation and Zone Dampers
+type: radio
+options:
+ - "Mechanical spring return"
+ - "Stored-energy electronic fail-safe"
+ - "None - actuator holds last position on loss of power"
+default: "None - actuator holds last position on loss of power"
+```
+
+### Outdoor air dampers on units serving spaces subject to freezing conditions shall drive to the closed position on loss of control power or control signal.
+
+### Relief and exhaust dampers whose closure would pressurize an occupied space or a stairwell beyond its design limit shall drive to the position that relieves that pressure on loss of control power.
+
+### Dampers whose position is part of a smoke control sequence shall assume the position required by that sequence on loss of control power.
+
+### Damper actuators shall be sized for the damper's close-off torque at the maximum differential pressure the system can develop across the damper, with the margin indicated in the datasheet, and shall not be sized on running torque.
+
+```datasheet
+label: Minimum Damper Actuator Torque Margin Above Close-Off Torque
+type: range
+unit: '%'
+min: 0
+max: 100
+setpoints: [0, 10, 20, 25, 33, 50, 100]
+default: 25
+```
+
+### An actuator sized on running torque strokes correctly during commissioning and then fails to seat the last few degrees once the fan is at design static, which shows up as outdoor air leakage and coil freezing rather than as an actuator fault. {note}
+
+## Hydronic Valve Actuators {toc}
+
+### The control signal used by modulating valve actuators shall be as indicated in the datasheet.
+
+```datasheet
+label: Modulating Valve Actuator Control Signal
+type: select
+options:
+ - "0-10 VDC analog"
+ - "2-10 VDC analog"
+ - "4-20 mA analog"
+ - "Floating three-wire"
+ - "Pulse-width modulated"
+ - "Networked digital command on the field bus"
+ - "Pneumatic"
+default: "0-10 VDC analog"
+```
+
+### The fail-safe mechanism for heating coil control valves shall be as indicated in the datasheet.
+
+```datasheet
+label: Fail-Safe Mechanism - Heating Coil Control Valves
+type: radio
+options:
+ - "Mechanical spring return"
+ - "Stored-energy electronic fail-safe"
+ - "None - actuator holds last position on loss of power"
+default: "Mechanical spring return"
+```
+
+### The fail-safe mechanism for cooling coil control valves shall be as indicated in the datasheet.
+
+```datasheet
+label: Fail-Safe Mechanism - Cooling Coil Control Valves
+type: radio
+options:
+ - "Mechanical spring return"
+ - "Stored-energy electronic fail-safe"
+ - "None - actuator holds last position on loss of power"
+```
+
+### Heating coil control valves on coils exposed to outdoor air below freezing shall drive to the open position on loss of control power or control signal.
+
+### Cooling coil control valves shall drive to the closed position on loss of control power unless the sequence of operations for that unit requires otherwise.
+
+### Valve actuators shall be sized to close the valve against the maximum differential pressure the pumping system can develop at the valve with all other valves closed.
+
+### Actuator close-off rating shall be verified against the pump shutoff head, not against the design differential pressure, because the differential pressure at a single valve rises as the rest of the system closes. {note}
+
+## Variable Frequency Drive Integration {toc}
+
+### Variable frequency drives serving equipment controlled by the BAS shall be integrated over the network interface required by [[sync/hvac-variable-frequency-drives]].
+
+### The following points shall be available at the BAS for each integrated drive:
+
+- Start and stop command
+- Speed reference
+- Run status
+- Fault status with the manufacturer's fault code
+- Output frequency
+- Motor current
+- Motor power
+- Accumulated energy
+- Accumulated run hours
+- Bypass status where a bypass is furnished
+- Communication loss status
+
+### The BAS speed reference shall be written at a command priority that the drive's hand-off-auto selector and any hardwired safety interlock override.
+
+### Loss of BAS communication shall place each drive in the failure mode required by that equipment's sequence of operations, and that mode shall be configured in the drive and verified during functional testing.
+
+# Equipment Integration Points {toc}
+
+## Air Handling Unit Integration {toc}
+
+### The BAS shall execute the published sequence of operations for each air handling unit in accordance with [[sync/air-handling-units]] and the contract drawings.
+
+### The following points shall be available at the BAS for each air handling unit, except where the unit does not include the associated component:
+
+- Supply, return, mixed, and outdoor air temperature
+- Supply and return air humidity where humidity is controlled or monitored
+- Supply duct static pressure and its setpoint
+- Supply fan and return fan start command, speed command, speed feedback, and proven status
+- Heating and cooling coil control valve command and position feedback
+- Outdoor, return, and relief damper command and position feedback
+- Measured outdoor airflow where demand-controlled ventilation or ventilation verification is required
+- Freeze protection device status
+- Filter differential pressure and filter status
+- Smoke detection status received from the fire alarm system
+- Unit occupancy mode and the schedule commanding it
+- Every additional point named in that unit's published sequence of operations
+
+### The BAS shall present a per-unit summary showing the current operating mode, the active setpoints, and the controlling loop output.
