open-control-library

Executable, engine-verified HVAC fault detection rules. Every rule is a CDL block graph, shipped as CXF JSON-LD that the open-control engine loads directly — no code generation, no black box.

📖 Browse the library — every rule, playbook, and point dictionary, published as a book.

Status: early access. Shared for review ahead of a broader release; content and contracts may still change.

Why

Most FDD libraries are papers, spreadsheets, or vendor black boxes. This one runs — and you can audit every step, from the plain-language fault card down to the exact logic the engine verified.

How a rule ships

Each rule is one folder of four files that travel together:

A rule is marked verified only when the engine at a pinned revision replays every vector green. The engine’s content_id is stamped on the card, so the verified logic stays identifiable forever.

Here’s a real one — AHU-0016, simultaneous heating and cooling:

What’s inside

• 137 verified fault rules across fourteen equipment families — air handlers, VAV boxes, fan-powered terminals, rooftop units, heat pumps, chillers, cooling towers, hot-water plants, hydronic heat exchangers, fan coils, energy recovery ventilators, pumps, VFDs, and cross-equipment sensor-health rules. The Fault Code Map lists them all.
• Point dictionaries (points/) — every canonical point name grounded in Brick 1.4.4 and ASHRAE 223P, so binding a rule to a real building is mechanical.
• Remediation playbooks (playbooks/) — verify → remote fix → on-site service → confirm, with typical costs and times.
• Fault clusters (clusters/) — faults that share a root cause, with a trigger rule and a fix order.
• CI verification (tools/verify) — every push replays every rule against the pinned engine.

Every card cites its sources — standards, research reports, and this library’s own simulation studies — and records each place the rule departs from them. The detail lives on the cards; start with any rule in the book.

Design stance

The graph computes fault-given-valid-data, and only that. Data quality, operating-state gating, and suppression are host concerns, declared on the card for the host to enforce — never buried in the logic. Rules stay portable, and every judgment call is written down where a reviewer can disagree with it.

Quick start

# read the contracts
$EDITOR SCHEMA.md

# run one rule's vectors against the engine (sibling checkout of open-control required)
cargo run --manifest-path tools/verify/Cargo.toml -- faults/ahu/AHU-0016

# run everything
cargo run --manifest-path tools/verify/Cargo.toml -- --all

# build the book locally
python3 tools/book/generate.py && mdbook serve book --open

Layout

• SCHEMA.md — the normative contracts. Read this first.
• faults/<equip>/<FAULT-ID>/ — one folder per rule; faults/registry.json maps them all.
• points/ — canonical point dictionaries.
• playbooks/, clusters/ — remediation workflows and fault syndromes.
• tools/ — the verifier, lints, and book generator.

License

Licensed under either of

• Apache License, Version 2.0 (LICENSE-APACHE)
• MIT license (LICENSE-MIT)

at your option. Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.

This book is generated from the repository by tools/book/generate.py; the files above are the source of truth.

cxf-library Schema

Normative contract for this library’s layout and file formats. Contract versions are per artifact: fault contracts remain v1 where named, and routine catalog artifacts use the identifiers in their section. Changes to any contract in this file require bumping the affected identifier.

Layout

cxf-library/
├── SCHEMA.md                    # this contract
├── points/<equip>.points.json   # canonical point dictionary per equipment family
├── faults/<equip>/<FAULT-ID>/   # one folder per fault rule
│   ├── card.md                  # fault card: YAML frontmatter (machine) + prose (human)
│   ├── rule.cxf.jsonld          # detection logic, hand-authored CXF JSON-LD
│   ├── vectors.json             # executable test scenarios
│   └── diagram.svg              # block-graph figure referenced from card.md
├── faults/<equip>/README.md     # chapter index and status table
├── playbooks/<slug>.md          # remediation playbooks (shared across faults)
├── clusters/clusters.json       # fault clusters (syndromes with shared root cause)
├── routines/                    # planned control-routine catalog
│   ├── registry.json            # canonical class inventory
│   ├── generated-registry.json  # executable deployment inventory
│   ├── ontology/                # immutable ontology pins and local vocabulary
│   ├── schemas/                 # six governed routine contract schemas
│   └── g36/                     # G36 pins, source inventory, scope, and coverage
├── tools/verify/                # Rust harness: loads each rule into the engine, runs vectors

Equipment family keys: ahu, vav, fpb, rtu, hp, fcu, chw, hw, hx, erv, pmp, vfd, sys, tower. Fault IDs live in a general namespace: {EQUIP}-{NNNN} — uppercase family key, four digits, contiguous from 0001 per family in authoring order. The folder name is the fault ID. The number carries no semantic meaning; provenance lives in each card’s source: list. IDs are stable identifiers and are never reused; renames are exceptional (the CXF does not embed the fault ID, so a rename never churns content_id, but it does break external links and every cross-reference).

faults/registry.json (cxf-library/registry/v1) is the library-wide fault-code map: one row per rule — id, family, name, method, status, and legacy_id (the rule’s pre-2026-08-18 {EQUIP}-FC-{NNN} code, for continuity with older references). The registry is orchestrator-maintained like clusters/clusters.json, and tools/lint/registry.py enforces in CI that it stays a bijection with the fault dirs, that IDs match the format and their folder, and that names/statuses match the cards. When a card is added, renamed, or changes status, the registry row moves with it in the same PR.

Reserved-but-unauthored IDs (a planned rule a README or card already names) are allowed: they appear in prose and index tables marked planned/deferred, never in the registry, and the next authored rule in that family takes the next free number, honoring any reservation.

Routine catalog

Routine contracts are independent of fault contracts. Nothing in this section changes a fault schema identifier or fault behavior. The routine catalog is schema-defined and non-executable. The current contract defines future canonical class, interface, specialization, semantic-profile, and derivation shapes without adding a production class, source mapping, semantic profile, derivation manifest, specialization, or executable deployment.

Pin ownership is split by purpose:

• Root ENGINE_PIN is the runtime evaluator revision.
• routines/g36/SOURCE_RELEASE_PIN is the stable Modelica Buildings release baseline.
• routines/g36/SOURCE_DEVELOPMENT_PIN is the reviewed development source baseline for material absent from the release.

Each source pin file contains exactly one lowercase 40-hex Git commit followed by a newline, and the commits MUST differ. The pin files are the authoritative source identities. routines/g36/DONOR_PIN and routines/g36/SOURCE_PIN are retired and MUST be absent.

Catalog inventories

routines/registry.json is the canonical class inventory. Its top-level object has exactly schema and routines; schema is cxf-library/routine-registry/v2. routines MUST be an array and remains empty until production class rows are implemented. This registry remains the sole catalog inventory; the schemas below do not replace it. A scope anchor is not a canonical class. The source inventory defined below records Git blobs; it does not identify Modelica classes or subsequences.

routines/generated-registry.json is the only inventory that may eventually drive routine execution. Its top-level object has exactly schema and deployments; schema is cxf-library/generated-routine-registry/v1. deployments MUST be an array and remains empty until generated deployments are implemented. The verifier’s --routines mode reads this file, accepts the empty array, and rejects nonempty arrays until that contract is implemented.

Canonical IDs MUST NOT encode fixed parameter values. Generated deployment IDs and row schemas are not defined by this version.

Canonical routine schema resources

This schema set governs six JSON Schema Draft 2020-12 resources:

Each resource declares https://json-schema.org/draft/2020-12/schema. References use same-resource fragments or the six absolute IDs above and resolve from an in-memory registry. Validation performs no network or filesystem retrieval for schema references. Objects are closed unless stated otherwise. Semantic-only definitions belong to the semantic-profile resource. routine-common-v1 retains its unchanged reusable definitions; the interface v3 resource defines its revised dimension form locally.

Canonical class IDs have the form G36-05-(01..22)-<UPPERCASE-HYPHENATED-CLASS-SLUG>. Scope IDs are invalid canonical IDs. A canonical ID identifies a parameterized engineering class; it MUST be independent of source paths and revisions, fixed parameter values, ordering, hashes, and future generated content IDs. IDs are immutable and MUST NOT be reused. Immutability and reuse are authoring and review invariants; the checker has no historical registry against which to prove them. A positive integer revision records contract changes separately from identity.

Parameter, connector, type, and dimension IDs use bounded lower-case snake_case. Stable repeated-member IDs use bounded lower-case hyphenated text beginning with a letter; a dense numeric index is not a stable member ID. Type, dimension, parameter, and connector IDs MUST be unique within their respective lists. Enum member IDs and symbols MUST be unique within their enum.

Class manifests (cxf-library/routine-class-manifest/v1)

A future class manifest has exactly schema, id, revision, section, source, and artifacts. section is 5.1 through 5.22; its number MUST agree with the section encoded in id.

source is a closed union selected by kind:

• upstream records snapshot (release or development), an exact lower-case 40-hex Git revision, a Modelica class path, and one or more file locators. Each locator contains a safe path below Buildings/Controls/OBC/ASHRAE/G36/ and a sha1:<40 lowercase hex> Git blob ID.
• independent records one or more safe repository-relative source paths.

Duplicate source paths, absolute paths, backslashes, control characters, and empty, ., or .. segments are invalid. artifacts has exactly interface, specialization_schema, and specialization_config. Their safe relative paths share one non-root class directory and end in interface.json, specialization.schema.json, and specialization.json, respectively. This is an artifact-location contract, not a production source-to-class mapping.

Interfaces (cxf-library/routine-interface/v3)

An interface has exactly schema, canonical_id, revision, types, dimensions, parameters, and connectors. Types and enums are local to that interface; this contract defines no global type catalog.

The primitive symbols are exactly real, integer, and boolean. String and runtime object types are excluded. A named alias selects one primitive and may record nonempty trimmed quantity, unit, and display_unit strings. These strings assert no QUDT, Brick, or ASHRAE 223 semantics. An enum declares a nonempty ordered list of unique stable member IDs and unique symbols. Enum values use the stable member IDs; no integer lowering code is assigned.

A type use is either primitive or a reference to a local named type. A shape is either scalar or an array with an ordered list of one or two dimension IDs. Dimensions have unique IDs. A fixed dimension declares a positive integer extent and a nonempty ordered members list whose count MUST equal that extent. A parameter-driven dimension references a scalar Integer parameter and MUST NOT declare canonical members; routine-specialization/v1 owns its member list. Dimension members are authored stable identities, not identities derived from array ordinals. Authored list order is contract order. Within one interface and specialization pair, member IDs MUST be unique across every fixed and parameter-driven dimension. Rank greater than two, zero extents, ragged matrices, and arithmetic dimension expressions are invalid.

Parameters have unique IDs, a type use, shape, fixed or configurable configurability, an optional typed default, and optional numeric minimum and maximum constraints. A fixed parameter MUST have a default and cannot be assigned by specialization. A configurable parameter without a default MUST be assigned by specialization.

Connectors have unique IDs, input or output direction, a type use, shape, and explicit presence. Presence is always or when with a closed guard AST. Guards support and, or, not, and eq, ne, lt, lte, gt, or gte comparisons. Operands are scalar parameter references or typed scalar literals. Ordering comparisons require numeric operands; Integer and Real operands are compatible. Runtime signals, connectors, time, point IDs, operating states, and host or fault logic cannot appear in guards. The checker validates guard structure, references, and operand compatibility but does not evaluate a guard or resolve optional branches.

Specialization inputs (cxf-library/routine-specialization/v1)

A specialization input has exactly schema, canonical_id, revision, parameters, and members. parameters is an ordered list of unique parameter IDs and JSON values. members binds each parameter-driven dimension ID to a nonempty ordered list of stable member IDs. Fixed dimensions are invalid targets. These IDs MUST be unique across the specialization’s member records and against the canonical members of every fixed dimension in the paired interface.

The interface and specialization canonical ID and revision MUST agree with the class manifest. Specialization checks parameter existence, fixed-parameter override rejection, required configurable assignments, primitive and enum value compatibility, numeric bounds, concrete dimension extents, rectangular rank-one and rank-two values, and parameter-driven member count. All numeric values MUST be finite. A parameter-driven dimension resolves only from a positive Integer effective value, and its member count MUST equal that value.

Specialization is input only. It contains no connector bindings, point IDs, resolved connector set, source map, generated CXF, runtime state, engine identity, or deployment identity.

Ontology identities and local vocabulary

routines/ontology/ontology-pins.json is the sole product ontology-pin record. It has the closed identifier cxf-library/ontology-pins/v1 and records these immutable authorities:

The S223 artifact imports <http://qudt.org/3.1.8/shacl/qudt-all>. The pin record keeps that as a compatibility observation. It does not replace the Library’s QUDT 3.1.4 authority, and the S223 artifact is not represented as the final published standard.

ocl-vocabulary.ttl contains only Library-owned profile, connector-binding, software-signal, derived-signal, aggregate, derivation, and policy terms used by the governed fixtures. It has no imports. Its SHA-256 is part of the pin record; changing the Turtle bytes requires updating that hash in the same change.

routines/ontology/shacl/open-control-routine-shapes.ttl is the governed SHACL Core graph for the two synthetic semantic fixtures. Shape identifiers use urn:open-control-library:shacl:routine:; every OCL term in the graph MUST be declared by ocl-vocabulary.ttl. The graph defines no SPARQL constraints, SHACL-AF rules, or SHACL-JS. Validation performs no imports or inference.

Routine semantic profiles (cxf-library/routine-semantic-profile/v1)

A semantic profile has a stable JSON-LD @id, type ocl:RoutineSemanticProfile, canonical class ID and revision, the exact routines/ontology/ontology-pins.json reference, and one or more connector roles. Its context is one closed embedded object. String, list, nested, remote, or imported contexts are invalid.

Connector role IDs use the interface connector-ID syntax and are unique. Each role has a bounded nonempty semantic_role, a mapping_status of verified or provisional, and a closed list of bounded topology requirements. verified means the author reviewed the mapping against the named pin evidence; provisional marks a mapping that still needs review. Neither value certifies a building instance. A physical role requires at least one location, topology, or ownership obligation; software and derived roles may use an empty list.

Direction is connector dataflow (input or output) and does not determine the S223 property class. For example, an active setpoint may be an input while its property remains actuatable. Requirement is R, A, O, N, S, D, or P; cardinality records integer minimum and maximum values with minimum not greater than maximum. Bindings are a closed union:

• physical-or-bms-point carries one points/<family>.points.json#<point_key> reference plus closed Brick and S223 mappings;
• software-signal carries an OCL class and no physical ontology mapping; and
• derived-signal carries an OCL class, output ID, and local derivation-manifest reference.

Physical mappings allow only the reviewed directional S223 property classes: s223:QuantifiableObservableProperty, s223:QuantifiableActuatableProperty, s223:EnumeratedObservableProperty, and s223:EnumeratedActuatableProperty. Quantifiable mappings require a QUDT quantity kind and unit. Enumerated mappings require an enumeration kind. Both mapping variants record the S223 medium as a CURIE or explicit null. Allowed aspects are s223:Aspect-Setpoint, s223:Aspect-Delta, and s223:Aspect-Maximum; s223:EnumeratedProperty is invalid. Topology strings are structural authoring obligations, not topology instances or SHACL results.

Derivation manifests (cxf-library/routine-derivation-manifest/v1)

A derivation manifest identifies one ocl:DerivedSignal or ocl:DerivedAggregate output. It records the canonical class revision, an exact routines/ontology/ontology-pins.json reference, an immutable function ID and version, ordered typed inputs with stable source IDs, stable members, exclusions, data-quality handling, freshness and alignment limits in seconds, readiness and in-domain policy, output unit and conversion policy, output scope, and reset behavior.

Member-linked inputs, exclusions, member output scopes, and source-triggered resets must resolve inside the manifest. IDs are unique. Data-quality and ready minimums cannot exceed the member population and must agree. A profile’s derived output ID and manifest fragment must equal the manifest output ID; a manifest output must be referenced by exactly one derived connector role in the synthetic fixture pair.

Schema validation boundary

The schemas enforce required and closed shapes, discriminators, ID patterns, primitive JSON types, and array-rank bounds. tools/lint/routine_schemas.py adds deterministic cross-document checks for uniqueness, section coherence, reference existence and kind, finite and compatible values, dimensions, rectangular arrays, guards, and specialization completeness. It rejects duplicate JSON keys and non-finite numbers before schema validation, checks all six schema resources with Draft202012Validator.check_schema, and reports sorted errors without a traceback for expected failures.

