Resiliency has been a buzzword for the past few years in the U.S. Air Force. It's the ability to bend, but not break, when something goes wrong. This term is used in a variety of contexts — from mental health to supply chain issues and even energy. Energy resiliency refers to the Air Force’s ability to carry out operational missions when our energy supplies are compromised (e.g., a power outage). On a more micro level, this concept of resiliency should also be considered when reviewing sequences of operation used to automate HVAC systems.

Control sequence resiliency

Control sequence resiliency relates to the ability of certain aspects of the control sequence meet their objectives during a variety of failure scenarios or when the system is subjected to an unexpected set of conditions. In graduate school, I often heard this concept referred to as “system robustness,” although I haven't heard that term used outside of academia. However, testing system resiliency is often referred to as a “stress test” in the HVAC industry.

The concept of control sequence resiliency is best explained with examples. The following examples have come up on a few recent projects and offer great demonstrations of how slight nuances in the control sequence can have significant impacts on the resiliency of the system.

Critical space control

Critical spaces often have a variety of variables that are being controlled, including temperature, humidity, ventilation or air change per hour (ACH) requirements, and pressure relationships to adjacent spaces (see Figure 1). A common strategy would include:

• Supply air control: A constant airflow set point for the supply air valve controls to satisfy ACH requirements.
• Space temperature control: Space temperature control is achieved by modulating a duct-mounted reheat coil control valve.
• Humidity control: Humidity control is achieved by modulating a duct-mounted humidifier or resetting the serving AHU’s discharge air temperature set point.
• Pressure control: The appropriate pressure relationship to adjacent spaces is maintained by modulating the exhaust air valve to maintain exhaust airflow to some offset from supply airflow. This is often a more superior strategy than controlling the exhaust air valve directly to space pressure, as it dampens unstable responses from the exhaust air valve, which may happen should a door to the space open and pressure is momentarily reduced.

The last aspect, pressure control, is very critical. It’s needed to keep containments out of the space for positively pressurized spaces, and to keep containments confined within the space for negatively pressurized spaces. The pressure control strategy of controlling with a fixed airflow offset between the supply airflow and exhaust airflow has some nuances that are often overlooked, which compromise the resiliency of this aspect of the control sequence.

Common errors

Referencing airflow set point instead of measured airflow
For positively pressurized spaces, the exhaust air valve needs to be controlled to an airflow set point that is a fixed offset from the measured supply airflow. For example, if the supply air valve controls to a fixed airflow of 3,000 cfm to meet ACH requirements for the space, then the exhaust air valve would need to control to some offset (e.g., 500 cfm) less than that. The value of the offset maintains the required pressure relationship between the critical space and adjacent spaces and is typically determined by a testing, adjusting, and balancing (TAB) professional.

A common error is the reference airflow the offset is applied to. Often, that offset is subtracted from the supply airflow set point. That approach works well until the supply airflow doesn’t track on set point, such as when a fan in the serving AHU’s supply fan array fails, or inappropriate adjustments are made to the static pressure set point the AHU is controlling to. In such instances, the exhaust airflow set point would remain high despite a drop in measured supply airflow, which will result in the space pressure dropping — possibly to a point of becoming negatively pressurized. The more resilient controls approach is to calculate the active exhaust airflow "set point" by subtracting the offset from the "measured" supply airflow.

When this approach is taken, if insufficient supply airflow is realized, the active exhaust set point reduces accordingly. ACH requirements may not be met, but an alarm could sound for that. More importantly, the containments would not cross the critical space’s boundary while the facility team works to rectify the issue or before critical events (e.g., surgeries, lab experiments, etc.) wrap up. If the exhaust system comes up short — well, then, the space just becomes more positively pressurized. That may become an undesirable scenario, but, again, at least the contaminants don’t cross the boundary of the conditioned space.

In my experience, tying the active exhaust airflow set point to the supply airflow set point instead of the measured supply airflow is usually a programming error — most designers don't get it blatantly wrong. As such, I always engage with the controls contractor prior to testing (preferably prior to them performing the programming) to ensure this doesn't get overlooked.

Tracking exhaust airflow off supply airflow in negative spaces

For negatively pressurized spaces, the pressure control approach should be swapped. The exhaust air valve should control to a fixed airflow set point needed to achieve ACH requirements, and the supply air valve should control to an airflow set point which is a fixed offset below the measured exhaust airflow. Now, when a compromised exhaust system results in exhaust airflow coming up short of set point, the space pressure would still be maintained as the active supply airflow set point would drop in response to a drop in measured exhaust airflow.

Had the exhaust airflow set point instead tracked on measured supply airflow, and the exhaust airflow was short of set point, the supply airflow would have continued to track on its fixed set point. Thus, the space pressure would have gone positive in this scenario, creating a potentially dangerous situation for people in the adjacent space, which is now unintentionally contaminated.

In my experience, this error is commonly attributed to the specified sequence by the designer. Most often, there's a single specified sequence for critical spaces served by supply and exhaust air valves, which have pressure requirements. This sequence is specified to be applied to both positively and negatively pressurized spaces. When I explain my concern, most designers are easily convinced of the validity of tracking supply airflow off measured exhaust airflow for negatively pressurized spaces. However, they're less convinced of its criticality and are reluctant to make changes to avoid further complication for the controls contractor. They tend to dismiss the recommendation, saying something along the lines of, “We can't plan for every possible scenario.”

Negating the naysayers

I don’t want to further complicate control sequences either. However, I've worked in enough facilities to know supply air valves can come up short on airflow for a variety of reasons — just like exhaust air valves. And these instances do affect space-pressure relationships. These failure scenarios will be experienced at some point in a building that houses such critical spaces. If a simple adjustment to a single line of programming can uphold a space’s pressure requirements during such situations, then why are we fighting against doing the right thing for the building owners? These pressure requirements are there for a reason, right?

Conclusion

When reviewing sequences of operations for the systems you are commissioning, one consideration that is often overlooked is that of resiliency. Certainly, experiencing various failure scenarios improves your ability to incorporate this frame of reference into your control sequence review. As such, it's also important to share these war stories with your co-workers, so everyone can learn from them. Where direct experience is lacking, thinking through various what-if scenarios can identify where slight improvements can be made as well. This article provided a few examples of how slight modifications to a sequence of operation can improve the resiliency of the system.