+
+## Terminal Unit Integration {toc}
+
+### The BAS shall provide a field controller at each terminal unit furnished under [[sync/air-terminal-units]].
+
+### The following points shall be available at the BAS for each terminal unit, except where the unit does not include the associated component:
+
+- Zone temperature
+- Occupied cooling, occupied heating, and unoccupied zone temperature setpoints
+- Primary air damper command and position feedback
+- Measured primary airflow and the active airflow setpoint
+- Reheat output command and status
+- Fan command and status on units with a terminal fan
+- Zone occupancy status from an occupancy sensor where one is provided
+- Zone carbon dioxide concentration where demand-controlled ventilation is applied to the zone
+- Every additional point named in the published terminal unit sequence of operations
+
+### Terminal unit controllers shall accept a zone setpoint adjustment range configured at the supervisory layer and shall enforce it locally.
+
+```datasheet
+label: Maximum Occupant Zone Setpoint Adjustment Range
+type: range
+unit: °F
+min: 0
+max: 10
+setpoints: [0, 1, 2, 3, 4, 5, 10]
+default: 2
+```
+
+## Central Plant Integration {toc}
+
+### Chillers, boilers, cooling towers, pumps, heat exchangers, and other central plant equipment shall be integrated over the network interface each item provides.
+
+### Where an item of central plant equipment offers the selected open protocol natively, that native interface shall be used rather than a gateway.
+
+### The following points shall be available at the BAS for each item of central plant equipment, except where the equipment does not include the associated component:
+
+- Start and stop command and proven status
+- Capacity, stage, or speed command and feedback
+- Fault status with the manufacturer's fault code
+- Entering and leaving fluid temperature and pressure
+- Flow rate where a flow meter is provided
+- Energy or fuel consumption
+- Accumulated run hours and start count
+- Safety and limit device status
+- Every additional point named in that equipment's published sequence of operations
+
+### The BAS shall compute and trend the energy delivered by each central plant from the measured flow and temperature difference.
+
+### Plant equipment run hours and start counts shall be maintained across controller restarts and shall not be reset by a firmware update.
+
+## Water Treatment Controller Integration {toc}
+
+### The BAS shall integrate with the chemical treatment controllers furnished under [[sync/hvac-water-treatment]].
+
+### The following points shall be available at the BAS for each treatment controller:
+
+- Measured conductivity and its setpoint
+- Blowdown valve status
+- Makeup water flow and accumulated volume
+- Blowdown flow and accumulated volume
+- Chemical feed status and low-level alarm for each chemical
+- Biocide cycle status
+- Treatment controller fault status
+
+### Cooling tower treatment records maintained by the BAS support the operational documentation required by a water management program under ANSI/ASHRAE 188, which asks for evidence that control limits were held rather than that a controller was installed. {note}
+
+## Balancing Agent Access {toc}
+
+### During the work of [[sync/testing-adjusting-and-balancing]], the BAS shall provide the balancing agent with an account holding override authority over damper position, valve position, fan speed, and pump speed for the equipment being balanced.
+
+### The balancing agent's account shall be restricted from configuration changes, program editing, and account administration.
+
+### Every override issued under the balancing agent's account shall be recorded in the audit log.
+
+### At the completion of balancing, all overrides shall be released, the as-balanced values shall be recorded as the system baseline, and the balancing agent's account shall be deactivated.
+
+## Fire Alarm Interface {toc}
+
+### The interface between the fire alarm system and the BAS shall be by hardwired contacts at the fire alarm control unit in accordance with NFPA 72.
+
+### The fire alarm system shall command the fire and smoke control sequence directly.
+
+### The BAS shall receive the resulting status and shall mirror it at the operator interface, and shall not be relied on to execute the life safety sequence.
+
+### The BAS shall not be capable of overriding a fire alarm command to any item of mechanical equipment.
+
+### Interface wiring between the fire alarm control unit and BAS panels shall be monitored for integrity where NFPA 72 requires monitoring of that circuit.
+
+### Following restoration of a fire alarm condition, equipment shall return to its normal sequence only after the fire alarm system releases the condition and an operator resets the affected equipment where the sequence of operations requires a manual reset.
+
+### The interface described here is the boundary of this standard; the fire alarm system itself, including the smoke control sequence it commands, is governed by [[sync/fire-alarm-systems]]. {note}
+
+# Operational Technology Cybersecurity {toc}
+
+## Baseline and Precedence {toc}
+
+### The BAS is operational technology whose availability and integrity affect occupant conditions, mechanical equipment, and energy use, and whose controllers run embedded software that is patched on a slower cycle than enterprise software. {note}
+
+### The cybersecurity provisions of this standard establish a minimum baseline consistent with the practices of NIST SP 800-82.