The linter validates one coherent fixture set under tools/lint/tests/fixtures/routine_schemas/. Those documents are synthetic, test-only contract evidence. They MUST NOT appear below routines/g36/ or be added to a registry, coverage claim, source inventory, book, or production catalog destination.

tools/lint/routine_semantics.py checks the closed pin record, recomputes the local-vocabulary hash, parses local Turtle bytes, applies the same six-resource in-memory schema registry, and rejects unsafe JSON-LD constructs before RDFLib parsing. It passes each fixture’s parsed graph independently to pySHACL 0.31.0 with imports, inference, advanced features, JavaScript, and in-place mutation disabled. SHACL reports are normalized into sorted diagnostics; Python retains the uniqueness, member, unit-policy, and cross-document checks.

The SHACL graph checks the RDF projection’s expected local classes and predicates, nested node/cardinality/datatype/class structure, and closed current entities. It does not duplicate every JSON Schema lexical rule or the Python checks above. The two fixtures under tools/lint/tests/fixtures/routine_semantics/ are synthetic. Their point references are syntax examples and are not resolved against production dictionaries or routine interfaces.

No external ontology is vendored or fetched. Brick, S223, and QUDT CURIE checks therefore prove closed syntax and selected S223 class and aspect policy, not that every external term exists in its pinned ontology. Connector semantic-role and topology requirements are authoring evidence, not building-instance evidence. Production profiles must later be paired with typed interfaces, canonical point dictionaries, ontology-term evidence, and building-instance validation before any semantic-conformance claim.

routines/g36/source-inventory.json (cxf-library/g36-source-inventory/v1)

The source inventory records two independent Git-tree snapshots from https://github.com/lbl-srg/modelica-buildings.git. Its top-level object has exactly these keys in order: schema, repository, source_root, inventory_scope, dependency_closure, license, and snapshots.

• schema is cxf-library/g36-source-inventory/v1;
• repository is https://github.com/lbl-srg/modelica-buildings.git;
• source_root is Buildings/Controls/OBC/ASHRAE/G36;
• inventory_scope is source-root-regular-files; and
• dependency_closure is not-inventoried.

license has exactly upstream_path, retained_path, git_blob_sha1, and sha256, in that order. upstream_path is Buildings/legal.html and retained_path is routines/g36/LICENSE-BUILDINGS.html. The retained file MUST equal the Git blob bytes at both pins. git_blob_sha1 uses sha1:<40 lowercase hex> and sha256 uses sha256:<64 lowercase hex>.

snapshots contains exactly two rows, ordered release then development. Each row has exactly these keys in order: role, revision, root_tree_sha1, file_count, total_bytes, modelica_file_count, package_order_count, and files. revision MUST equal the corresponding pin file. root_tree_sha1 is the Git tree ID for source_root, encoded as sha1:<40 lowercase hex>.

Each files row has exactly path, mode, bytes, git_blob_sha1, and sha256, in that order. Paths are full upstream repository-relative POSIX paths below source_root, sorted lexicographically and unique. Empty, ., and .. path segments, absolute paths, backslashes, and control characters are invalid. Version 1 supports only regular 100644 Git blobs; other modes and object types MUST be rejected. bytes and both hashes are calculated from Git object bytes rather than working-tree files.

file_count is the number of file rows, and total_bytes is the sum of their bytes values. modelica_file_count counts paths ending in .mo. package_order_count counts paths ending in /package.order; package.order content is not parsed or validated. All files remain in the inventory whether or not another source file names them.

The release and development snapshots MUST remain separate. The inventory does not choose a snapshot for a future canonical class and MUST NOT use one as a fallback for the other. It inventories no dependency outside source_root and makes no claim about Modelica declarations, classes, package members, references, imports, inheritance, source-family mapping, or executable coverage.

tools/lint/g36_source.py --write regenerates the inventory and retained legal notice from two supplied checkouts. --check verifies each checkout origin and exact HEAD, derives all records through Git object commands, and compares both tracked artifacts byte-for-byte without rewriting them. JSON uses two-space indentation, the field order above, and one final newline. It contains no timestamp, branch name, checkout path, or moving source identity. A source pin change requires regenerating both snapshots; generation fails if the pinned legal blobs or bytes differ.

routines/g36/scope.json (cxf-library/g36-scope/v1)

The scope manifest makes the Section 5 planning boundary discoverable without claiming canonical classes. Its top-level object has exactly schema, profile, status, and sections:

• schema is cxf-library/g36-scope/v1;
• profile is ASHRAE Guideline 36-2021 Section 5;
• status is planned; and
• sections is an array of exactly 22 rows, ordered from 5.1 through 5.22.

Each row has exactly id, section, name, status, source_disposition, and destination. IDs, sections, and destinations MUST each be unique. name is an independently written, nonempty display name and status is planned. Scope IDs identify planning anchors only; they MUST NOT be used as canonical class IDs.

The IDs, destinations, and reviewed planning dispositions are:

These dispositions classify the source plan; they do not identify a source class or prove implementation. Destinations are safe repository-relative POSIX paths below g36/. Absolute paths, backslashes, empty segments, . segments, and .. segments are invalid. The manifest reserves destinations without requiring placeholder directories.

routines/g36/coverage.json (cxf-library/g36-coverage/v2)

Coverage has exactly schema, profile, status, scope, and claims. schema is cxf-library/g36-coverage/v2; profile and status MUST equal scope.json; scope is scope.json; and claims remains empty until production coverage claims are implemented. Coverage does not repeat scope rows or inventory and makes no completeness, implementation, or evidence claim.

No routine.cxf.jsonld may appear below routines/g36/ until generated deployments are implemented. The retired routines/g36/generic/air-economizer-high-limits fixed-variant path MUST be absent.

Deferred routine contracts

Production class manifests, interfaces, specialization inputs, semantic profiles, and derivation manifests remain deferred, as do source-to-family and class mapping instances, point migrations, a specializer, resolved connectors, generated deployment bundle schemas and rows, source maps, vectors, generated CXF, building-instance conformance, and execution.

Design stance (why the pieces split this way)

• A fault rule is a CDL composite block: canonical point inputs → elementary comparison/logic/timing blocks → boolean fault output(s). Stored as CXF the open-control engine loads directly.
• The rule computes the fault condition given valid data. Data quality (NO_EVAL), operating-state gating, suppression, and energy accumulation are host/runtime concerns declared in the card frontmatter, never encoded in the block graph. The engine is deliberately status-blind; hosts enforce preconditions and operating_states before trusting yFault.
• Semantics live in the point dictionary (Brick + ASHRAE 223P), keyed by canonical point name. CXF documents stay semantics-free in v1; a generator may later inject annotations from the dictionary (the engine preserves unknown keys losslessly).

card.md contract (cxf-library/fault-card/v1)

YAML frontmatter followed by Markdown prose. Frontmatter fields:

Conventions:

• Every entry in points is a bare name resolvable in points/<equipment>.points.json as either a local concrete point or an explicit v2 alias. The CXF boundary input connector keeps that exact bare name. Resolution yields the canonical concrete target; a compatibility alias is not itself a canonical identity.
• params.*.cxf is the parameter’s CXF path relative to the root block (<instance>.<param>, e.g. persist.delayTime) so hosts can retune deployed rules via set_param without re-authoring. It may be a list of paths when one card parameter binds several block parameters (e.g. an evaluation window driving sampler periods and dwell times); hosts must set every listed path together.
• Signal units are those declared in the point dictionary (°C, Pa, %, bool). Hosts must feed those units; rules do no unit conversion in v1.
• verified.engine_rev is the open-control git rev the vectors last passed against; verified.content_id is the engine’s exported cxf:fnv1a128:… diagnostic identity. Git history is the integrity record for the bytes.

Prose sections (in order): ## Description, ## Detection Logic, ## Possible Diagnoses, ## Energy Impact, ## Emissions Impact, ## Deviations (differences from the source reference and why — required, may be “None”), ## Notes (optional).

## Detection Logic contains the equation in a fenced block plus the block graph as ![…](diagram.svg) (a standalone SVG file — GitHub renders linked SVG but strips inline SVG). Diagram conventions: boundary inputs as blue pills on the left, fault outputs as red pills on the right, elementary blocks as rounded rectangles labeled instance over Class · key params, signal flow left to right.

validation: (optional frontmatter block, adopted 2026-08-18). Records empirical validation runs against the card’s rule. A list; each entry: kind (simulation_fpr | simulation_tpr — for simulation_tpr, failures counts MISSED detections), harness (e.g. simharness/v1), date, fleet (one-line description of buildings × climates × period), scenarios (count), failures (count), optional notes (one line, e.g. the finding a failure represents). Results are facts about a specific fleet and gating configuration, not guarantees; the harness README documents mapping proxies and gating. Cards without the block simply have not been swept yet.

Card style (conciseness contract, adopted 2026-08-18; exemplar: faults/ahu/AHU-0016/card.md). Cards are clear, concise, and outlay the conditions — they are specifications, not design journals. Targets: Description ≤ ~10 lines; Detection Logic prose ≤ ~15 lines beyond the equation and diagram (timing semantics, strictness, deployer must-knows only — no block-by-block narration of the diagram); Energy/Emissions ≤ ~8 lines each; Notes ≤ ~8 lines or omitted. Deviations keeps EVERY engineering decision but each as one bullet of 2–5 lines (decision + one-sentence why + citation) — no alternatives-considered essays. Never narrate vector scenarios in the card (vectors.json is that record), except a sentence naming a deliberately-pinned engine behavior. Typical full card: ~140–220 lines (statistical cards may run ~250).

rule.cxf.jsonld contract

Target dialect: the open-control engine’s composite subset (open-control/docs/cxf-composite-subset.md), matching its G36 fixture style:

• @context: {"S231": "http://data.ashrae.org/S231P#", "base": "<fault ns>"} where the fault namespace is urn:cxf-library:<fault-id-lowercase>#.
• Flat @graph, full IRIs written out. Root block: <ns><fault_id_snake> with @type S231:Block, S231:label, S231:containsBlock, S231:hasInput (boundary points), S231:hasOutput.
• Child instances: <root>.<label>; @type is <ns>Buildings.Controls.OBC.CDL.<ClassPath> (the engine resolves the class from the IRI fragment). Only registry-supported classes.
• Ports <instance>.<portName> typed S231:RealInput/S231:BooleanInput/… with S231:isOfDataType; connections via S231:isConnectedTo on the source (output) node.
• Parameters: <instance>.<param> nodes carrying S231:value typed literals; referenced from S231:hasParameter. Set only non-default values.
• Fault outputs are BooleanOutputs; primary output is named yFault (true while the fault condition persists). Additional outputs allowed (e.g. sub-condition flags) and must be listed in the card’s outputs. When the reference semantics include an in-rule evaluability condition (a NO_EVAL test vector), expose it as an additional boolean output (y… name); the card documents that false means NO_EVAL — the host must consult it before interpreting yFault. Secondary outputs come in TWO kinds and the card’s outputs prose must say which: evaluability flags (y…Ok — false means NO_EVAL) and sub-condition/direction flags (e.g. SYS-0006’s yBias/yNoise, SYS-0008’s direction flags — diagnostic detail only; false never means NO_EVAL). Hosts must not treat every non-yFault boolean as an evaluability gate.
• No semantic annotations in v1 (see design stance). No oce.* class aliases.

vectors.json contract (cxf-library/vectors/v1)

{
  "schema": "cxf-library/vectors/v1",
  "clock": { "step_s": 60, "horizon_s": 1800 },
  "scenarios": [
    {
      "name": "snake_case_name",
      "description": "optional",
      "inputs": {
        "htg_vlv_cmd": 20.0,
        "clg_vlv_cmd": [ { "t": 0, "value": 30.0 }, { "t": 600, "value": 0.0 } ]
      },
      "expect": [
        { "output": "yFault", "from_s": 0, "to_s": 840, "equals": false }
      ]
    }
  ]
}

• inputs: canonical point name → constant (number/bool) or a step list [{t, value}…] (piecewise-constant; each value staged before the first tick with model time ≥ its t).
• expect: windowed assertions on boundary outputs, inclusive of both ends, checked at every tick whose time falls in the window. Reals compare with optional tolerance (default 1e-9).
• Scenarios are independent: each runs on a freshly loaded engine.
• Windows must respect timing parameters (e.g. leave ≥ one step of margin around an alarm_delay edge rather than asserting the exact boundary tick).
• Scenarios must cover at minimum: the reference card’s published test vectors, one threshold-edge case, and one transient case exercising delay/reset behavior where the rule has timing state.

points/<equip>.points.json contract (cxf-library/points/v1 and v2)

{
  "schema": "cxf-library/points/v2",
  "equipment": "vav",
  "namespaces": {
    "brick": {
      "iri": "https://brickschema.org/schema/Brick#",
      "verified_version": "1.4.4"
    },
    "s223": {
      "iri": "http://data.ashrae.org/standard223#",
      "verified_version": "1.0.0-ppr.2.1"
    },
    "quantitykind": {
      "iri": "http://qudt.org/vocab/quantitykind/",
      "verified_version": "QUDT 3.1.4"
    },
    "unit": {
      "iri": "http://qudt.org/vocab/unit/",
      "verified_version": "QUDT 3.1.4"
    }
  },
  "imports": ["points/zone.points.json"],
  "aliases": [
    {
      "name": "zone_temp",
      "target": "points/zone.points.json#zone_temp"
    }
  ],
  "points": [
    {
      "name": "zone_airflow",
      "description": "VAV box measured supply airflow",
      "kind": "real",
      "unit": "L/s",
      "qudt_unit": "L-PER-SEC",
      "brick": "Supply_Air_Flow_Sensor",
      "s223": {
        "pattern": "Sensor observes QuantifiableObservableProperty at the VAV box discharge via hasProperty",
        "property_class": "QuantifiableObservableProperty",
        "quantitykind": "VolumeFlowRate",
        "unit": "L-PER-SEC",
        "medium": "Fluid-Air",
        "aspects": []
      },
      "provisional": false,
      "notes": "Attach isPointOf the VAV box; hosts convert CFM before binding."
    }
  ]
}

• A v1 dictionary has exactly the required top-level fields schema, equipment, namespaces, and points. Only notes is optional. Existing v1 dictionaries remain valid and MUST NOT contain imports or aliases.
• A v2 dictionary has exactly the required top-level fields schema, equipment, namespaces, imports, aliases, and points. Only notes is optional. Namespace and concrete point records use the same closed shapes as v1.
• A concrete point’s canonical identity is points/<family>.points.json#<name>. name is snake_case; suffixes are none for measured values, _sp for setpoints, _cmd for commands, _status for status, and _fbk for feedback. A bare name is meaningful only in the context of one family dictionary.
• imports is an array of unique root-relative points/<lowercase-family>.points.json paths. Absolute paths, traversal, URLs, self-imports, missing files, duplicate entries, and import cycles are invalid.
• aliases is an array of closed {name, target} objects. name MUST be unique and MUST NOT collide with a local concrete point. target MUST be a fully qualified point reference whose dictionary appears in imports and whose fragment names a concrete record. Alias-to-alias targets are invalid.
• Contextual resolution of (family dictionary, bare name) checks one local concrete record, then one explicitly declared alias. It does not search other dictionaries. A fully qualified reference resolves its named dictionary and fragment; a legacy alias fragment normalizes once to its concrete target. Malformed, missing, colliding, or ambiguous references fail closed. There is no alias chain, filesystem-first match, or fallback.
• Fault cards keep bare boundary names. Rust fault lint resolves each name in the card family’s dictionary before the existing card/CXF/vector checks. Book generation uses the canonical resolved target for links and lists compatibility aliases without copying the target record or anchor.
• Role points (documented exception, points/sys.points.json only): the cross-equipment sensor-health rules bind role names (sensor_value, sensor_value_a/b, equip_active) rather than canonical points, because the same graph deploys against many real points. Role entries carry brick: null, s223: null; the host’s instance configuration records each binding, and that record is also what resolves the rule’s adjudicates target and drives its NO_EVAL fan-out. The reference’s own SYS-0005 card uses the same role form (“varies by application”).
• derived: true marks host-computed points rather than physical ones — both aggregates (a max or fraction across zones) and physical transforms (e.g. saturation temperatures from pressure via a refrigerant P-T lookup). The entry’s notes must state the derivation and its site-specific inputs (which refrigerant, which underlying points); rules consume derived points exactly like physical ones, and the derivation itself never appears in a rule graph.
• A top-level namespaces map records the exact ontology IRIs and the versions the terms were verified against.
• routines/ontology/ontology-pins.json is the point dictionaries’ sole immutable authority for Brick, S223 compatibility, and QUDT namespace IRIs and version echoes.
• brick: verified Brick class local name (namespace https://brickschema.org/schema/Brick#).
• s223: object {pattern, property_class, quantitykind, unit, medium, aspects, enumerationkind?} using verified ASHRAE 223P terms (enumerationkind for enumerated properties). See the internal 223P point-modeling note (local-only, not distributed) for the modeling pattern.
• Every term must be reviewed against the evidence named by the pin record — never from memory. provisional: true additionally marks entries with genuine ambiguity (class-choice judgment calls, unit conflicts, or patterns unattested in the standard’s reference models); the per-point notes field records the specifics. All s223 entries also await confirmation against the formal ASHRAE 223 standard text once obtained.
• tools/lint/point_semantics.py checks the strict mixed v1/v2 corpus, import/alias resolution, namespace echoes, command/setpoint direction, actuatable quantity and unit requirements, and the bounded reviewed VAV/SYS/zone mappings. It reads local files without network access and emits sorted diagnostics. It does not verify arbitrary external term existence, evaluate topology or SHACL, certify building instances, or change Engine or Studio runtime behavior. The Engine executes CXF and does not consume point dictionaries.

clusters/clusters.json (cxf-library/clusters/v1)

Array of {id, name, trigger, members, playbook, prevalence, energy_impact}. trigger fires first; fixing it should clear members within 24–48 h.

