Building IoT platformPrimustech, 2026 · Case study
Remote control that fails safe
The platform could watch a building's air-conditioning. Letting it switch units on and off took a different kind of care.
- safety principles, each traced to the finding behind it
- 10
- tests on the bridge that drives the control lanes
- 431
- commands per unit per hour at most, set per lane
- 6-12
A small working model of the real system. Press the buttons.
control bridge
dry run
commands this hour 0/6
air-conditioning unit
26 °C from the plant's readback
selector auto
- Set DRY_RUN to "false" to arm the lane, then send a setpoint. Try the typo too.
The problem
A wrong command to a compressor is not like a wrong row in a table: it wears real equipment, or leaves a building without cooling. The first control lanes had grown rule by rule, and nothing wrote down what must hold before a lane may command real equipment.
What I did
- 1
Wrote the control safety pattern each lane is measured against: ten principles, each with the finding it came from, how the platform enforces it and what the site must provide, plus a commissioning checklist and a record kept per site.
- 2
Made arming deliberate. A lane commands equipment only when its dry-run setting is exactly "false"; before, any value other than "true" armed it, so a typo would have started it live. Now anything else stops the bridge at startup.
- 3
Made the site's manual selector win: while a unit is on manual the platform sends nothing, retries nothing and raises no false alarm. By design, control goes back to the schedule when the selector returns to auto.
- 4
Capped commands per unit per hour, held setpoints to 20-30 °C, and designed every command to be confirmed from the plant's own readback instead of the command's echo. A command that does not take gets three attempts, two minutes apart, then an alarm.
- 5
Built a Modbus bench simulator, so the whole path is rehearsed before a real unit is touched, and gave each lane its own alert budget.
Three control lanes are measured against one written pattern, and the bridge that drives them has 431 tests. The pattern's rule: whatever goes wrong, the equipment ends up in the site's agreed safe state, under local control.
Stack
- MQTT
- Modbus
- Python
- Kubernetes
- Terraform
- Cloud Monitoring