+
+### Where the Owner's information technology or security organization publishes requirements that exceed this standard, those requirements shall govern.
+
+### Where a requirement of the Owner's security organization conflicts with a requirement necessary for the mechanical system to operate safely, the Contractor shall notify the Engineer of Record in writing before implementing either, and the Engineer of Record shall make the initial determination.
+
+### The Contractor shall not implement a security control that disables a safety interlock, a freeze protection function, or a smoke control response.
+
+## Network Segregation {toc}
+
+### The segregation of the BAS network from other networks shall be as indicated in the datasheet.
+
+```datasheet
+label: BAS Network Segregation Method
+type: select
+options:
+ - "Physically separate cabling and switching dedicated to the BAS"
+ - "Virtual LAN on shared switching with documented access control lists"
+ - "Software-defined micro-segmentation on shared switching"
+ - "Shared with the general data network without segregation"
+default: "Virtual LAN on shared switching with documented access control lists"
+```
+
+### Unless the datasheet selects an unsegregated arrangement, the BAS shall not share a broadcast domain with the general data network, with guest networks, or with video surveillance networks.
+
+### Where the datasheet selects an unsegregated arrangement, the Contractor shall record that condition in the cybersecurity plan together with the compensating controls applied, and the Owner's security organization shall accept it in writing before energization.
+
+### Traffic between the BAS network and any other network shall pass a firewall configured to permit only the protocols, ports, and source addresses required for identified BAS functions.
+
+### Every firewall rule permitting traffic to or from the BAS network shall be documented with the function it serves and the date it was created.
+
+### Firewall rules shall be reviewed at the interval indicated in the datasheet, and the review shall be recorded.
+
+```datasheet
+label: Firewall Rule Review Interval
+type: range
+unit: months
+min: 3
+max: 36
+setpoints: [3, 6, 12, 24, 36]
+default: 12
+```
+
+### The most common path into a control network is not an attack on the control protocol; it is a route that was opened for a legitimate reason, documented nowhere, and never closed after the reason expired. {note}
+
+## Remote Access {toc}
+
+### Remote access to the BAS shall be by the method indicated in the datasheet.
+
+```datasheet
+label: Remote Access Method
+type: select
+options:
+ - "No remote access - site-local operation only"
+ - "Owner-managed virtual private network"
+ - "Owner-managed jump host in a demilitarized zone with session recording"
+ - "Manufacturer-hosted cloud connector"
+ - "Owner-managed virtual private network with a jump host for privileged sessions"
+default: "Owner-managed virtual private network"
+```
+
+### BAS servers, supervisory controllers, and operator client interfaces shall not be reachable directly from the public internet.
+
+### A manufacturer-hosted cloud connector shall not be installed unless the datasheet selects it and the Owner has accepted it in writing.
+
+### Where a cloud connector is installed, it shall authenticate on every session, shall log every session with the identity of the remote party, and shall be capable of being disabled by the Owner without a manufacturer service call.
+
+### Remote sessions by the Contractor or the manufacturer during the warranty period shall be logged and shall be available to the Owner on request.
+
+## Credential and Account Management {toc}
+
+### Every default and vendor-supplied credential shall be changed before the device is placed in service, on every device that has an authentication interface, including servers, supervisory controllers, programmable controllers, gateways, network switches, and uninterruptible power supplies with network management cards.
+
+### The Contractor shall submit at substantial completion a signed statement identifying every device whose default credentials were changed.
+
+### The Owner's representative may select a sample of devices for verification, and the Contractor shall demonstrate on request that the default credential no longer authenticates.
+
+### Where verification finds a device still holding a default credential, the Contractor shall remediate every device of that type at the Contractor's cost and shall repeat the verification.
+
+### The password policy shall be as indicated in the datasheet.
+
+```datasheet
+label: Password Policy Source
+type: select
+options:
+ - "Owner's directory service password policy"
+ - "Minimum length and complexity policy configured on the BAS server"
+ - "Passphrase policy with no scheduled expiry, paired with multi-factor authentication"
+ - "Owner's privileged access management platform"
+```
+
+### Credentials shall not be embedded in graphics, scripts, integration configuration files, or documentation turned over to the Owner.
+
+### Service accounts used for integration shall be distinct from named user accounts and shall hold only the privileges the integration requires.
+
+## Patching and Firmware Maintenance {toc}
+
+### The interval between server operating system security patch cycles shall not exceed the value indicated in the datasheet.
+
+```datasheet
+label: Maximum Server Security Patch Interval
+type: range
+unit: days
+min: 7
+max: 365
+setpoints: [7, 14, 30, 60, 90, 180, 365]
+default: 30
+```
+
+### The controller firmware update policy shall be as indicated in the datasheet.