Playbooks

playbooks/<slug>.md: prose with a header block (Applies To, Fix Complexity, Typical Time, Typical Cost, Energy Impact) and the four-step workflow: Verify → Remote fix → On-site service → Confirm resolution. Faults reference playbooks by slug; playbooks list the fault IDs they apply to.

Verification

tools/verify loads each fault’s rule.cxf.jsonld into the open-control engine (path dependency, in-process), replays every vectors.json scenario tick by tick, and checks the assertion windows. A fault may be marked status: verified only when all scenarios pass; record the engine rev, exported content ID, and date in verified. Re-verify (and re-record) after any engine pin bump or rule edit.

AHU Fault Rules

Air handling unit fault detection rules (AHU-*). Source grounding: HVAC FDD Reference v1.0 ch.9 (adapted authority — see each card’s Deviations section) and ASHRAE Guideline 36-2021 §5.16.14 for the 001-range. AHU-0032–068 are library-authored extensions past the reference’s ch.9 range (which ends at 065), grounded in Bushby, Castro, Schein & House (2001), NIST/CEC PIER Project 2.3 — the original APAR rule set — with AHU-0034 additionally corroborated by PNNL-27338 §3.4 (HW-0004 extension precedent: explicit non-reference sourcing on each card).

Point dictionary: points/ahu.points.json.

Index

Reference note: the FDD Reference’s index (§5.8.1) lists 31 AHU codes while its ch.9 header claims “20 fully specified” — some 0xx cards in the reference are abbreviated. Our library treats every code above as in scope; severities shown are the reference’s and may be adjusted per card (recorded under Deviations).

Working order (first pass)

1. AHU-0016 — highest-impact fault, simplest logic; proves the schema.
2. AHU-0018, 057, 058 — the remote-fix “74% problem” cluster (CLU-02/04).
3. AHU-0017 — economizer (CLU-03).
4. AHU-0001…015 — the G36 001-range.
5. Remaining 05x/06x research rules.

AHU-0001 — Duct static pressure too low at full fan speed

Preconditions (host-enforced): Supply fan running — with the fan off both the pressure reading and the speed feedback are meaningless. The unit must be a multi-zone VAV AHU under duct static pressure control; a constant-volume unit has no dsp_sp to compare against. The speed feedback must be a real VFD readback rather than the commanded speed echoed back, since a defeated or bypassed drive reports 100% while the fan turns at line speed or not at all. When any gate is unmet the verdict is NO_EVAL, not healthy.

Points: dsp, dsp_sp, sf_speed

Outputs:

• yFault — True while duct static pressure has stayed more than dsp_error_threshold below its setpoint with the fan above speed_full_threshold, for at least alarm_delay

Parameters:

Description

The fan is at the stop and the duct is still short of pressure. VAV boxes throttle against that pressure to hold zone airflow; without it they run wide open and still starve. The control loop has already asked for everything and the measurement has not moved, so the deficit is mechanical rather than a tuning problem — a belt slipping on its sheaves, a fire/smoke damper that closed and never reopened, a filter bank past its change-out point, or a VFD that has silently derated all read the same way from the outside. This is a protective fault: it catches the mechanical failure early and explains complaints that would otherwise be chased zone by zone. The energy story is real but indirect — a fan pinned at 100% against a leaking or obstructed duct burns full fan power to deliver less than design air.

Detection Logic

press_gap = dsp_sp − dsp
yFault    = (press_gap > dsp_error_threshold)      pressure short of setpoint by more than tolerance
        AND (sf_speed  > speed_full_threshold)     fan has no reserve left
            sustained continuously for alarm_delay

Block graph (rule.cxf.jsonld):

The gap form is the reference’s dsp < dsp_sp − eps_dsp rearranged so one positive number carries the tolerance (see Deviations). The speed conjunct is what makes the rule mean anything: pressure below setpoint at part speed is an ordinary control loop working, and only a loop that has run out of fan is evidence of a defect. Both comparisons are strict, so a deficit sitting exactly on 25 Pa and a speed feedback parked exactly on 99.0% both read healthy. persist requires 30 minutes of continuous violation — enough to separate a mechanical fault from a morning start-up, a damper stroke, or the pressure dip after a bank of boxes opens at once — and any interruption restarts the timer.

Possible Diagnoses

1. Ductwork obstruction or collapse — a closed fire/smoke damper, a dropped internal liner, or debris left after a renovation
2. Fan belt slipping or broken
3. Fan motor or VFD fault — a drive derating on a thermal or current limit reports full speed command while delivering less
4. Excessive duct leakage — a disconnected branch or a failed flex connection downstream of the sensor
5. DSP sensor fault — a plugged or disconnected sensing tube reads low with a perfectly healthy duct behind it

Energy Impact

PROTECTIVE, LOW confidence, QUALITATIVE_ONLY. No waste term is computable and none is published: the alarm is about equipment damage and undeliverable airflow, not kilowatt-hours. What energy there is depends on the cause — duct leakage means the fan produces air that never reaches a zone, an obstruction means the fan spends pressure across the blockage, and a slipping belt or derated drive costs comfort and a repair bill instead. No PNNL measure covers this fault, hence LOW confidence and no range. Climate-neutral. If a leakage or obstruction cause is confirmed, size the recovered fan energy per Energy Impact Reference §4.4 from fan hours and the pressure spent against the defect.

Emissions Impact

QUALITATIVE_EMISSIONS, LOW confidence; negligible direct emissions. A fan already at 100% draws what it draws whether or not the duct is short of pressure, so detecting this fault avoids no emissions on its own. Scope is N/A — there is no emitting stream to attribute, the general shape of a PROTECTIVE fault. Any credit belongs to the repair that follows and to the DSP reset it enables, which is AHU-0031’s to claim. Avoided-emissions basis: N/A.

Deviations

• The fan-speed conjunct uses the reference’s bare sf_speed ≥ 99%. G36-2018 §5.16.14 FC#1 subtracts a VFD speed error allowance (> 99% − eps_VFDSPD, 94% at the Table 5.16.14.5 default); the reference ch.9 card simplifies to a bare 99% and this card follows its primary source. Drives that plateau just under 99% read NO-fault under the shipped default — retune speed_full_threshold to 94.0 for the G36 form.
• dsp < dsp_sp − eps_dsp rewritten in gap form. Subtracting first and testing dsp_sp − dsp > eps_dsp keeps eps_dsp the positive number the reference publishes, retunable at one CXF path, instead of negating it into an AddParameter. Same rearrangement as AHU-0028; the one-ulp difference at the threshold is not observable at 1 Pa sensor resolution.
• sf_speed >= 99% → strict >. CDL Reals offers only strict comparisons, so a feedback parked at exactly 99.000% reads as not-at-full- speed and the rule stays silent. A host binding a coarsely quantized speed point (integer percent) should retune speed_full_threshold to 98.9 rather than rely on the drive overshooting.
• The fan-running condition is a precondition, not a wire. The reference lists it under Preconditions rather than in its Logic row, so it stays in frontmatter for the host. This is the opposite choice from AHU-0031, where the reference puts sf_status = ON in the logic and the graph carries it.
• Operating states OS 1–5 are declared, not gated. The reference marks the fault applicable in every operating state, so the frontmatter records applicability and the graph carries no state logic.
• First PROTECTIVE fault in the library, and the first with no emissions scope. emissions.scope is the literal string "N/A"; the schema types the field as free text, so the convention is set here.
• persist.delayOnInit = true (Modelica/CDL default is false), the library’s standing choice: a deficit already present at load waits out the full 30 minutes instead of alarming on the first tick after a controller restart.

Notes

Rule out diagnosis 5 first: a plugged sensing tube reads low forever and the fan chases it to 100%, which is the same trace as a collapsed duct. Two tells separate them — a genuine deficit moves when zone demand moves, and a healthy duct with a bad sensor still delivers zone airflow. This fault is the low-side mirror of AHU-0031 (excessive static pressure): same two signals, opposite failure, and they cannot be true at once. If the DSP setpoint has never been reset from its design value — the case AHU-0024 detects — a fan at 100% against an unrealistic setpoint is a tuning artifact, not a broken belt.

Test Vectors

10 scenarios, clock step 300 s over 5400 s.

{
  "schema": "cxf-library/vectors/v1",
  "clock": {
    "step_s": 300,
    "horizon_s": 5400
  },
  "scenarios": [
    {
      "name": "normal_part_speed_operation",
      "description": "Reference vector: 350 Pa against a 375 Pa setpoint with the fan at 60% \u2014 the fan still has headroom, and the 25 Pa gap does not clear the strict threshold either; nothing to report",
      "inputs": {
        "dsp": 350.0,
        "dsp_sp": 375.0,
        "sf_speed": 60.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "at_full_speed_holding_setpoint",
      "description": "Reference vector: 370 Pa against a 375 Pa setpoint with the fan at 100% \u2014 the fan is maxed out but the duct is only 5 Pa short, well inside dsp_error_threshold, so the system is simply sized close to its design point",
      "inputs": {
        "dsp": 370.0,
        "dsp_sp": 375.0,
        "sf_speed": 100.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "underpressure_at_full_speed",
      "description": "Reference vector: 300 Pa against a 375 Pa setpoint with the fan at 100% \u2014 a 75 Pa deficit with no speed left to give; the alarm asserts one alarm_delay (1800 s) after the condition appears",
      "inputs": {
        "dsp": 300.0,
        "dsp_sp": 375.0,
        "sf_speed": 100.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 5400,
          "equals": true
        }
      ]
    },
    {
      "name": "gap_exactly_at_threshold",
      "description": "Threshold edge: dsp_sp \u2212 dsp = 25.0 Pa exactly with the fan at 100% \u2014 gapBig is a strict `>`, so a deficit sitting precisely on dsp_error_threshold reads healthy",
      "inputs": {
        "dsp": 350.0,
        "dsp_sp": 375.0,
        "sf_speed": 100.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "gap_just_over_threshold",
      "description": "Threshold edge, other side: dsp_sp \u2212 dsp = 25.1 Pa with the fan at 100% clears the strict comparison and alarms after alarm_delay",
      "inputs": {
        "dsp": 349.9,
        "dsp_sp": 375.0,
        "sf_speed": 100.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 5400,
          "equals": true
        }
      ]
    },
    {
      "name": "speed_exactly_at_threshold",
      "description": "Threshold edge: the fan sits exactly on speed_full_threshold (99.0%) with a 75 Pa deficit \u2014 spdFull is a strict `>`, so a feedback parked on 99.000% does not count as full speed and the rule stays silent",
      "inputs": {
        "dsp": 300.0,
        "dsp_sp": 375.0,
        "sf_speed": 99.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "speed_just_over_threshold",
      "description": "Threshold edge, other side: 99.5% clears the strict comparison, so the same 75 Pa deficit alarms after alarm_delay",
      "inputs": {
        "dsp": 300.0,
        "dsp_sp": 375.0,
        "sf_speed": 99.5
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 5400,
          "equals": true
        }
      ]
    },
    {
      "name": "startup_ramp_clears_before_delay",
      "description": "Transient: the fan pins at 100% and runs 75 Pa short while the system comes up, then pressure recovers to 370 Pa at t=1200 \u2014 a morning start-up is shorter than alarm_delay, so nothing alarms",
      "inputs": {
        "dsp": [
          {
            "t": 0,
            "value": 300.0
          },
          {
            "t": 1200,
            "value": 370.0
          }
        ],
        "dsp_sp": 375.0,
        "sf_speed": 100.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "fault_clears_on_recovery",
      "description": "A sustained deficit alarms at 1800 s; a closed fire/smoke damper reopens at t=3000, pressure recovers to 370 Pa, and the alarm drops on that tick \u2014 TrueDelay has no off-delay",
      "inputs": {
        "dsp": [
          {
            "t": 0,
            "value": 300.0
          },
          {
            "t": 3000,
            "value": 370.0
          }
        ],
        "dsp_sp": 375.0,
        "sf_speed": 100.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 2700,
          "equals": true
        },
        {
          "output": "yFault",
          "from_s": 3300,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "speed_backs_off_before_delay",
      "description": "Transient: the deficit holds but the fan drops to 92% at t=1200 as zone demand falls \u2014 the rule needs both halves at once, so persistence restarts and no alarm follows",
      "inputs": {
        "dsp": 300.0,
        "dsp_sp": 375.0,
        "sf_speed": [
          {
            "t": 0,
            "value": 100.0
          },
          {
            "t": 1200,
            "value": 92.0
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    }
  ]
}

AHU-0002 — Mixed air temperature too low

Preconditions (host-enforced): Supply fan running — MAT means nothing in still air. The host must not evaluate during coil freeze-protection or within a few minutes of an economizer mode transition, when MAT lags the mixture it is supposed to report, and must silence this rule while AHU-0028 is active. When a gate is unmet the verdict is NO_EVAL, not healthy.

Points: oat, rat, mat

Outputs:

• yFault — True while MAT has stayed more than mat_tolerance below min(oat, rat) for at least alarm_delay

Parameters:

Description

Mixed air is a blend of outdoor and return air, so it cannot be colder than both streams. When MAT reads more than combined sensor accuracy below the colder of OAT and RAT, the reading is impossible and something is wrong with the measurement or the mixing plenum: a sensor out of calibration, or outdoor air leaking past the mixing box straight onto the MAT sensor.

This is G36 §5.16.14 FC#2, the low half of the mixed-air envelope check. AHU-0003 is its mirror on the high side; both sit in cluster CLU-09 (Sensor Integrity Failure), whose trigger AHU-0028 tests the envelope in both directions at once. Roughly 15% of buildings have at least one AHU with a temperature sensor this far out.

Detection Logic

yFault = mat < min(oat, rat) − mat_tolerance,
         sustained continuously for alarm_delay

Block graph (rule.cxf.jsonld):

Min rather than a fixed OAT-below-RAT assumption, because which stream is colder flips with the season. The threshold comparison is strict, so a MAT sitting exactly 2.0 °C below the bound is healthy and 2.1 °C below is not. persist requires 30 minutes of continuous violation — a MAT that dips out and recovers during a damper stroke never alarms, and any interruption restarts the timer — while recovery is immediate on the tick MAT climbs back inside the bound. Nothing above the envelope can trip this rule: a MAT 4 °C above both sources violates the same physics and reads healthy here, because that case is AHU-0003’s.

Possible Diagnoses

1. MAT sensor out of calibration, reading low
2. OAT sensor out of calibration, reading high
3. RAT sensor out of calibration, reading high
4. Cold air leakage into the mixing plenum — outdoor air short-circuiting to the sensor rather than mixing

Energy Impact

COMFORT_ENERGY, LOW confidence, QUALITATIVE_ONLY. A mis-read temperature costs nothing directly; the cost is downstream. A MAT biased low reads as excess cold in the mixture, so the mixed-air loop closes outdoor air below what the mixture needs — giving up free cooling in mild weather — and can call for preheat that nothing requires. PNNL-25985 EEM-01 (sensor recalibration) puts the recoverable range at 0–5% of site energy across a whole sensor population, sensor-dependent and climate-neutral. Prevalence ~15% of buildings have sensor faults.