+
+```datasheet
+label: Controller Firmware Update Policy
+type: select
+options:
+ - "Updated on issuance of a manufacturer security bulletin affecting installed firmware"
+ - "Updated on a scheduled review interval and on issuance of a security bulletin"
+ - "Updated on a scheduled review interval only"
+ - "Updated only when a vulnerability affecting installed equipment is identified by the Owner"
+default: "Updated on issuance of a manufacturer security bulletin affecting installed firmware"
+```
+
+### Where a scheduled firmware review is selected, the review interval shall be as indicated in the datasheet.
+
+```datasheet
+label: Scheduled Firmware Review Interval
+type: range
+unit: months
+min: 3
+max: 36
+setpoints: [3, 6, 12, 24, 36]
+default: 12
+```
+
+### The Contractor shall register the Owner to receive the manufacturer's security bulletins for every installed product line and shall confirm the registration at closeout.
+
+### Firmware shall be verified on a controller that is not serving occupied equipment, or on the manufacturer's test arrangement, before it is deployed to the installed base.
+
+### A configuration backup shall be taken and verified before any firmware update is applied.
+
+### Firmware updates during the warranty period shall be performed by the Contractor at no additional cost where the update addresses a manufacturer security bulletin or a defect.
+
+### Server operating system patching shall be scheduled with the Owner's information technology organization, and the Contractor shall perform it during the warranty period.
+
+## Audit Logging {toc}
+
+### The system shall log the events indicated in the datasheet.
+
+```datasheet
+label: Audit Log Events
+type: checkbox
+options:
+ - "Successful authentication"
+ - "Failed authentication"
+ - "Account creation, modification, and deletion"
+ - "Privilege or role change"
+ - "Configuration change to programs, schedules, or alarm definitions"
+ - "Setpoint change and override write"
+ - "Backup and restore operations"
+ - "Firmware and software update"
+ - "Remote access session start and end"
+default:
+ - "Successful authentication"
+ - "Failed authentication"
+ - "Account creation, modification, and deletion"
+ - "Privilege or role change"
+ - "Configuration change to programs, schedules, or alarm definitions"
+ - "Setpoint change and override write"
+ - "Firmware and software update"
+ - "Remote access session start and end"
+```
+
+### Each logged event shall record the timestamp, the account, the source address where applicable, the object affected, and the previous and new values where the event changed a value.
+
+### Audit logs shall be retained for at least the period indicated in the datasheet.
+
+```datasheet
+label: Minimum Audit Log Retention
+type: range
+unit: days
+min: 30
+max: 2555
+setpoints: [30, 90, 180, 365, 730, 1095, 2555]
+default: 90
+```
+
+### Audit logs shall not be editable or deletable from the operator interface by any role.
+
+### Audit log forwarding shall be as indicated in the datasheet.
+
+```datasheet
+label: Audit Log Forwarding
+type: radio
+options:
+ - "Not forwarded - retained on the BAS server only"
+ - "Forwarded to the Owner's security information and event management platform by syslog"
+ - "Forwarded to the Owner's security information and event management platform by a manufacturer-supplied connector"
+ - "Exported on a scheduled basis to Owner-designated storage"
+```
+
+## Removable Media {toc}
+
+### The removable media policy shall be as indicated in the datasheet.
+
+```datasheet
+label: Removable Media Policy
+type: radio
+options:
+ - "Prohibited on BAS servers, workstations, and programming devices"
+ - "Permitted only on Owner-issued media with documented authorization for each use"
+ - "Permitted on any media after scanning by an Owner-approved tool"
+ - "Unrestricted"
+default: "Permitted only on Owner-issued media with documented authorization for each use"
+```
+
+### Software, firmware images, and configuration files shall be transferred by the file transfer mechanism identified in the cybersecurity plan wherever that mechanism is available.
+
+### Each use of removable media on a BAS device shall be recorded with the date, the device, the account, and the purpose.
+
+### Programming laptops connected to the BAS network shall carry current endpoint protection and shall have been used on no network for which the Owner's security organization has not granted approval.
+
+# System Capacity and Expansion {toc}
+
+## The total point count drives controller hardware quantity, field bus segment count, server sizing, and, on platforms licensed by point, the license cost. It is developed from the equipment schedules and the sequences of operation, and it changes during shop drawing development as integrated equipment point lists arrive. {note}
+
+## The Contractor shall develop the project point count from the equipment schedules and the sequences of operation and shall submit it with the point list.
+
+```datasheet
+label: Total Active Points
+type: range
+unit: points
+min: 100
+max: 100000
+setpoints: [100, 250, 500, 1000, 2500, 5000, 10000, 25000, 50000, 100000]
+drawing_ref: "as indicated on the equipment schedules and sequences of operation"
+```
+
+```datasheet
+label: Hardware Input and Output Points
+type: range
+unit: points
+min: 50
+max: 50000
+setpoints: [50, 100, 250, 500, 1000, 2500, 5000, 10000, 25000, 50000]
+drawing_ref: "as indicated on the equipment schedules and sequences of operation"
+```
+
+```datasheet
+label: Network Integrated Points
+type: range
+unit: points
+min: 50
+max: 50000
+setpoints: [50, 100, 250, 500, 1000, 2500, 5000, 10000, 25000, 50000]
+drawing_ref: "as indicated on the equipment schedules and sequences of operation"
+```
+
+## The system shall be delivered with spare hardware input and output capacity of at least the percentage indicated in the datasheet, distributed across the installed controllers rather than concentrated in one panel.