Emissions Impact

QUALITATIVE_EMISSIONS, LOW confidence; no direct emissions. Scope is 1|2 because it depends on which subsystem the bad reading distorts: unnecessary preheat lands in Scope 1 (on-site combustion), a disabled economizer calling for mechanical cooling lands in Scope 2 (purchased electricity). The same drifted sensor can do both in different seasons, so no single scope is correct year-round. Avoided-emissions basis: N/A.

Deviations

• Single combined tolerance instead of G36’s per-sensor error bands. G36’s precise form is MAT_AVG + eps_MAT < min[(RAT_AVG − eps_RAT), (OAT_AVG − eps_OAT)]; the HVAC FDD Reference collapses that to one eps_MAT applied once and this card inherits the simplification. One combined band needs a larger true error before it fires — fewer false positives, less sensitivity to drift in any individual sensor. The G36 form would need three parameters and an offset block on each sensor path ahead of the Min.
• Instantaneous samples instead of averaged signals. G36 compares time-averaged temperatures; this rule compares raw samples and leans on the 30-minute persist delay to reject noise. The two are not equivalent — averaging tolerates a signal that crosses the bound repeatedly while its mean stays outside, whereas persistence resets on every tick inside the envelope and can hide an oscillating MAT indefinitely. Steady drift, the fault this rule is for, reads the same either way.
• Bound comparison rewritten as gap comparison. min − mat > tol ⟺ mat < min − tol, algebraically identical, but it keeps mat_tolerance a single positive set_param value instead of a negative offset in the graph. Same rewrite as AHU-0028.
• Strict inequality at the threshold. GreaterThreshold is u > t, so a sensor sitting precisely at its rated accuracy stays off the alarm list; CDL Reals offers no greater-or-equal comparison, so this is also the only available spelling.
• Suppression is declared, not encoded. AHU-0028 tests the same envelope with a shorter delay and suppresses this rule while active. The block graph cannot express that — the engine is status-blind and each rule is an independent composite — so it lives in suppressed_by and CLU-09 for the host to enforce.
• Operating states and preconditions are frontmatter, not graph. Freeze protection and the minutes after an economizer mode change are periods when MAT legitimately disagrees with the steady-state mixture; all of it is host-enforced, per the library’s stance.
• persist.delayOnInit = true (Modelica/CDL default is false): a violation already present at load waits out the full 30 minutes rather than alarming on the first tick after a controller restart.
• Severity 3 (warning) comes from the reference’s chapter 9 card, its only severity statement for this fault — the §5.8.1 index carries no severity column.

Notes

The rule finds a contradiction between three sensors; it cannot say which one is lying. Direction narrows the list — a low MAT means MAT reads low or one of its bounds reads high — which is why the diagnoses mirror AHU-0003’s rather than copy them. Step 1 of the sensor-drift playbook resolves the ambiguity one sensor at a time; fix is on-site recalibration or replacement ($30–$80), and if all three check out, look at the mixing box for a leakage path onto the sensor. AHU-0028 runs a 15-minute delay against this pair’s 30, so the operator sees the integrity alarm first and this rule confirms which side of the envelope the reading fell on.

Test Vectors

9 scenarios, clock step 300 s over 7200 s.

{
  "schema": "cxf-library/vectors/v1",
  "clock": {
    "step_s": 300,
    "horizon_s": 7200
  },
  "scenarios": [
    {
      "name": "normal_mixing",
      "description": "Reference vector: MAT 18 \u00b0C with OAT 5 / RAT 22 sits 13 \u00b0C above the low bound; nothing to report",
      "inputs": {
        "oat": 5.0,
        "rat": 22.0,
        "mat": 18.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 7200,
          "equals": false
        }
      ]
    },
    {
      "name": "mat_below_envelope",
      "description": "Reference vector: MAT 1 \u00b0C is 4 \u00b0C below min(oat, rat) = 5 \u00b0C, twice the tolerance; alarms at alarm_delay (1800 s)",
      "inputs": {
        "oat": 5.0,
        "rat": 22.0,
        "mat": 1.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 7200,
          "equals": true
        }
      ]
    },
    {
      "name": "within_tolerance",
      "description": "Reference vector: MAT 4 \u00b0C is 1 \u00b0C below the low bound \u2014 inside eps_MAT, so the sensor pair is still plausible",
      "inputs": {
        "oat": 5.0,
        "rat": 22.0,
        "mat": 4.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 7200,
          "equals": false
        }
      ]
    },
    {
      "name": "edge_gap_equals_tolerance",
      "description": "Threshold edge: min(oat, rat) \u2212 mat = 2.0 \u00b0C exactly; the comparison is strict, so this is healthy",
      "inputs": {
        "oat": 20.0,
        "rat": 22.0,
        "mat": 18.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 7200,
          "equals": false
        }
      ]
    },
    {
      "name": "edge_gap_just_over_tolerance",
      "description": "Threshold edge, other side: a gap of 2.1 \u00b0C clears the strict comparison and alarms at alarm_delay",
      "inputs": {
        "oat": 20.0,
        "rat": 22.0,
        "mat": 17.9
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 7200,
          "equals": true
        }
      ]
    },
    {
      "name": "summer_oat_above_rat",
      "description": "Cooling season with OAT above RAT: RAT 24 \u00b0C is now the low bound and MAT 20 \u00b0C sits 4 \u00b0C under it",
      "inputs": {
        "oat": 30.0,
        "rat": 24.0,
        "mat": 20.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 7200,
          "equals": true
        }
      ]
    },
    {
      "name": "high_excursion_is_not_this_fault",
      "description": "MAT 26 \u00b0C is 4 \u00b0C above the envelope \u2014 a real violation, but the high side belongs to AHU-0003",
      "inputs": {
        "oat": 5.0,
        "rat": 22.0,
        "mat": 26.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 7200,
          "equals": false
        }
      ]
    },
    {
      "name": "transient_excursion_never_alarms",
      "description": "MAT drops below the bound for 1200 s (< alarm_delay) during a damper stroke and recovers; the timer resets unfired",
      "inputs": {
        "oat": 5.0,
        "rat": 22.0,
        "mat": [
          {
            "t": 0,
            "value": 18.0
          },
          {
            "t": 900,
            "value": 1.0
          },
          {
            "t": 2100,
            "value": 18.0
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 7200,
          "equals": false
        }
      ]
    },
    {
      "name": "fault_clears_on_recovery",
      "description": "Sustained low excursion alarms at 1800 s; recalibration at 3600 s drops the alarm on the same tick",
      "inputs": {
        "oat": 5.0,
        "rat": 22.0,
        "mat": [
          {
            "t": 0,
            "value": 1.0
          },
          {
            "t": 3600,
            "value": 18.0
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 3300,
          "equals": true
        },
        {
          "output": "yFault",
          "from_s": 3900,
          "to_s": 7200,
          "equals": false
        }
      ]
    }
  ]
}

AHU-0003 — Mixed air temperature too high

Preconditions (host-enforced): Supply fan running — MAT means nothing in still air. The host must not evaluate during coil freeze-protection or within a few minutes of an economizer mode transition, when MAT lags the mixture it is supposed to report, and must silence this rule while AHU-0028 is active. When a gate is unmet the verdict is NO_EVAL, not healthy.

Points: oat, rat, mat

Outputs:

• yFault — True while MAT has stayed more than mat_tolerance above max(oat, rat) for at least alarm_delay

Parameters:

Description

Mixed air is a blend of outdoor and return air, so it cannot be warmer than both streams. When MAT reads more than combined sensor accuracy above the warmer of OAT and RAT, the reading is impossible and something is wrong with the measurement or the sensor’s surroundings: a sensor out of calibration, or one mounted where sunlight or a warm surface reaches it instead of the mixed stream.

This is G36 §5.16.14 FC#3, the high half of the mixed-air envelope check. AHU-0002 is its mirror on the low side; both sit in cluster CLU-09 (Sensor Integrity Failure), whose trigger AHU-0028 tests the envelope in both directions at once. Roughly 15% of buildings have at least one AHU with a temperature sensor this far out.

Detection Logic

yFault = mat > max(oat, rat) + mat_tolerance,
         sustained continuously for alarm_delay

Block graph (rule.cxf.jsonld):

Max rather than a fixed RAT-above-OAT assumption, because which stream is warmer flips with the season. The threshold comparison is strict, so a MAT sitting exactly 2.0 °C above the bound is healthy and 2.1 °C above is not. persist requires 30 minutes of continuous violation — a MAT that spikes and recovers during a damper stroke never alarms, and any interruption restarts the timer — while recovery is immediate on the tick MAT drops back inside the bound. Nothing below the envelope can trip this rule: a MAT 4 °C under both sources violates the same physics and reads healthy here, because that case is AHU-0002’s.

Possible Diagnoses

1. MAT sensor out of calibration, reading high
2. OAT sensor out of calibration, reading low
3. RAT sensor out of calibration, reading low
4. Solar gain at the MAT sensor location — the sensor sees radiant heat or a sun-struck duct wall rather than the mixed stream

Energy Impact

COMFORT_ENERGY, LOW confidence, QUALITATIVE_ONLY. A mis-read temperature costs nothing directly; the cost is downstream. A MAT biased high reads as excess heat in the mixture, so the mixed-air loop pulls in more outdoor air than the mixture needs and the coil downstream pays for the difference — preheat in winter, mechanical cooling in summer. PNNL-25985 EEM-01 (sensor recalibration) puts the recoverable range at 0–5% of site energy across a whole sensor population, sensor-dependent and climate-neutral. Prevalence ~15% of buildings have sensor faults.

Emissions Impact

QUALITATIVE_EMISSIONS, LOW confidence; no direct emissions. Scope is 1|2 because it depends on which subsystem the bad reading distorts: excess outdoor air paid for at the preheat coil lands in Scope 1 (on-site combustion), the same excess paid for at the cooling coil lands in Scope 2 (purchased electricity). The same drifted sensor can do both in different seasons, so no single scope is correct year-round. Avoided-emissions basis: N/A.

Deviations

• Single combined tolerance instead of G36’s per-sensor error bands. G36’s precise form is MAT_AVG − eps_MAT > max[(RAT_AVG + eps_RAT), (OAT_AVG + eps_OAT)]; the HVAC FDD Reference collapses that to one eps_MAT applied once and this card inherits the simplification. One combined band needs a larger true error before it fires — fewer false positives, less sensitivity to drift in any individual sensor. The G36 form would need three parameters and an offset block on each sensor path ahead of the Max.
• Instantaneous samples instead of averaged signals. G36 compares time-averaged temperatures; this rule compares raw samples and leans on the 30-minute persist delay to reject noise. The two are not equivalent — averaging tolerates a signal that crosses the bound repeatedly while its mean stays outside, whereas persistence resets on every tick inside the envelope and can hide an oscillating MAT indefinitely. Steady drift, the fault this rule is for, reads the same either way.
• Bound comparison rewritten as gap comparison. mat − max > tol ⟺ mat > max + tol, algebraically identical, but it keeps mat_tolerance a single positive set_param value. Matches AHU-0002 and AHU-0028 spelling for spelling.
• Strict inequality at the threshold. GreaterThreshold is u > t, so a sensor sitting precisely at its rated accuracy stays off the alarm list; CDL Reals offers no greater-or-equal comparison, so this is also the only available spelling.
• Suppression is declared, not encoded. AHU-0028 tests the same envelope with a shorter delay and suppresses this rule while active. The block graph cannot express that — the engine is status-blind and each rule is an independent composite — so it lives in suppressed_by and CLU-09 for the host to enforce.
• Operating states and preconditions are frontmatter, not graph. Freeze protection and the minutes after an economizer mode change are periods when MAT legitimately disagrees with the steady-state mixture; all of it is host-enforced, per the library’s stance.
• persist.delayOnInit = true (Modelica/CDL default is false): a violation already present at load waits out the full 30 minutes rather than alarming on the first tick after a controller restart.
• Severity 3 (warning) comes from the reference’s chapter 9 card, its only severity statement for this fault — the §5.8.1 index carries no severity column.

Notes

The rule finds a contradiction between three sensors; it cannot say which one is lying. Direction narrows the list — a high MAT means MAT reads high or one of its bounds reads low — and solar gain earns a place on this side only: a sun-struck sensor reads high, never low. Step 1 of the sensor-drift playbook resolves the ambiguity one sensor at a time; fix is on-site recalibration or replacement ($30–$80), and relocating a MAT probe out of a sunlit spot fixes what recalibration cannot. AHU-0028 runs a 15-minute delay against this pair’s 30, so the operator sees the integrity alarm first and this rule confirms which side of the envelope the reading fell on.

Test Vectors

9 scenarios, clock step 300 s over 7200 s.

{
  "schema": "cxf-library/vectors/v1",
  "clock": {
    "step_s": 300,
    "horizon_s": 7200
  },
  "scenarios": [
    {
      "name": "normal_mixing",
      "description": "Reference vector: MAT 18 \u00b0C with OAT 5 / RAT 22 sits 4 \u00b0C below the high bound; nothing to report",
      "inputs": {
        "oat": 5.0,
        "rat": 22.0,
        "mat": 18.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 7200,
          "equals": false
        }
      ]
    },
    {
      "name": "mat_above_envelope",
      "description": "Reference vector: MAT 28 \u00b0C is 6 \u00b0C above max(oat, rat) = 22 \u00b0C; alarms at alarm_delay (1800 s)",
      "inputs": {
        "oat": 5.0,
        "rat": 22.0,
        "mat": 28.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 7200,
          "equals": true
        }
      ]
    },
    {
      "name": "within_tolerance",
      "description": "Mirror of the FC#2 within-tolerance vector: MAT 23 \u00b0C is 1 \u00b0C above the high bound \u2014 inside eps_MAT",
      "inputs": {
        "oat": 5.0,
        "rat": 22.0,
        "mat": 23.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 7200,
          "equals": false
        }
      ]
    },
    {
      "name": "edge_gap_equals_tolerance",
      "description": "Threshold edge: mat \u2212 max(oat, rat) = 2.0 \u00b0C exactly; the comparison is strict, so this is healthy",
      "inputs": {
        "oat": 5.0,
        "rat": 22.0,
        "mat": 24.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 7200,
          "equals": false
        }
      ]
    },
    {
      "name": "edge_gap_just_over_tolerance",
      "description": "Threshold edge, other side: a gap of 2.1 \u00b0C clears the strict comparison and alarms at alarm_delay",
      "inputs": {
        "oat": 5.0,
        "rat": 22.0,
        "mat": 24.1
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 7200,
          "equals": true
        }
      ]
    },
    {
      "name": "summer_oat_above_rat",
      "description": "Cooling season with OAT above RAT: OAT 30 \u00b0C is now the high bound and MAT 34 \u00b0C sits 4 \u00b0C over it",
      "inputs": {
        "oat": 30.0,
        "rat": 24.0,
        "mat": 34.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 7200,
          "equals": true
        }
      ]
    },
    {
      "name": "low_excursion_is_not_this_fault",
      "description": "MAT 1 \u00b0C is 4 \u00b0C below the envelope \u2014 a real violation, but the low side belongs to AHU-0002",
      "inputs": {
        "oat": 5.0,
        "rat": 22.0,
        "mat": 1.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 7200,
          "equals": false
        }
      ]
    },
    {
      "name": "transient_excursion_never_alarms",
      "description": "MAT rises above the bound for 1200 s (< alarm_delay) during a damper stroke and recovers; the timer resets unfired",
      "inputs": {
        "oat": 5.0,
        "rat": 22.0,
        "mat": [
          {
            "t": 0,
            "value": 18.0
          },
          {
            "t": 900,
            "value": 28.0
          },
          {
            "t": 2100,
            "value": 18.0
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 7200,
          "equals": false
        }
      ]
    },
    {
      "name": "fault_clears_on_recovery",
      "description": "Sustained high excursion alarms at 1800 s; recalibration at 3600 s drops the alarm on the same tick",
      "inputs": {
        "oat": 5.0,
        "rat": 22.0,
        "mat": [
          {
            "t": 0,
            "value": 28.0
          },
          {
            "t": 3600,
            "value": 18.0
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 3300,
          "equals": true
        },
        {
          "output": "yFault",
          "from_s": 3900,
          "to_s": 7200,
          "equals": false
        }
      ]
    }
  ]
}

AHU-0004 — Excessive operating state changes per hour

Preconditions (host-enforced): The host must report NO_EVAL for the first count_window (1 h) after engine start: while the moving average’s window fills, its divisor is elapsed time, so the output is an extrapolated rate rather than a completed-hour count. delayOnInit = true on persist already blocks any assertion before 3600 s, so the two windows coincide. The operating_state encoding must be stable for the life of the deployment — re-mapping the enum mid-stream registers as a transition on every point that moved. Operator activity is not a fault: periods of commissioning, manual mode forcing, or scheduled occupancy testing must be excluded host-side, since every deliberate mode change counts the same as an oscillation. When any gate is unmet the verdict is NO_EVAL, not healthy.

Points: operating_state

Outputs:

• yFault — True while the number of operating-state transitions in the trailing count_window has stayed above os_max for at least alarm_delay

Parameters:

Description

The sequence cannot decide what it is doing. An AHU walking between heating, cooling, economizer, and off more than a few times an hour is not following load — load does not move that fast — it is chasing a changeover threshold with nothing to hold it on one side. Valves and dampers stroke, control loops restart from a new setpoint and overshoot, and air conditioned one way is conditioned the other way minutes later. The cause is nearly always a missing or undersized deadband, in the changeover logic or in the zone demand aggregation feeding it; a close second is upstream sensor noise crossing a threshold every few minutes with the sequencing logic working as written. A member fault of CLU-01 (Simultaneous Heating & Cooling).

Detection Logic

pulse  = (operating_state ≠ previous tick's operating_state)   one tick wide
count  = MovingAverage(pulse, count_window) × count_scale       transitions in the trailing hour
yFault = count > os_max, sustained continuously for alarm_delay

Block graph (rule.cxf.jsonld):

Reals.MovingAverage is a continuous-time integral mean: it accumulates u·dt and divides by the window, so a one-tick pulse of height 1.0 encloses one tick interval of area and n transitions in the trailing hour give rate = n · dt / count_window. count_scale = count_window / dt = 3600/300 = 12 recovers n, which couples the parameter to the host’s tick interval — the one thing about this rule that can be got wrong silently (see Deviations). Only whether the state moved is consumed; chg.up and chg.down are declared and left unconnected, since the destination state says nothing about oscillation. The threshold is strict, so exactly seven transitions an hour reads clear and eight alarms; the arithmetic is exact at that boundary in IEEE-754, not approximately exact. persist then requires the count to stay above os_max for a full hour, so roughly two hours of genuine thrashing elapse before anything is reported, and any interruption restarts the timer.

Possible Diagnoses

1. Deadband between modes too narrow — the sequence flips back as soon as it has finished acting, because the condition that ended the last mode is the condition that starts the next one
2. Fluctuating zone demands near a changeover threshold — the aggregated demand signal sits on the boundary and the unit follows every wobble in it
3. Sensor noise causing mode oscillation — one intermittent or poorly located sensor crosses the threshold repeatedly and the sequencing logic faithfully obeys

Energy Impact

COMFORT_ENERGY, LOW confidence, QUALITATIVE_ONLY. The rule sees a state index and nothing else, so it cannot say what any transition cost. The reference puts the loss at 1–3% of AHU energy, split between actuator wear and the transitions themselves, where a coil is charged and then abandoned before the air stream has settled. Confidence is LOW because no controlled study isolates cycling losses from the deadband change that fixes them and no PNNL measure covers sequencing stability. Climate-neutral. Size the opportunity per Energy Impact Reference §4.4 (unstable hours × AHU coil and fan power); this rule contributes the hours.

Emissions Impact

Scope 1 + 2, QUALITATIVE_EMISSIONS, LOW confidence; on the order of 5–15 kg CO₂e/yr from cycling losses. Both scopes appear because the transitions being counted cross between them — gas at the boiler and electricity at the chiller for the same hour of indecision. The magnitude is small enough that the number is an order of magnitude, not an estimate. Avoided-emissions basis: N/A.

Deviations

• The reference card names no points; operating_state is our choice. Its chapter 9 card has no Required Points table, only the logic and tunables. Only transitions are consumed and no value is ever interpreted, so any stable enumeration binds; the dictionary recommends the G36 §5.16.14 OS#1–OS#5 index and requires only that the encoding not change under the rule’s feet.
• Rolling count built from a moving average, because the block set has no windowed counter. Integers.OnCounter counts monotonically from a reset and has no window, so it would need a host-driven hourly reset — turning the rolling count into a tumbling one whose verdict depends on where the hour boundary fell.
• count_scale is coupled to the host’s tick interval. k = count_window / dt; the default 12.0 is correct only at a 300 s tick. A host ticking every 60 s must set 60.0, and leaving 12.0 reports a fifth of the true count so the rule never fires. Same family of deployment constraint as AHU-0022’s minimum sample interval, but this one fails quietly: a mis-set scale produces a plausible-looking number.
• Minimum tick interval, from the same block. Each MovingAverage keeps a fixed 64-checkpoint ring and silently drops the oldest in-window sample past that. A window spanning n ticks retains n + 1 checkpoints, so it may span at most 63 ticks: dt ≥ count_window/63 = 57.15 s, and a legal deployment has count_scale = 3600/dt ≤ 63. At the default 300 s tick the window holds 12 samples.
• Startup artifact (a): the first-tick pulse is inert. Integers.Change compares against pre_u_start on the first tick, so a unit loading in OS#3 registers a change at t = 0. It encloses no area because dt is zero there, so it never reaches the count. chg.pre_u_start is written explicitly as 0 rather than left to the engine default (also 0) and is not exposed as a card parameter, since nothing it can do survives tick 0.
• Startup artifact (b): the first hour reads as a rate, not a count. While t < count_window the moving average divides by elapsed time, so two changes in the first ten minutes read as 12/hr — the pace, extrapolated. Defensible, but not the reference’s completed-hour count. delayOnInit = true blocks any assertion before 3600 s and the frontmatter precondition requires the host to report NO_EVAL over the same hour, so the artifact cannot reach a verdict.
• The counting window is half-open. rate compares the accumulated integral now against its value one count_window ago, so a transition exactly count_window old has just left the window. The reference is silent; it matters only right at the threshold, and it errs toward silence.
• alarm_delay equals count_window. Both come from the reference (60 min AlarmDelay, per-hour count), but the interaction is worth stating: the count must hold above os_max for a full hour after first crossing it, so a burst that ends inside that hour never reports.
• related adds AHU-0022. The reference lists AHU-0016 only; AHU-0022 (SAT hunting) already names this fault from its side, so the link is made reciprocal.
• Severity 3 (warning) and method rule, per the reference’s chapter 9 card; its §5.8.1 index carries no severity column. Operating states OS 1–5 are declared, not gated — the reference marks the fault applicable in every state.
• persist.delayOnInit = true (Modelica/CDL default is false), the library’s standing choice: a count already above os_max at load waits out the full hour instead of alarming on the first tick after a controller restart.

Notes

The fix is a deadband, and it is remote and free. Step 2.1 of the simultaneous-hc playbook gives the numbers for the heating/cooling case — G36 §5.16’s 2.8 °C (5 °F) minimum — and the same reasoning applies to whatever pair of states this unit oscillates between: the condition that leaves a mode must not be the condition that re-enters it. Confirm first that the demand signal is not itself the problem (diagnosis 3). This rule and AHU-0022 are the same pathology at two altitudes, and both tripping together is the strongest evidence for that diagnosis.

Test Vectors

9 scenarios, clock step 300 s over 14400 s.

{
  "schema": "cxf-library/vectors/v1",
  "clock": {
    "step_s": 300,
    "horizon_s": 14400
  },
  "scenarios": [
    {
      "name": "stable_state",
      "description": "The unit holds one operating state for the whole run. operating_state equals chg.pre_u_start, so Integers.Change never pulses and the rolling count sits at zero \u2014 the baseline every other scenario departs from",
      "inputs": {
        "operating_state": 0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 14400,
          "equals": false
        }
      ]
    },
    {
      "name": "startup_pulse_is_inert",
      "description": "Startup artifact (a): operating_state is a constant 3, which differs from chg.pre_u_start (0), so Integers.Change emits a spurious pulse on tick 0. It costs nothing \u2014 MovingAverage integrates u\u00b7dt and dt is zero on the first tick, so the pulse encloses no area and count stays at 0.0 for the whole run",
      "inputs": {
        "operating_state": 3
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 14400,
          "equals": false
        }
      ]
    },
    {
      "name": "four_transitions_per_hour",
      "description": "The sequence walks OS 1\u21922\u21923\u21924\u21925\u21921 every 900 s: four transitions an hour, ordinary for a unit tracking load across a day. count holds at 4.0, and the warm-up window agrees rather than overshooting \u2014 one change in the first 900 s extrapolates to the same 4/hr pace",
      "inputs": {
        "operating_state": [
          {
            "t": 0,
            "value": 1
          },
          {
            "t": 900,
            "value": 2
          },
          {
            "t": 1800,
            "value": 3
          },
          {
            "t": 2700,
            "value": 4
          },
          {
            "t": 3600,
            "value": 5
          },
          {
            "t": 4500,
            "value": 1
          },
          {
            "t": 5400,
            "value": 2
          },
          {
            "t": 6300,
            "value": 3
          },
          {
            "t": 7200,
            "value": 4
          },
          {
            "t": 8100,
            "value": 5
          },
          {
            "t": 9000,
            "value": 1
          },
          {
            "t": 9900,
            "value": 2
          },
          {
            "t": 10800,
            "value": 3
          },
          {
            "t": 11700,
            "value": 4
          },
          {
            "t": 12600,
            "value": 5
          },
          {
            "t": 13500,
            "value": 1
          },
          {
            "t": 14400,
            "value": 2
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 14400,
          "equals": false
        }
      ]
    },
    {
      "name": "sustained_thrash",
      "description": "operating_state alternates every tick \u2014 12 transitions an hour, the signature of a changeover threshold with no deadband. count reads 12 from the first pulse (during the first hour that is an extrapolated pace, and here the pace is the truth), cntHigh latches at t=300, and yFault follows one alarm_delay later at t=3900, the earliest instant this rule can assert",
      "inputs": {
        "operating_state": [
          {
            "t": 0,
            "value": 1
          },
          {
            "t": 300,
            "value": 2
          },
          {
            "t": 600,
            "value": 1
          },
          {
            "t": 900,
            "value": 2
          },
          {
            "t": 1200,
            "value": 1
          },
          {
            "t": 1500,
            "value": 2
          },
          {
            "t": 1800,
            "value": 1
          },
          {
            "t": 2100,
            "value": 2
          },
          {
            "t": 2400,
            "value": 1
          },
          {
            "t": 2700,
            "value": 2
          },
          {
            "t": 3000,
            "value": 1
          },
          {
            "t": 3300,
            "value": 2
          },
          {
            "t": 3600,
            "value": 1
          },
          {
            "t": 3900,
            "value": 2
          },
          {
            "t": 4200,
            "value": 1
          },
          {
            "t": 4500,
            "value": 2
          },
          {
            "t": 4800,
            "value": 1
          },
          {
            "t": 5100,
            "value": 2
          },
          {
            "t": 5400,
            "value": 1
          },
          {
            "t": 5700,
            "value": 2
          },
          {
            "t": 6000,
            "value": 1
          },
          {
            "t": 6300,
            "value": 2
          },
          {
            "t": 6600,
            "value": 1
          },
          {
            "t": 6900,
            "value": 2
          },
          {
            "t": 7200,
            "value": 1
          },
          {
            "t": 7500,
            "value": 2
          },
          {
            "t": 7800,
            "value": 1
          },
          {
            "t": 8100,
            "value": 2
          },
          {
            "t": 8400,
            "value": 1
          },
          {
            "t": 8700,
            "value": 2
          },
          {
            "t": 9000,
            "value": 1
          },
          {
            "t": 9300,
            "value": 2
          },
          {
            "t": 9600,
            "value": 1
          },
          {
            "t": 9900,
            "value": 2
          },
          {
            "t": 10200,
            "value": 1
          },
          {
            "t": 10500,
            "value": 2
          },
          {
            "t": 10800,
            "value": 1
          },
          {
            "t": 11100,
            "value": 2
          },
          {
            "t": 11400,
            "value": 1
          },
          {
            "t": 11700,
            "value": 2
          },
          {
            "t": 12000,
            "value": 1
          },
          {
            "t": 12300,
            "value": 2
          },
          {
            "t": 12600,
            "value": 1
          },
          {
            "t": 12900,
            "value": 2
          },
          {
            "t": 13200,
            "value": 1
          },
          {
            "t": 13500,
            "value": 2
          },
          {
            "t": 13800,
            "value": 1
          },
          {
            "t": 14100,
            "value": 2
          },
          {
            "t": 14400,
            "value": 1
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 3600,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 4200,
          "to_s": 14400,
          "equals": true
        }
      ]
    },
    {
      "name": "seven_per_hour_stays_clear",
      "description": "Boundary, low side. The unit is quiet for the first hour, then transitions seven times an hour indefinitely \u2014 seven changes per twelve ticks, so every trailing-hour window holds exactly seven. count lands on exactly 7.0 (12.0 \u00d7 7 \u00d7 300 / 3600 is exact in IEEE-754) and os_max is a strict `>`, so seven transitions an hour stays clear",
      "inputs": {
        "operating_state": [
          {
            "t": 0,
            "value": 1
          },
          {
            "t": 3900,
            "value": 2
          },
          {
            "t": 4200,
            "value": 1
          },
          {
            "t": 4500,
            "value": 2
          },
          {
            "t": 4800,
            "value": 1
          },
          {
            "t": 5100,
            "value": 2
          },
          {
            "t": 5400,
            "value": 1
          },
          {
            "t": 5700,
            "value": 2
          },
          {
            "t": 7500,
            "value": 1
          },
          {
            "t": 7800,
            "value": 2
          },
          {
            "t": 8100,
            "value": 1
          },
          {
            "t": 8400,
            "value": 2
          },
          {
            "t": 8700,
            "value": 1
          },
          {
            "t": 9000,
            "value": 2
          },
          {
            "t": 9300,
            "value": 1
          },
          {
            "t": 11100,
            "value": 2
          },
          {
            "t": 11400,
            "value": 1
          },
          {
            "t": 11700,
            "value": 2
          },
          {
            "t": 12000,
            "value": 1
          },
          {
            "t": 12300,
            "value": 2
          },
          {
            "t": 12600,
            "value": 1
          },
          {
            "t": 12900,
            "value": 2
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 14400,
          "equals": false
        }
      ]
    },
    {
      "name": "eight_per_hour_trips",
      "description": "Boundary, high side. The same shape with eight transitions an hour. The eighth pulse enters the trailing window at t=6000, count steps to 8.0, and yFault asserts one alarm_delay later at t=9600",
      "inputs": {
        "operating_state": [
          {
            "t": 0,
            "value": 1
          },
          {
            "t": 3900,
            "value": 2
          },
          {
            "t": 4200,
            "value": 1
          },
          {
            "t": 4500,
            "value": 2
          },
          {
            "t": 4800,
            "value": 1
          },
          {
            "t": 5100,
            "value": 2
          },
          {
            "t": 5400,
            "value": 1
          },
          {
            "t": 5700,
            "value": 2
          },
          {
            "t": 6000,
            "value": 1
          },
          {
            "t": 7500,
            "value": 2
          },
          {
            "t": 7800,
            "value": 1
          },
          {
            "t": 8100,
            "value": 2
          },
          {
            "t": 8400,
            "value": 1
          },
          {
            "t": 8700,
            "value": 2
          },
          {
            "t": 9000,
            "value": 1
          },
          {
            "t": 9300,
            "value": 2
          },
          {
            "t": 9600,
            "value": 1
          },
          {
            "t": 11100,
            "value": 2
          },
          {
            "t": 11400,
            "value": 1
          },
          {
            "t": 11700,
            "value": 2
          },
          {
            "t": 12000,
            "value": 1
          },
          {
            "t": 12300,
            "value": 2
          },
          {
            "t": 12600,
            "value": 1
          },
          {
            "t": 12900,
            "value": 2
          },
          {
            "t": 13200,
            "value": 1
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 9300,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 9900,
          "to_s": 14400,
          "equals": true
        }
      ]
    },
    {
      "name": "thrash_stops_before_delay",
      "description": "Transient: ten transitions between t=3900 and t=6600, then the sequence settles. count crosses 7 at t=6000, but the burst is already over and the count decays as pulses age out, reaching 7.0 at t=8100. cntHigh held for 1800 s \u2014 half the alarm_delay \u2014 so nothing asserts",
      "inputs": {
        "operating_state": [
          {
            "t": 0,
            "value": 1
          },
          {
            "t": 3900,
            "value": 2
          },
          {
            "t": 4200,
            "value": 1
          },
          {
            "t": 4500,
            "value": 2
          },
          {
            "t": 4800,
            "value": 1
          },
          {
            "t": 5100,
            "value": 2
          },
          {
            "t": 5400,
            "value": 1
          },
          {
            "t": 5700,
            "value": 2
          },
          {
            "t": 6000,
            "value": 1
          },
          {
            "t": 6300,
            "value": 2
          },
          {
            "t": 6600,
            "value": 1
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 14400,
          "equals": false
        }
      ]
    },
    {
      "name": "burst_ages_out_of_window",
      "description": "A two-hour thrash (t=3900 to t=10800) is long enough: count crosses at t=6000 and yFault asserts at t=9600. When the thrash stops the count does not drop at once \u2014 it decays as pulses leave the trailing hour, reaching 7.0 at t=12300, and the alarm clears on that tick because TrueDelay has no off-delay",
      "inputs": {
        "operating_state": [
          {
            "t": 0,
            "value": 1
          },
          {
            "t": 3900,
            "value": 2
          },
          {
            "t": 4200,
            "value": 1
          },
          {
            "t": 4500,
            "value": 2
          },
          {
            "t": 4800,
            "value": 1
          },
          {
            "t": 5100,
            "value": 2
          },
          {
            "t": 5400,
            "value": 1
          },
          {
            "t": 5700,
            "value": 2
          },
          {
            "t": 6000,
            "value": 1
          },
          {
            "t": 6300,
            "value": 2
          },
          {
            "t": 6600,
            "value": 1
          },
          {
            "t": 6900,
            "value": 2
          },
          {
            "t": 7200,
            "value": 1
          },
          {
            "t": 7500,
            "value": 2
          },
          {
            "t": 7800,
            "value": 1
          },
          {
            "t": 8100,
            "value": 2
          },
          {
            "t": 8400,
            "value": 1
          },
          {
            "t": 8700,
            "value": 2
          },
          {
            "t": 9000,
            "value": 1
          },
          {
            "t": 9300,
            "value": 2
          },
          {
            "t": 9600,
            "value": 1
          },
          {
            "t": 9900,
            "value": 2
          },
          {
            "t": 10200,
            "value": 1
          },
          {
            "t": 10500,
            "value": 2
          },
          {
            "t": 10800,
            "value": 1
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 9300,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 9900,
          "to_s": 11700,
          "equals": true
        },
        {
          "output": "yFault",
          "from_s": 12600,
          "to_s": 14400,
          "equals": false
        }
      ]
    },
    {
      "name": "warmup_rate_never_asserts",
      "description": "Startup artifact (b): two transitions inside the first 10 minutes read as a 12/hr pace, because the growing-window divisor is elapsed time rather than count_window. cntHigh is true from t=300 to t=900, then the pace collapses as the window fills \u2014 count is 6.0 at t=1200 and 2.0 by the end of the hour. delayOnInit keeps yFault false throughout, which is the reason the frontmatter puts the first count_window under host NO_EVAL",
      "inputs": {
        "operating_state": [
          {
            "t": 0,
            "value": 1
          },
          {
            "t": 300,
            "value": 2
          },
          {
            "t": 600,
            "value": 1
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 14400,
          "equals": false
        }
      ]
    }
  ]
}