+
+```datasheet
+label: Minimum Spare Hardware Input and Output Capacity
+type: range
+unit: '%'
+min: 0
+max: 50
+setpoints: [0, 10, 15, 20, 25, 30, 50]
+default: 20
+```
+
+## The system shall be delivered with spare licensed point capacity of at least the percentage indicated in the datasheet above the commissioned point count.
+
+```datasheet
+label: Minimum Spare Licensed Point Capacity
+type: range
+unit: '%'
+min: 0
+max: 100
+setpoints: [0, 10, 20, 25, 30, 50, 100]
+default: 20
+```
+
+## Each field bus segment shall be delivered with spare device capacity of at least the percentage indicated in the datasheet below the specified maximum devices per segment.
+
+```datasheet
+label: Minimum Spare Field Bus Device Capacity Per Segment
+type: range
+unit: '%'
+min: 0
+max: 50
+setpoints: [0, 10, 20, 25, 30, 50]
+default: 20
+```
+
+## Spare capacity is consumed by the tenant fit-outs and equipment replacements that follow occupancy. A system delivered at its licensed limit turns the first small addition into a licensing negotiation, which is a cost the Owner incurs to save a smaller cost at procurement. {note}
+
+# Panel and Field Installation {toc}
+
+## Controller Panel Installation {toc}
+
+### Controller panel enclosures shall carry the environmental rating indicated in the datasheet.
+
+```datasheet
+label: Controller Panel Enclosure Rating
+type: select
+options:
+ - "NEMA Type 1"
+ - "NEMA Type 12"
+ - "NEMA Type 3R"
+ - "NEMA Type 4"
+ - "NEMA Type 4X"
+```
+
+### Panels installed outdoors shall be rated NEMA Type 3R at minimum.
+
+### Panels installed in locations subject to washdown, hose-directed water, or persistent condensation shall be rated NEMA Type 4 or Type 4X.
+
+### Panels installed in locations subject to salt air, chemical exposure, or cooling tower drift shall be rated NEMA Type 4X.
+
+### Panels shall not be installed in classified hazardous locations unless listed for the classification present.
+
+### Panels shall be mounted near the equipment they serve, in locations accessible without removing other equipment and without a ladder placed on a roof edge or over equipment.
+
+### Clear working space in front of each panel shall be at least the dimension indicated in the datasheet, and the panel door shall open at least 90 degrees within that space.
+
+```datasheet
+label: Minimum Clear Working Space in Front of Controller Panels
+type: range
+unit: in.
+min: 30
+max: 48
+setpoints: [30, 36, 42, 48]
+default: 36
+```
+
+### Panels mounted on equipment or structures subject to vibration shall be isolated from that vibration.
+
+### Line-voltage and Class 2 wiring within a panel shall be separated by a barrier or routed in separate wireways.
+
+## Control Wiring Practices {toc}
+
+### Control and network wiring shall be installed in accordance with [[sync/conductors-and-cables]], [[sync/raceways-and-conduit]], and NFPA 70 Article 725.
+
+### Class 2 control wiring shall not occupy the same raceway, cable tray compartment, or enclosure wireway as line-voltage conductors.
+
+### Where Class 2 control wiring runs parallel to line-voltage power wiring, the separation shall be at least the distance indicated in the datasheet.
+
+```datasheet
+label: Minimum Separation Between Class 2 Control Wiring and Power Wiring
+type: range
+unit: in.
+min: 2
+max: 24
+setpoints: [2, 6, 12, 18, 24]
+default: 12
+```
+
+### Where a crossing between control wiring and power wiring cannot be avoided, the two shall cross at approximately right angles.
+
+### Network and control cable shall be routed away from variable frequency drive output conductors for their full length.
+
+### Drive output conductors carry fast-switching pulse-width-modulated voltage, and the resulting capacitive coupling into a nearby shielded pair appears as communication errors and analog signal noise that come and go with drive speed. {note}
+
+### Cable shall not be spliced between the device and its termination.
+
+### Cable shall be supported independently of piping, ductwork, and equipment, and shall not be laid on ceiling grid or suspended from other trades' hangers.
+
+### Conductors shall be terminated on labeled terminal blocks, and more than the number of conductors indicated in the datasheet shall not be landed on one terminal point.
+
+```datasheet
+label: Maximum Conductors Per Terminal Point
+type: range
+unit: conductors
+min: 1
+max: 3
+setpoints: [1, 2, 3]
+default: 2
+```
+
+### Slack shall be left at each termination sufficient to re-terminate the conductor at least twice.