AHU-0005 — SAT too low vs MAT in heating

Preconditions (host-enforced): The unit must have a MAT sensor; G36 omits FC#5 where there is none. Evaluate only in OS#1, whose actuator signature per G36 Table 5.16.14.2 is heating coil > 0, cooling coil = 0, OA damper at minimum position — outside it a SAT below MAT is the intended result of cooling, not a fault. Supply fan running, since neither MAT nor SAT means anything in still air. Suspend evaluation for ModeDelay (30 min) after any operating-state change, while the coils and damper are still stroking and the sensors still report the previous state’s mixture. Silence this rule while AHU-0028 is active: MAT is an input here and FC-062 is its integrity gate. When any gate is unmet the verdict is NO_EVAL, not healthy.

Points: mat, sat

Outputs:

• yFault — True while SAT has stayed more than mat_sat_gap_threshold below MAT for at least alarm_delay

Parameters:

Description

In heating, air leaves the unit warmer than it arrived: it crosses the supply fan, which adds about a degree of shaft work, and then a heating coil the sequence has called for. SAT sitting several degrees below MAT under those conditions is not a control error — something in the unit is taking heat back out. A cooling coil valve leaking or stuck open, a DX circuit stuck on, or a sensor pair that disagrees by more than either instrument is rated for.

This is G36 §5.16.14 FC#5, applicable in OS#1 (heating) only; elsewhere a SAT below MAT is what the sequence asked for. The leaking-cooling-coil diagnosis is simultaneous heating and cooling seen from the air side, which is why the fault sits in CLU-01 behind AHU-0016: FC-050 catches two valve commands overlapping, this rule catches one device passing water or refrigerant with no command raised.

Detection Logic

gap    = mat − sat
yFault = gap > mat_sat_gap_threshold,
         sustained continuously for alarm_delay

Block graph (rule.cxf.jsonld):

The threshold is G36’s SAT_AVG + eSAT <= MAT_AVG − eMAT + dTSF rearranged so one positive number carries the whole allowance (see Deviations). It is not a sensor tolerance: it is the two sensor bands minus the fan rise the air gets for free, so the rule fires on heat removal that neither instrument error nor the fan can explain. The comparison is strict, so a gap sitting exactly on 3.0 °C reads healthy where G36’s <= would call it a fault. persist requires 30 minutes of continuous violation — enough to ride out a mode change, a hot-water loop coming up to temperature, or a valve stroking through its span — and any interruption restarts the timer.

Nothing about the size of the heating call reaches this rule. A unit whose heating coil does nothing at all still shows SAT about a fan rise above MAT, so the gap runs slightly negative and this rule reads healthy; that failure belongs to the inactive-coil rules.

Possible Diagnoses

G36 §5.16.14 FC#5, transcribed:

1. SAT sensor error
2. MAT sensor error
3. Cooling coil valve leaking or stuck open
4. Heating coil valve stuck closed or actuator failure
5. Fouled or undersized heating coil
6. HW temperature too low or HW unavailable
7. Gas or electric heat unavailable
8. DX cooling stuck on

Read the list as two groups. Either the sensors are lying (1, 2), or a heat sink is running against the heating call (3, 8) — and a dead coil behind it (4–7) makes the gap wide enough to clear the threshold sooner. Diagnoses 4 through 7 explain a missing rise on their own, but not a rise of the wrong sign, so they reach this rule only in company.

Energy Impact

EXCESS_CONSUMPTION, MEDIUM confidence, PROXY_ESTIMATION, all three from the reference’s §5.8.1 index row. The waste is a cancellation: the heating source pays to warm air and a leaking cooling coil or stuck DX circuit immediately unpays it, so both sides bill.

waste_kw >= supply_airflow_m3s × 1.2 × 1.005 × ((mat + dTSF) − sat)

A floor, not an equality — it credits the heating coil with no rise at all, and design airflow stands in for a measured one. The index puts the recoverable range at 1–4% of site energy against PNNL-25985 EEM-05 (supply air temperature reset), the nearest catalog measure rather than a study of this failure, so treat it as an order-of-magnitude bound. Heating-dominant: the rule is only evaluable in OS#1, so its hours are heating hours.

Emissions Impact

PROXY_EMISSIONS, MEDIUM confidence. Scope 1+2 because the two halves of the exchange run at once and land in different inventories: hot water from a gas boiler or furnace section is Scope 1, electric resistance or a heat pump is Scope 2, and the cooling side eating the heat is Scope 2 in nearly every building. Avoided-emissions basis: marginal operating emissions rate (MOER) for the electric half, static combustion factor for the fuel half.

Deviations

• The reference card is abbreviated; G36 is the normative source. HVAC FDD Reference v1.0 carries AHU-0005 as a §5.8.1 index row only — no equation, tunables, diagnoses, operating-state applicability, or severity. Detection Logic and Possible Diagnoses are transcribed from ASHRAE Guideline 36 §5.16.14 FC#5 as it appears in Addendum u to Guideline 36-2018 (first public review, 2021), with the Table 5.16.14.5 defaults (NISTIR 7365 provenance, which the addendum notes are biased toward minimizing false alarms).
• Severity 3 is the library’s. No reference card states one and the §5.8.1 index carries no severity column; the value matches this chapter’s scaffold row and every other G36 comparison rule here.
• The energy profile is the index row’s; the emissions split is the library’s. category, confidence, estimation_method, and savings_range are copied from §5.8.1. The index has no emissions column, so scope: 1+2 follows AHU-0016’s convention for simultaneous heating-and-cooling waste (matching mirror card AHU-0012), and the runtime formula is mirrored from AHU-0016’s waste term.
• Combined-epsilon threshold. MAT − SAT >= eSAT + eMAT − dTSF binds one positive threshold to one CXF path: 1 + 3 − 1 = 3.0 °C at the Table 5.16.14.5 defaults. A site that retunes any input recomputes the sum rather than the parameter — a measured 2 K fan rise drops the threshold to 2.0 °C, a looser eMAT of 4 K for a poorly mixed plenum raises it to 4.0 °C. Same rearrangement as AHU-0028 and AHU-0001.
• G36’s <= becomes a strict >. CDL Reals offers no greater-or-equal comparison; the disagreement has measure zero on a real temperature pair and errs toward silence.
• Instantaneous samples instead of averaged signals. G36 computes every signal as a five-minute rolling average of one-minute samples; this rule compares raw samples and leans on the 30-minute persist delay. The two are not equivalent — averaging tolerates a signal that keeps crossing back while its mean stays outside the band, whereas persistence resets on every compliant tick, so an oscillating gap can hide indefinitely. A steady offset, which is what a leaking valve or drifted sensor produces, reads the same either way. Same note as AHU-0002.
• Operating-state applicability and ModeDelay are frontmatter, not graph. G36 scopes FC#5 to OS#1 and suspends every fault condition for 30 minutes after a mode change; both are host concerns under this library’s stance (precedent AHU-0029), and a verdict outside OS#1 or inside the transition window is NO_EVAL, never healthy. The OS#1 signature the host gates on is G36 Table 5.16.14.2’s: heating coil > 0, cooling coil = 0, OA damper at minimum.
• Suppression is declared, not encoded. MAT is an input, so AHU-0028 — the mixing-box integrity gate — silences this rule while active. The engine is status-blind, so it lives in suppressed_by for the host to enforce.
• persist.delayOnInit = true (Modelica/CDL default is false), the library’s standing choice: a gap already present at load waits out the full 30 minutes rather than alarming on the first tick after a controller restart.

Notes

This rule and AHU-0007 are the two G36 heating-side SAT tests, and they fail differently on purpose: FC-007 says the unit cannot make the air it was asked for, this one says the unit is making air colder than it found it. A fouled coil or dead boiler trips FC-007 alone; a leaking cooling valve trips both, which points at diagnosis 3 or 8 before anything else. Order of work: confirm MAT first — AHU-0028 runs a shorter delay and suppresses this rule — then take the leaking-valve half of the list to the simultaneous-hc playbook.

Test Vectors

10 scenarios, clock step 300 s over 5400 s.

{
  "schema": "cxf-library/vectors/v1",
  "clock": {
    "step_s": 300,
    "horizon_s": 5400
  },
  "scenarios": [
    {
      "name": "heating_air_leaves_warmer_than_it_arrived",
      "description": "Healthy OS#1 operation: 15 \u00b0C mixed air leaves at 25 \u00b0C after the fan and an active heating coil. The gap runs negative, which no `>` against a positive threshold can satisfy",
      "inputs": {
        "mat": 15.0,
        "sat": 25.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "sensor_spread_absorbed_by_threshold",
      "description": "SAT reads 2 \u00b0C below MAT \u2014 inside the combined eSAT + eMAT \u2212 dTSF band, so a pair of sensors at their rated accuracy plus a fan that adds less rise than assumed cannot fire the rule",
      "inputs": {
        "mat": 20.0,
        "sat": 18.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "cooling_coil_leaking_through_heating",
      "description": "SAT 6 \u00b0C below MAT while the unit is in heating: a leaking or stuck-open cooling coil valve is stripping more heat than the fan and heating coil put in. Alarms one alarm_delay (1800 s) after the condition appears",
      "inputs": {
        "mat": 20.0,
        "sat": 14.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 5400,
          "equals": true
        }
      ]
    },
    {
      "name": "dx_stuck_on_deep_gap",
      "description": "SAT 10 \u00b0C below MAT \u2014 DX cooling stuck on against a heating call. Same verdict as a leaking valve; the rule reports the contradiction, not which device caused it",
      "inputs": {
        "mat": 18.0,
        "sat": 8.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 5400,
          "equals": true
        }
      ]
    },
    {
      "name": "gap_exactly_at_threshold",
      "description": "Threshold edge: mat \u2212 sat = 3.0 \u00b0C exactly. `gapBig` is a strict `>`, so a gap sitting precisely on mat_sat_gap_threshold reads healthy \u2014 G36's `<=` would call this a fault",
      "inputs": {
        "mat": 20.0,
        "sat": 17.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "gap_just_over_threshold",
      "description": "Threshold edge, other side: mat \u2212 sat = 3.1 \u00b0C clears the strict comparison and alarms after alarm_delay",
      "inputs": {
        "mat": 20.0,
        "sat": 16.9
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 5400,
          "equals": true
        }
      ]
    },
    {
      "name": "no_temperature_rise_is_not_this_fault",
      "description": "SAT equals MAT \u2014 the heating coil is contributing nothing, which is a real problem and not this one. The gap is zero, so this rule stays silent and the finding belongs to the inactive-coil rules",
      "inputs": {
        "mat": 18.0,
        "sat": 18.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "transient_gap_clears_before_delay",
      "description": "Transient: a 6 \u00b0C gap opens at load and closes at t = 1200 s as the hot-water loop comes up to temperature. Twenty minutes is short of alarm_delay, so nothing alarms",
      "inputs": {
        "mat": 20.0,
        "sat": [
          {
            "t": 0,
            "value": 14.0
          },
          {
            "t": 1200,
            "value": 22.0
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "oscillating_gap_never_persists",
      "description": "Honesty case for the instantaneous-sampling deviation: SAT alternates every 600 s between 6 \u00b0C below MAT and 2 \u00b0C above it. The mean sits outside the band, so G36's 5-minute rolling average would fault; persistence resets on every compliant tick and this rule never does",
      "inputs": {
        "mat": 20.0,
        "sat": [
          {
            "t": 0,
            "value": 14.0
          },
          {
            "t": 600,
            "value": 22.0
          },
          {
            "t": 1200,
            "value": 14.0
          },
          {
            "t": 1800,
            "value": 22.0
          },
          {
            "t": 2400,
            "value": 14.0
          },
          {
            "t": 3000,
            "value": 22.0
          },
          {
            "t": 3600,
            "value": 14.0
          },
          {
            "t": 4200,
            "value": 22.0
          },
          {
            "t": 4800,
            "value": 14.0
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "fault_clears_on_recovery",
      "description": "A sustained 6 \u00b0C gap alarms at 1800 s; the leaking cooling valve is isolated at t = 3000 s and SAT climbs above MAT, dropping the alarm on that tick \u2014 TrueDelay has no off-delay",
      "inputs": {
        "mat": 20.0,
        "sat": [
          {
            "t": 0,
            "value": 14.0
          },
          {
            "t": 3000,
            "value": 22.0
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 2700,
          "equals": true
        },
        {
          "output": "yFault",
          "from_s": 3300,
          "to_s": 5400,
          "equals": false
        }
      ]
    }
  ]
}

AHU-0006 — OA fraction deviation

Preconditions (host-enforced): Supply fan running, and the unit in one of the two minimum-OA operating states G36 defines by actuator signature: OS#1 (HC > 0, CC = 0, OA damper at minimum) or OS#4 (HC = 0, CC > 0, OA damper at minimum). The rule must not be evaluated in OS#2 or OS#3, where the outdoor-air fraction is supposed to exceed the minimum — economizing looks identical to a stuck damper from these three temperatures — nor in OS#5, where no damper position is defined at all. Suspend evaluation for ModeDelay (30 min) after any mode or operating-state change in a zone group the AHU serves, while the dampers are still stroking and the mixing box has not settled. Silence the rule while AHU-0028 is active: the fraction is a ratio of temperature differences, so a MAT outside the OAT/RAT envelope moves it directly. min_oa_fraction must be retuned to track the active minimum-OA setpoint whenever the ventilation reset moves it (see Deviations). The temperature-difference conjunct is signalled in-rule by yTempDeltaOk; when it is false the verdict is NO_EVAL, not healthy, and the same is true whenever any of the gates above is unmet. Additionally suspend evaluation (NO_EVAL) while demand-controlled ventilation or a ventilation-demand override holds outdoor-air flow above the minimum-OA state — at VAV turndown a constant ventilation flow becomes a large OA fraction and this rule fires on healthy operation (fleet-validated FP mechanism; see the validation block).

Points: mat, rat, oat

Outputs:

• yFault — True while the outdoor air fraction has stayed further than oa_fraction_tolerance from min_oa_fraction, in either direction, for at least alarm_delay, with the outdoor-to-return temperature difference large enough to evaluate
• yTempDeltaOk — Evaluability signal — true when |rat − oat| exceeds delta_min (G36’s dTMIN conjunct); false means NO_EVAL and the host must ignore yFault

Parameters:

Description

The unit should be sitting at its minimum outdoor-air setpoint, and the mixing-box energy balance says it is not. Too much outdoor air costs money: every extra cubic metre is heated or cooled to supply temperature for no ventilation benefit. Too little has no energy signature at all — the building is under-ventilated, an indoor-air-quality finding rather than a waste one. G36 tests both directions with one absolute value, so this rule alarms on either.

This is G36 §5.16.14 FC#6, evaluated in the two operating states where the damper is supposed to be at minimum — OS#1 (heating) and OS#4 (mechanical cooling on minimum outdoor air). In OS#2 and OS#3 the damper is opening deliberately and the same three temperatures would read as a fault, so the host gate matters more here than the equation does. The fraction is inferred from three temperatures rather than measured, which is what makes the diagnostic cheap and what makes it conditional: when outdoor and return air are close, the quotient’s denominator collapses and sensor error becomes an arbitrary answer.

Detection Logic

oaf          = (mat − rat) / (oat − rat)                      (G36 %OA)
yTempDeltaOk = |rat − oat| > delta_min                        (false ⇒ host reports NO_EVAL)
yFault       = (|oaf − min_oa_fraction| > oa_fraction_tolerance) AND yTempDeltaOk,
               sustained for alarm_delay

Block graph (rule.cxf.jsonld):

minConst holds %OAmin in a Reals.Sources.Constant rather than folded into the threshold, so min_oa_fraction and oa_fraction_tolerance stay independent single-value set_param paths — which matters here because the setpoint is the parameter a host is expected to move at runtime.

The dTMIN branch goes to two places: into gate as G36’s second conjunct, and out of the block as yTempDeltaOk. A host that ignores the output still gets the right verdict; a host that reads it learns the difference between “not faulted” and “cannot tell”. That arrangement is also what makes the division safe. CDL Divide follows IEEE-754, so oat = rat yields ±∞ or NaN rather than an error, and a near-zero denominator inflates sensor noise into a fraction of any magnitude. NaN compares false everywhere and can never raise devBig; ±∞ and a noise-inflated finite fraction both can, and gate stops them, because a denominator small enough to misbehave is by construction below delta_min. Garbage arithmetic cannot assert a fault — only report the rule unevaluable.

Both comparisons are strict. The fraction is signed consistently across the year (winter, both differences negative; summer, both positive), so no seasonal branch is needed. persist requires 30 continuous minutes and any interruption restarts the timer; recovery is immediate on the tick the deviation falls back inside tolerance.

Possible Diagnoses

Transcribed from G36 §5.16.14 FC#6:

1. RAT sensor error
2. MAT sensor error
3. OAT sensor error
4. Leaking or stuck economizer damper or actuator

Three of the four are sensor errors, and the reason is arithmetic: a 1 °C bias in MAT moves the apparent outdoor air by 5 percentage points across a 20 °C outdoor-to-return spread, and by 17 points on a spread sitting at dTMIN. A sensor within its rated accuracy can account for most of a deviation this rule reports.

Energy Impact

EXCESS_CONSUMPTION, MEDIUM confidence, DIRECT_MEASUREMENT, savings 2–10% of the subsystem — the §5.8.1 index row, the only energy statement the reference makes here. The high branch is directly computable from live data, with the excess fraction already on the wire as dev.y:

excess_oa_kw = (oaf − min_oa_fraction) × supply_airflow_m3s × 1.2 × 1.005 × |oat − rat|

Payback lands in the upper half of the range in heating-dominant climates, where every extra cubic metre costs most. The index maps the fault to PNNL-25985 EEM-06 (OA damper faults) and EEM-17 (demand control ventilation). MEDIUM rather than AHU-0021’s HIGH on the same quotient, because a low-side alarm has no energy term at all — under-ventilating saves energy while failing the occupants, so a host must check the sign of dev.y before banking anything — and because three of the four diagnoses are sensor errors, which waste nothing.

Emissions Impact

Scope 1 + 2, PROXY_EMISSIONS, MEDIUM confidence. On the high branch the split follows the season, as for AHU-0021: excess outdoor air burns Scope 1 fuel at the heating coil in winter, draws Scope 2 electricity at the chiller in summer, and collapses to Scope 2 on an all-electric unit. The low branch has nothing to attribute. PROXY where the index says DIRECT because the fraction is measured but the mass flow it must be multiplied by is not — this rule is worth deploying precisely on units with three temperature sensors and no airflow station. Avoided-emissions basis: marginal operating emissions rate (MOER) for the electric half, static combustion factor for the fuel half.

Deviations

• The reference card is abbreviated; G36 is the normative text. The HVAC FDD Reference carries AHU-0006 only as a §5.8.1 index row — a name and an energy profile. Detection logic, internal-variable defaults, and the diagnosis list are transcribed from ASHRAE Guideline 36 §5.16.14 FC#6 as it appears in Addendum u to Guideline 36-2018 (First Public Review, 2021).
• %OAmin is a static parameter, not the active setpoint. G36 defines it as the active minimum-OA setpoint divided by actual total airflow, which a VAV system recomputes continuously; binding it as a constant (as AHU-0021 does) keeps this a three-temperature diagnostic instead of one needing a flow station or zone-flow rollup. Hosts should retune min_oa_fraction through set_param as the reset moves it: left static, an active setpoint above the design minimum makes a correctly ventilating unit read high and measures an under-ventilating one against too low a bar. G36’s defaults absorb up to 0.30 of fraction before either error surfaces.
• The low branch is nearly unreachable at G36’s defaults, and that is G36’s arithmetic. With %OAmin = 0.15 and eF = 0.30 the low-side alarm point is a fraction below −0.15, which no physical mixing box can produce — not even a fully shut damper delivering zero ventilation. It fires only when the inferred fraction goes negative (MAT outside the OAT/RAT interval, so a sensor is lying) or when a host has retuned min_oa_fraction above the tolerance. A real under-ventilation alarm at a 15% minimum needs oa_fraction_tolerance well below eF, and the false-alarm rate NISTIR 7365 chose eF to avoid.
• G36’s ≥ on the dTMIN conjunct becomes a strict >. FC#6 mixes inequalities (|RAT − OAT| ≥ dTMIN, |%OA − %OAmin| > eF) and CDL Reals offers only strict comparisons, so the deviation term transcribes exactly while a spread of exactly 6.000 °C is evaluable to G36 and unevaluable here. Measure zero on a real signal, and it errs toward silence on the one term whose purpose is to suppress meaningless verdicts.
• The high-side deviation boundary is not representable in binary. A nominal 0.45 fraction against a 0.15 setpoint and 0.30 tolerance computes one ulp above 0.30, so the rule alarms where decimal arithmetic says it should not; no double gives a deviation of exactly 0.30 on the high side. The low side is exact, because the double nearest 0.15 doubles exactly into the double nearest 0.30. Read nothing into a fraction sitting on the threshold, especially with coarsely quantized temperatures.
• Instantaneous samples instead of 5-minute rolling averages. G36 defines rolling averages for measured points and writes the dTMIN conjunct on them, but writes %OA on unsubscripted MAT, RAT, and OAT in the same clause; this library consumes instantaneous points and lets the 30-minute AlarmDelay stand in. Not equivalent — persistence resets on every compliant tick, so an oscillating deviation (a hunting damper) can hide indefinitely, while a stuck damper or drifted sensor reads the same either way. The gap is wider here than on a single-signal rule: averaging the three inputs and averaging the quotient give different numbers.
• Operating states and ModeDelay are host-side preconditions. G36 scopes FC#6 to OS#1 and OS#4 and suspends evaluation for ModeDelay (30 min) after a mode change in a served zone group; none of it is in the graph, per the library’s stance (precedent AHU-0029). The stakes are higher here than on most rules — a high outdoor-air fraction is the correct answer in OS#2 and OS#3, so a host that evaluates while the unit is economizing gets a sustained fault of its own making.
• Severity 3 is the library’s. No chapter card exists to state one and the §5.8.1 index carries no severity column. G36 §5.16.14 makes every reported fault condition a Level 3 alarm, but that is an alarm-priority scheme rather than this library’s 1–4 severity scale, so it corroborates without supplying.
• The energy profile is the index row’s; the emissions block and runtime formula are the library’s. category, confidence, estimation_method, savings_range, and the EEM mapping are copied from §5.8.1; scope 1+2 and PROXY_EMISSIONS follow AHU-0021’s reading of the same physics, and the formula is mirrored from AHU-0021 with the sign check added.
• persist.delayOnInit = true (Modelica/CDL default is false), the library’s standing choice: a deviation already present at load waits out the full 30 minutes instead of alarming on the first tick after a controller restart.

Notes

This rule and AHU-0021 measure the same quotient and are not redundant. AHU-0021 is a one-sided energy test with a 0.10 tolerance in any non-economizing occupied hour; AHU-0006 is G36’s symmetric test in the two minimum-OA states, and its contribution is the low branch — which at G36’s defaults catches a fraction gone negative, a sensor or mixing-box contradiction that AHU-0028 tests directly with a shorter delay. Expect the pair to fire together and read AHU-0028 first; a genuine under-ventilation alarm needs CO₂ or a measured outdoor-air flow. Check the minimum position setpoint before sending anyone to the roof — a minimum dialled up during a ventilation complaint is the most common high-side cause and a $0 desk fix, ahead of the economizer-failure playbook’s damper steps. If commanding the damper closed does not move the fraction, measure building pressure: an oversized exhaust fan reads the same as a stuck damper from these three points.

Test Vectors

16 scenarios, clock step 300 s over 5400 s.

{
  "schema": "cxf-library/vectors/v1",
  "clock": {
    "step_s": 300,
    "horizon_s": 5400
  },
  "scenarios": [
    {
      "name": "at_minimum_ventilation_setpoint",
      "description": "Winter minimum-OA operation: 2 \u00b0C outdoor air, 22 \u00b0C return, and a 19 \u00b0C mixture. The energy balance puts %OA at 0.15, exactly the setpoint, so the deviation is zero and the 20 \u00b0C spread makes the inference meaningful",
      "inputs": {
        "mat": 19.0,
        "rat": 22.0,
        "oat": 2.0
      },
      "expect": [
        {
          "output": "yTempDeltaOk",
          "from_s": 0,
          "to_s": 5400,
          "equals": true
        },
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "excess_outdoor_air_alarms",
      "description": "The mixture reads 12 \u00b0C against the same 2/22 \u00b0C pair, so %OA is 0.50 \u2014 0.35 above the setpoint, past the 0.30 tolerance. The high branch: outdoor air being heated for no ventilation benefit. Alarms one alarm_delay (1800 s) after the deviation appears",
      "inputs": {
        "mat": 12.0,
        "rat": 22.0,
        "oat": 2.0
      },
      "expect": [
        {
          "output": "yTempDeltaOk",
          "from_s": 0,
          "to_s": 5400,
          "equals": true
        },
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 5400,
          "equals": true
        }
      ]
    },
    {
      "name": "summer_excess_oat_above_rat",
      "description": "Same 0.50 fraction with the temperature gradient reversed \u2014 35 \u00b0C outdoor, 24 \u00b0C return, 29.5 \u00b0C mixed. Both differences change sign together and the quotient is unchanged, so no seasonal branch is needed and the rule alarms exactly as it does in winter",
      "inputs": {
        "mat": 29.5,
        "rat": 24.0,
        "oat": 35.0
      },
      "expect": [
        {
          "output": "yTempDeltaOk",
          "from_s": 0,
          "to_s": 5400,
          "equals": true
        },
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 5400,
          "equals": true
        }
      ]
    },
    {
      "name": "damper_shut_no_ventilation_stays_silent",
      "description": "MAT equals RAT: the unit is on full recirculation and delivering no outdoor air at all. %OA is 0.00, a deviation of 0.15, which is only half of G36's eF = 0.30 tolerance \u2014 so a total ventilation failure sits inside the band and the rule reports nothing. This is the false-negative documented in Deviations, and the reason the low branch only bites on units whose active minimum-OA setpoint exceeds the tolerance",
      "inputs": {
        "mat": 22.0,
        "rat": 22.0,
        "oat": 2.0
      },
      "expect": [
        {
          "output": "yTempDeltaOk",
          "from_s": 0,
          "to_s": 5400,
          "equals": true
        },
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "high_deviation_inside_tolerance",
      "description": "Tolerance band, high side: a 13.2 \u00b0C mixture puts %OA at 0.44, a deviation of 0.29. Inside the tolerance, so no fault however long it lasts",
      "inputs": {
        "mat": 13.2,
        "rat": 22.0,
        "oat": 2.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "high_deviation_outside_tolerance",
      "description": "Tolerance band, high side, one hundredth further out: 12.8 \u00b0C gives %OA 0.46 and a deviation of 0.31, which clears the strict comparison and alarms after alarm_delay",
      "inputs": {
        "mat": 12.8,
        "rat": 22.0,
        "oat": 2.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 5400,
          "equals": true
        }
      ]
    },
    {
      "name": "high_nominal_boundary_rounds_into_alarm",
      "description": "The nominal high boundary: 13.0 \u00b0C gives %OA 0.45, a deviation of exactly 0.30 in decimal, which the strict `>` should read as healthy. It alarms instead. (13 \u2212 22)/(2 \u2212 22) rounds to the double just above 0.45, and subtracting the double nearest 0.15 lands one ulp above 0.30. The boundary is not representable in binary \u2014 see Deviations \u2014 so this pins where the rounding actually falls rather than pretending the decimal edge is testable",
      "inputs": {
        "mat": 13.0,
        "rat": 22.0,
        "oat": 2.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 5400,
          "equals": true
        }
      ]
    },
    {
      "name": "low_deviation_exactly_at_tolerance",
      "description": "Strict-comparison pin, inclusive side: a 25 \u00b0C mixture against 22 \u00b0C return and 2 \u00b0C outdoor puts %OA at \u22120.15, a deviation of exactly \u22120.30. On the low side the arithmetic is exact \u2014 the double nearest 0.15 doubles exactly into the double nearest 0.30 \u2014 so this is the one place the decimal boundary is genuinely testable. `devBig` is a strict `>`, so it reads healthy",
      "inputs": {
        "mat": 25.0,
        "rat": 22.0,
        "oat": 2.0
      },
      "expect": [
        {
          "output": "yTempDeltaOk",
          "from_s": 0,
          "to_s": 5400,
          "equals": true
        },
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "low_deviation_outside_tolerance",
      "description": "The low branch, which AHU-0021 structurally cannot produce: 25.2 \u00b0C mixed air against 22 \u00b0C return and 2 \u00b0C outdoor gives %OA \u22120.16, a deviation of \u22120.31. A mixture warmer than both streams is not mixing, so the ventilation the unit reports cannot be trusted \u2014 G36's diagnosis list leads with the three sensor errors for exactly this reason. Alarms after alarm_delay",
      "inputs": {
        "mat": 25.2,
        "rat": 22.0,
        "oat": 2.0
      },
      "expect": [
        {
          "output": "yTempDeltaOk",
          "from_s": 0,
          "to_s": 5400,
          "equals": true
        },
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 5400,
          "equals": true
        }
      ]
    },
    {
      "name": "delta_exactly_at_dtmin_holds_fault_down",
      "description": "NO_EVAL pin: 16 \u00b0C outdoor against 22 \u00b0C return is a spread of exactly dTMIN = 6.0 \u00b0C, and the 16.6 \u00b0C mixture reads 0.90 outdoor air \u2014 a damper stuck wide open in a minimum-OA state, a deviation of 0.75. `deltaOk` is a strict `>`, so yTempDeltaOk is false and the gate holds yFault down for the whole horizon. False here means unknown, not healthy",
      "inputs": {
        "mat": 16.6,
        "rat": 22.0,
        "oat": 16.0
      },
      "expect": [
        {
          "output": "yTempDeltaOk",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "delta_just_over_dtmin_alarms",
      "description": "The other side of the same boundary, one tenth of a degree colder outdoors: 15.9 \u00b0C against 22 \u00b0C is a 6.1 \u00b0C spread, enough to evaluate. The 16.5 \u00b0C mixture reads 0.90 outdoor air and the same stuck damper now alarms after alarm_delay",
      "inputs": {
        "mat": 16.5,
        "rat": 22.0,
        "oat": 15.9
      },
      "expect": [
        {
          "output": "yTempDeltaOk",
          "from_s": 0,
          "to_s": 5400,
          "equals": true
        },
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 5400,
          "equals": true
        }
      ]
    },
    {
      "name": "small_delta_wild_fraction_silent",
      "description": "A 2 \u00b0C outdoor-to-return spring spread with a 12 \u00b0C mixture: the quotient reads 5.0, five hundred percent outdoor air, a deviation of 4.85. Nothing is wrong with the unit \u2014 a small denominator has amplified ordinary sensor error into an arbitrary fraction. yTempDeltaOk is false and yFault stays down, which is the whole purpose of the dTMIN conjunct",
      "inputs": {
        "mat": 12.0,
        "rat": 22.0,
        "oat": 20.0
      },
      "expect": [
        {
          "output": "yTempDeltaOk",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "zero_denominator_infinite_fraction_silent",
      "description": "The degenerate case: outdoor and return air at the same 22 \u00b0C, so the denominator is exactly zero. CDL `Divide` follows IEEE-754 and returns \u2212\u221e rather than raising, |\u2212\u221e \u2212 0.15| clears any finite tolerance, and `devBig` goes true. The gate is what stops it reaching the operator \u2014 garbage arithmetic can make the rule report itself unevaluable but can never assert a fault",
      "inputs": {
        "mat": 18.0,
        "rat": 22.0,
        "oat": 22.0
      },
      "expect": [
        {
          "output": "yTempDeltaOk",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "transient_excess_clears_before_alarm_delay",
      "description": "Transient: the fraction sits at 0.50 for 1200 s while the outdoor damper strokes back down from a purge, then returns to 0.15. Shorter than alarm_delay, so the deviation never reaches the operator",
      "inputs": {
        "mat": [
          {
            "t": 0,
            "value": 12.0
          },
          {
            "t": 1200,
            "value": 19.0
          }
        ],
        "rat": 22.0,
        "oat": 2.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "fault_clears_on_recovery",
      "description": "A sustained 0.50 fraction alarms at 1800 s; the minimum-position setpoint is corrected at t = 3000 and the fraction drops to 0.15. `TrueDelay` has no off-delay, so the alarm releases on that tick",
      "inputs": {
        "mat": [
          {
            "t": 0,
            "value": 12.0
          },
          {
            "t": 3000,
            "value": 19.0
          }
        ],
        "rat": 22.0,
        "oat": 2.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 2700,
          "equals": true
        },
        {
          "output": "yFault",
          "from_s": 3300,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "oscillating_deviation_never_alarms",
      "description": "A hunting damper swings the mixture between 12.0 \u00b0C and 13.2 \u00b0C on a 10-minute period, so the deviation alternates 0.35 (outside the tolerance) and 0.29 (inside). Its mean, 0.32, is outside \u2014 an averaged form of the test would report the fault. Persistence restarts on every compliant tick and this rule stays silent, which is the cost of substituting TrueDelay for G36's rolling averages (see Deviations)",
      "inputs": {
        "mat": [
          {
            "t": 0,
            "value": 12.0
          },
          {
            "t": 600,
            "value": 13.2
          },
          {
            "t": 1200,
            "value": 12.0
          },
          {
            "t": 1800,
            "value": 13.2
          },
          {
            "t": 2400,
            "value": 12.0
          },
          {
            "t": 3000,
            "value": 13.2
          },
          {
            "t": 3600,
            "value": 12.0
          },
          {
            "t": 4200,
            "value": 13.2
          },
          {
            "t": 4800,
            "value": 12.0
          }
        ],
        "rat": 22.0,
        "oat": 2.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    }
  ]
}