+
+## Sensor and Actuator Installation {toc}
+
+### Sensors shall be installed in accordance with the manufacturer's published instructions and the location requirements of this standard.
+
+### Each measured sensor shall be compared against a reference instrument at startup, and both the as-found and as-left readings shall be recorded.
+
+### A sensor whose as-found reading differs from the reference by more than the specified measurement error shall be replaced rather than corrected by a software offset.
+
+### A software offset that compensates a sensor error is indistinguishable at the operator interface from a correct sensor, so the drift it hides is discovered only when the offset is large enough to affect control. It also becomes wrong at every condition other than the one at which it was set. {note}
+
+### Actuators shall be coupled to the damper or valve shaft in accordance with the manufacturer's instructions, with the shaft aligned and the coupling tightened to the published torque.
+
+### Each actuator shall be stroked from the BAS through its full travel in both directions and the resulting device position verified visually.
+
+### Damper actuator end positions shall be set so that the damper blades seat fully at the closed position and reach their design open position without over-travel.
+
+### Valve actuator end positions shall be set so that the valve closes without leakage at the design differential pressure and opens to its full rated travel.
+
+### Stroke verification results shall be recorded on the point-to-point verification record.
+
+## Identification and Labeling {toc}
+
+### The labeling method shall be as indicated in the datasheet.
+
+```datasheet
+label: Labeling Method
+type: select
+options:
+ - "Engraved phenolic laminate, mechanically fastened"
+ - "Engraved phenolic laminate, adhesive applied"
+ - "Thermal-transfer printed vinyl label rated for the service environment"
+ - "Stainless steel tag on stainless wire"
+ - "Brass tag on stainless wire"
+default: "Engraved phenolic laminate, mechanically fastened"
+```
+
+### Labels shall be machine-produced.
+
+### Each controller panel shall carry a permanent nameplate identifying the panel designation, the equipment or zone it serves, the supervisory controller it reports to, the device identifier, and a service contact.
+
+### Each field-mounted sensor and actuator shall be labeled with the point name as it appears in the BAS database.
+
+### Each cable shall be labeled at every termination with its type, its source, and its destination.
+
+### Each conductor pair serving a field point shall be labeled at the controller termination with that point's name as it appears in the BAS database.
+
+### The single most common troubleshooting step at a controller panel is finding which pair belongs to the point that is misbehaving. A point name at the termination replaces a continuity trace with a glance. {note}
+
+### A current panel wiring diagram and point schedule shall be mounted inside each panel door in a protective pocket.
+
+### The panel point schedule shall be revised whenever a point is added, removed, or re-terminated.
+
+### A laminated system overview drawing showing the network topology, the location of each controller panel, and service contact information shall be mounted in the main mechanical room or the operator workstation room.
+
+### The system overview drawing shall be revised at every system change during the warranty period.
+
+# Testing and Commissioning {toc}
+
+## Factory Acceptance Testing {toc}
+
+### Factory acceptance testing shall be performed as indicated in the datasheet.
+
+```datasheet
+label: Factory Acceptance Testing
+type: radio
+options:
+ - "Not required"
+ - "Required for pre-assembled plant control panels, documented by the Contractor"
+ - "Required for pre-assembled plant control panels, witnessed by the Owner or the Commissioning Authority"
+ - "Required for all pre-assembled panels, witnessed by the Owner or the Commissioning Authority"
+```
+
+### Factory acceptance testing shall verify panel assembly against the reviewed submittal, power-up of every device, communication between every device and the supervisory controller, rendering of the graphic pages associated with the tested panels, and execution of the loaded programs against simulated inputs.
+
+### Deficiencies found at factory acceptance testing shall be corrected before shipment.
+
+### Factory acceptance testing does not satisfy any part of the field functional testing requirement.
+
+## Field Functional Testing {toc}
+
+### The field functional testing scope shall include the activities indicated in the datasheet.
+
+```datasheet
+label: Field Functional Testing Scope
+type: checkbox
+options:
+ - "Point-to-point verification of every hardware input and output"
+ - "Sensor calibration verification against a reference instrument"
+ - "Actuator stroke verification through full travel in both directions"
+ - "Network verification including conformance, segment loading, and routing"
+ - "Sequence verification of every step of every published sequence"
+ - "Alarm verification of every defined alarm and every routing destination"
+ - "Schedule verification including holiday and exception behavior"
+ - "Trend verification confirming collection, buffering, and historian retrieval"
+ - "Failure mode verification by inducing loss of communication at each layer"
+ - "Cybersecurity verification of credentials, segregation, and audit logging"
+ - "Integrated systems test with the fire alarm system"
+default:
+ - "Point-to-point verification of every hardware input and output"
+ - "Sensor calibration verification against a reference instrument"
+ - "Actuator stroke verification through full travel in both directions"
+ - "Network verification including conformance, segment loading, and routing"
+ - "Sequence verification of every step of every published sequence"
+ - "Alarm verification of every defined alarm and every routing destination"
+ - "Schedule verification including holiday and exception behavior"
+ - "Trend verification confirming collection, buffering, and historian retrieval"
+ - "Failure mode verification by inducing loss of communication at each layer"
+ - "Cybersecurity verification of credentials, segregation, and audit logging"
+```
+
+### Field functional testing shall be performed by the controls contractor and witnessed by the Commissioning Authority where one is engaged.
+
+### Each test shall produce a dated record identifying the item tested, the acceptance criterion, the observed result, and a disposition of pass, fail, or deficiency with a corrective action.
+
+### Failure mode verification shall demonstrate that each controller continues to execute its sequence with the layer above it disconnected, and shall demonstrate the recovery behavior when communication is restored.
+
+### Where a test fails, the Contractor shall correct the deficiency and repeat the test.
+
+### The cost of the Commissioning Authority's or the Engineer's attendance at a repeat test made necessary by a failure attributable to the Contractor's work shall be borne by the Contractor.
+
+## Network Performance Verification {toc}
+
+### The Contractor shall measure and record the token loop time on every field bus segment under full design load with all equipment operating.
+
+### The Contractor shall record the count of devices and the configured data rate on each segment.
+
+### The Contractor shall verify that every device identifier and every network number is unique across the system and matches the reviewed addressing plan.
+
+### The Contractor shall demonstrate routing between every pair of network segments that the sequences of operation require to exchange data.
+
+### Where a measured value does not meet the criteria of this standard, the Contractor shall correct the condition and repeat the measurement before requesting acceptance.
+
+## Sensor Calibration {toc}
+
+### Every measured sensor shall be calibrated at startup against a reference instrument whose accuracy is traceable as indicated in the datasheet.
+
+```datasheet
+label: Calibration Reference Traceability
+type: radio
+options:
+ - "Certificate traceable to a national metrology institute, issued within the interval indicated below"
+ - "Manufacturer factory calibration certificate issued within the interval indicated below"
+ - "Comparison against an on-site reference instrument holding a current traceable certificate"
+default: "Certificate traceable to a national metrology institute, issued within the interval indicated below"
+```
+
+```datasheet
+label: Maximum Age of Reference Instrument Calibration Certificate
+type: range
+unit: months
+min: 3
+max: 24
+setpoints: [3, 6, 12, 18, 24]
+default: 12
+```
+
+### The reference instrument shall be at least three times more accurate than the specified measurement error of the sensor being calibrated.
+
+### Calibration shall be performed at conditions within the range the sensor experiences in service, and not at a single ambient condition for sensors whose service range is wider.
+
+### The calibration record shall identify the sensor by its system tag, the reference instrument and its certificate, the as-found reading, the as-left reading, and the technician.
+
+## Owner Training {toc}
+
+### The Contractor shall deliver training to Owner personnel covering navigation of the operator interface, alarm response and acknowledgement, schedule editing, override and release procedure, trend retrieval and export, backup and restoration, and the cybersecurity procedures that constrain Owner operation of the system.
+
+### Training shall total at least the number of hours indicated in the datasheet.
+
+```datasheet
+label: Minimum Owner Training Hours
+type: range
+unit: hours
+min: 4
+max: 80
+setpoints: [4, 8, 16, 24, 40, 60, 80]
+default: 16
+```
+
+### Training shall be delivered in at least the number of separate sessions indicated in the datasheet so that personnel on different shifts can attend.
+
+```datasheet
+label: Minimum Number of Training Sessions
+type: range
+unit: sessions
+min: 1
+max: 6
+setpoints: [1, 2, 3, 4, 6]
+default: 2
+```
+
+### At least one training session shall be delivered after the building has been through one seasonal changeover, where the warranty period extends that far.
+
+### Training shall be conducted on the installed system with the project's own graphics, schedules, and alarms.
+
+### Training materials shall include written procedures for each covered task, a recording of each session, and a quick-reference card for the tasks performed most often.
+
+### Training records shall identify the attendees, the dates, the topics, and the instructor.
+
+# Warranty {toc}
+
+## Warranty Period and Coverage {toc}
+
+### The Contractor shall warrant the BAS against defects in materials and workmanship under normal service for the periods indicated in the datasheet, measured from the date of substantial completion.
+
+```datasheet
+label: Warranty Period - Parts
+type: range
+unit: years
+min: 1
+max: 10
+setpoints: [1, 2, 3, 5, 10]
+default: 1
+```
+
+```datasheet
+label: Warranty Period - Labor
+type: range
+unit: years
+min: 1
+max: 5
+setpoints: [1, 2, 3, 5]
+default: 1
+```
+
+### The warranty shall cover the cost of removing and reinstalling any item replaced under warranty, and the cost of repairing collateral damage caused by the failure or by the warranty repair itself.
+
+### Where a component is repaired or replaced under warranty, that component shall carry a new warranty of the same duration from the date of the repair, or the remainder of the original warranty period, whichever ends later.
+
+### Warranty response times shall meet the requirement stated under Controls Contractor Qualifications.
+
+## Post-Occupancy Tuning {toc}
+
+### The Contractor shall provide a tuning period following substantial completion for the duration indicated in the datasheet.
+
+```datasheet
+label: Post-Occupancy Tuning Period
+type: range
+unit: days
+min: 30
+max: 730
+setpoints: [30, 60, 90, 180, 365, 730]
+default: 90
+```
+
+### During the tuning period the Contractor shall respond to control loop instability, alarm limit adjustment, schedule adjustment, setpoint adjustment, and graphic corrections arising from operation of the building.
+
+### Work performed during the tuning period shall be at no additional cost to the Owner.
+
+### The Contractor shall record every change made during the tuning period and shall submit the record and an updated configuration backup at the end of the period.
+
+### A control system leaves the Contractor's hands before the building has run through its first full load range, so the settings at acceptance are estimates against an unoccupied building. The tuning period is where those estimates meet the loads the building actually has. {note}
+
+## Software and Firmware Support {toc}
+
+### The Contractor shall provide the software and firmware support indicated in the datasheet during the warranty period.
+
+```datasheet
+label: Software and Firmware Support During Warranty
+type: checkbox
+options:
+ - "Server operating system security patches"
+ - "BAS application software updates and security patches"
+ - "Controller firmware updates"
+ - "Graphic page changes within a defined monthly allowance"
+ - "Schedule and alarm definition changes within a defined monthly allowance"
+ - "Trend definition additions within a defined monthly allowance"
+ - "Annual cybersecurity configuration review"
+ - "Annual backup restoration test"
+default:
+ - "Server operating system security patches"
+ - "BAS application software updates and security patches"
+ - "Controller firmware updates"
+ - "Annual cybersecurity configuration review"
+```
+
+### Where a monthly allowance applies, the allowance shall be as indicated in the datasheet, and unused hours shall not accumulate between months.
+
+```datasheet
+label: Monthly Configuration Change Allowance
+type: range
+unit: hours
+min: 0
+max: 40
+setpoints: [0, 2, 4, 8, 16, 24, 40]
+default: 4
+```
+
+### Software and firmware updates applied during the warranty period shall be preceded by a verified configuration backup and shall be recorded in the audit log.
+
+# Spare Parts {toc}
+
+## The Contractor shall deliver the spare parts indicated in the datasheet at substantial completion.
+
+```datasheet
+label: Spare Parts Delivered at Substantial Completion
+type: checkbox
+options:
+ - "Spare hardware input and output modules of each type installed"
+ - "One spare controller of each model installed"
+ - "One spare control power transformer of each rating installed"
+ - "One spare network switch of each model installed"
+ - "Spare space temperature sensors"
+ - "Spare duct and immersion temperature sensors of each type installed"
+ - "Spare humidity sensors of each type installed"
+ - "Spare carbon dioxide sensors of each type installed"
+ - "Spare differential pressure transmitters of each range installed"
+ - "One spare damper actuator of each torque rating installed"
+ - "One spare valve actuator of each torque rating installed"
+ - "One spare gateway of each model installed"
+default:
+ - "Spare hardware input and output modules of each type installed"
+ - "One spare controller of each model installed"
+ - "One spare control power transformer of each rating installed"
+ - "Spare space temperature sensors"
+ - "One spare damper actuator of each torque rating installed"
+ - "One spare valve actuator of each torque rating installed"
+```
+
+## Spare hardware input and output modules shall be furnished in the quantity indicated in the datasheet, expressed as a percentage of the modules of that type installed.
+
+```datasheet
+label: Spare Hardware Module Quantity
+type: range
+unit: '%'
+min: 0
+max: 25
+setpoints: [0, 5, 10, 15, 20, 25]
+default: 10
+```
+
+## Spare sensors shall be furnished in the quantity indicated in the datasheet for each sensor type selected in the spare parts list.
+
+```datasheet
+label: Spare Sensor Quantity Per Type
+type: range
+unit: units
+min: 1
+max: 10
+setpoints: [1, 2, 3, 5, 10]
+default: 2
+```
+
+## Spare parts shall be of the same model, revision, and firmware level as the installed equipment, and the Contractor shall record the firmware level of each spare in the closeout package.
+
+## Spare parts shall be delivered in their original packaging and turned over against a written inventory signed by the Owner's representative.
+
+## Spare controllers and modules shall be stored in a conditioned location, and the storage location shall be identified in the closeout package.
+
+## Electrolytic capacitors and battery-backed memory in a controller held in storage age with temperature and humidity, so a spare kept in an unconditioned mechanical space may reach its failure point before it is ever installed. {note}