AHU-0007 — SAT too low at full heating

Preconditions (host-enforced): The unit must have a heating coil; G36 omits FC#7 where there is none. Evaluate only in OS#1, whose actuator signature per G36 Table 5.16.14.2 is heating coil > 0, cooling coil = 0, OA damper at minimum position — in any cooling state SAT is meant to sit below its heating setpoint. Supply fan running, since SAT means nothing in still air. Suspend evaluation for ModeDelay (30 min) after any operating-state change, while the coil is still stroking and SAT still reflects the previous state. sat_sp must be the setpoint the unit is actively controlling to: a host that binds a design constant while the sequence follows a reset schedule is comparing SAT against a number nothing is chasing. When any gate is unmet the verdict is NO_EVAL, not healthy.

Points: sat, sat_sp, htg_vlv_cmd

Outputs:

• yFault — True while SAT has stayed more than sat_error_threshold below setpoint with the heating coil commanded above hc_full_threshold, for at least alarm_delay

Parameters:

Description

The heating coil is wide open and the air is still coming out cold. Two signals settle it: the coil command has reached its stop, so the control loop has already asked for everything it has, and SAT is below setpoint by more than the sensor could be wrong about. What is left is a capacity, supply, or sensing problem — the coil cannot deliver, the heat source is not there to deliver, or the measurement is lying about what did get delivered. None of it is a tuning question, which is what makes the saturated-valve half of the test worth carrying: SAT below setpoint at 60% valve command is an ordinary loop working through a load change. This is G36 §5.16.14 FC#7, applicable in OS#1 (heating) only, and G36 omits it entirely on units with no heating coil.

Detection Logic

sp_gap = sat_sp − sat
yFault = (sp_gap       > sat_error_threshold)   SAT short of setpoint by more than sensor error
     AND (htg_vlv_cmd  > hc_full_threshold)     coil has no capacity left
         sustained continuously for alarm_delay

Block graph (rule.cxf.jsonld):

The gap form is G36’s SAT_AVG < SATSP − eSAT rearranged so the tolerance stays a positive number on one CXF path (see Deviations). Both comparisons are strict, so an error sitting exactly on 1.0 °C and a coil reported at exactly 99.0% both read healthy. persist requires 30 minutes of continuous violation and any interruption restarts the timer, which separates a broken coil from a morning warm-up, a step in the setpoint reset schedule, or the recovery after a mode change.

The rule reads the coil command, not a position feedback, and that is deliberate: a valve commanded to 100% while its actuator has failed closed is diagnosis 3, and reading the command is what catches it. The cost is that the rule cannot distinguish a coil genuinely wide open and starved from one that never moved.

Possible Diagnoses

G36 §5.16.14 FC#7, transcribed:

1. SAT sensor error
2. Cooling coil valve leaking or stuck open
3. Heating coil valve stuck closed or actuator failure
4. Fouled or undersized heating coil
5. HW temperature too low or HW unavailable
6. Gas or electric heat unavailable
7. DX cooling stuck on
8. Leaking or stuck economizer damper or actuator

The list spans three failure modes that look identical from these three points: the heat never arrives (3–6), something removes it after it arrives (2, 7, 8), or it arrived and the sensor did not see it (1). Trending MAT alongside SAT splits the first two groups — that comparison is AHU-0005.

Energy Impact

EXCESS_CONSUMPTION, MEDIUM confidence, PROXY_ESTIMATION, all three from the reference’s §5.8.1 index row, which puts the range at 2–5% of AHU energy and maps no PNNL measure. The waste depends on the cause and the three points cannot tell the causes apart, which is why the estimate is a proxy. Where something removes heat (diagnoses 2, 7, 8) the unit pays twice and AHU-0016’s simultaneous heating and cooling term sizes it. Where the coil is starved or fouled (3–6) the AHU wastes little on its own and the deficit moves downstream: makeup_kw = supply_airflow_m3s × 1.2 × 1.005 × (sat_sp − sat), delivered by terminal reheat at worse efficiency than the central coil, or not at all in zones with no terminal heat. Heating-dominant, since the rule is only evaluable in OS#1.

Emissions Impact

PROXY_EMISSIONS, MEDIUM confidence. Scope 1|2 because the inventory follows the heat source: hot water from a gas boiler, a gas furnace section, or a steam coil is Scope 1, while electric resistance, a heat pump, and the terminal reheat making up the deficit are usually Scope 2. A site with a gas boiler and electric reheat pays into both, and the cooling-side diagnoses (2, 7) add a Scope 2 term of their own. Avoided-emissions basis: static combustion factor for the fuel half, marginal operating emissions rate (MOER) for the electric half.

Deviations

• The reference card is abbreviated; G36 is the normative source. HVAC FDD Reference v1.0 carries AHU-0007 as a §5.8.1 index row only — no equation, tunables, diagnoses, operating-state applicability, or severity. Detection Logic and Possible Diagnoses are transcribed from ASHRAE Guideline 36 §5.16.14 FC#7 as it appears in Addendum u to Guideline 36-2018 (first public review, 2021), with the Table 5.16.14.5 defaults (NISTIR 7365 provenance, which the addendum notes are biased toward minimizing false alarms).
• Severity 3 is the library’s. No reference card states one and the §5.8.1 index carries no severity column; the value matches this chapter’s scaffold row and the other G36 comparison rules here.
• The energy profile is the index row’s; the emissions split is the library’s. category, confidence, estimation_method, and savings_range are copied from §5.8.1. The index has no emissions column, so scope: 1|2 follows AHU-0020’s convention for a fault whose fuel depends on which diagnosis is true; the cause-dependent runtime formula is the library’s, its simultaneous-heating-and-cooling branch AHU-0016’s term.
• SAT_AVG < SATSP − eSAT rewritten in gap form. Subtracting first and testing sat_sp − sat > eSAT keeps the tolerance the positive number G36 publishes, retunable at one CXF path, instead of a negative offset ahead of the comparison. Same rearrangement as AHU-0001 and AHU-0028, with the same one-ulp caveat that no temperature sensor resolves.
• HC >= 99% becomes a strict >. CDL Reals has only strict comparisons, so a coil command parked at exactly 99.000% reads as not-at-full-capacity and the rule stays silent — the same deviation AHU-0001 documents for fan speed. A host whose valve command is quantized to whole percent should retune hc_full_threshold to 98.9.
• Instantaneous samples instead of averaged signals. G36 computes every signal as a five-minute rolling average of one-minute samples; this rule compares raw samples and leans on the 30-minute persist delay. Not equivalent — persistence resets on every compliant tick, so an oscillating SAT can hide indefinitely, while the steady shortfall of a starved or fouled coil reads the same either way. Same note as AHU-0002; a SAT swinging across the band rather than sitting under it is AHU-0022’s finding.
• Operating-state applicability and ModeDelay are frontmatter, not graph. G36 scopes FC#7 to OS#1 and suspends every fault condition for 30 minutes after a mode change; both are host concerns under this library’s stance (precedent AHU-0029), and a verdict outside OS#1 or inside the transition window is NO_EVAL, never healthy. The graph’s htg_vlv_cmd > 99 test is not that gate — it is the saturation half of the fault condition, and OS#1 admits any heating command above zero.
• persist.delayOnInit = true (Modelica/CDL default is false), the library’s standing choice: a shortfall already present at load waits out the full 30 minutes rather than alarming on the first tick after a controller restart.

Notes

Check the setpoint before the coil. A SAT setpoint that never resets (AHU-0023) can hold a heating call the unit was never sized to meet, and a reset schedule stepping up faster than the coil can follow produces this signature for a few minutes at every step. Then work the supply side: hot water temperature and pump status cost nothing to read, and diagnoses 5 and 6 take a whole building’s heating rather than one unit’s. AHU-0013 is this fault mirrored into cooling; AHU-0005 is its companion in the same state, and FC-007 with FC-005 points at a heat sink running against the heating call. No playbook covers coil capacity and heat-supply work yet.

Test Vectors

11 scenarios, clock step 300 s over 5400 s.

{
  "schema": "cxf-library/vectors/v1",
  "clock": {
    "step_s": 300,
    "horizon_s": 5400
  },
  "scenarios": [
    {
      "name": "part_load_heating_holding_setpoint",
      "description": "Healthy OS#1 operation: the coil is at 60% and SAT is 0.5 \u00b0C under a 21.5 \u00b0C setpoint. Neither half of the conjunction is true \u2014 the loop has capacity left and the error is inside eSAT",
      "inputs": {
        "sat": 21.0,
        "sat_sp": 21.5,
        "htg_vlv_cmd": 60.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "full_heating_still_on_setpoint",
      "description": "The valve is wide open on a design-day morning but SAT is only 0.5 \u00b0C short \u2014 the unit is sized close to its design point, not broken. Saturation alone is not a fault",
      "inputs": {
        "sat": 20.5,
        "sat_sp": 21.0,
        "htg_vlv_cmd": 100.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "part_load_missing_setpoint",
      "description": "SAT is 6 \u00b0C short of setpoint with the valve at 60% \u2014 that is a control-loop finding (tuning, or a reset the loop is chasing), not a capacity finding, and this rule stays silent by design",
      "inputs": {
        "sat": 15.0,
        "sat_sp": 21.0,
        "htg_vlv_cmd": 60.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "full_heating_missing_setpoint",
      "description": "The reportable case: valve at 100% and SAT 6 \u00b0C below setpoint. The coil is saturated and still losing, so the shortfall is capacity, supply, or sensing. Alarms one alarm_delay (1800 s) after the condition appears",
      "inputs": {
        "sat": 15.0,
        "sat_sp": 21.0,
        "htg_vlv_cmd": 100.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 5400,
          "equals": true
        }
      ]
    },
    {
      "name": "error_exactly_at_threshold",
      "description": "Threshold edge: sat_sp \u2212 sat = 1.0 \u00b0C exactly with the valve at 100%. `spMiss` is a strict `>`, so an error sitting precisely on eSAT reads healthy",
      "inputs": {
        "sat": 20.0,
        "sat_sp": 21.0,
        "htg_vlv_cmd": 100.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "error_just_over_threshold",
      "description": "Threshold edge, other side: sat_sp \u2212 sat = 1.1 \u00b0C clears the strict comparison and alarms after alarm_delay",
      "inputs": {
        "sat": 19.9,
        "sat_sp": 21.0,
        "htg_vlv_cmd": 100.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 5400,
          "equals": true
        }
      ]
    },
    {
      "name": "valve_exactly_at_full_threshold",
      "description": "Threshold edge: the valve reports exactly 99.0% with a 6 \u00b0C error present. `htgFull` is a strict `>`, so G36's `HC >= 99%` reads as not-full here \u2014 the case a host with integer-quantized valve feedback must retune hc_full_threshold to 98.9 to catch",
      "inputs": {
        "sat": 15.0,
        "sat_sp": 21.0,
        "htg_vlv_cmd": 99.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "valve_just_over_full_threshold",
      "description": "Threshold edge, other side: 99.5% clears the strict comparison, so the same 6 \u00b0C error alarms after alarm_delay",
      "inputs": {
        "sat": 15.0,
        "sat_sp": 21.0,
        "htg_vlv_cmd": 99.5
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 5400,
          "equals": true
        }
      ]
    },
    {
      "name": "morning_warmup_clears_before_delay",
      "description": "Transient: the coil pins at 100% and SAT sits 6 \u00b0C short during warm-up, then reaches 20.5 \u00b0C at t = 1200 s. Twenty minutes is short of alarm_delay, so a cold start never alarms",
      "inputs": {
        "sat": [
          {
            "t": 0,
            "value": 15.0
          },
          {
            "t": 1200,
            "value": 20.5
          }
        ],
        "sat_sp": 21.0,
        "htg_vlv_cmd": 100.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "valve_modulates_off_before_delay",
      "description": "Transient on the other input: the 6 \u00b0C error holds but the valve backs off to 70% at t = 1200 s, which means the loop was never out of capacity. Both halves must be true at once, so persistence restarts and no alarm follows",
      "inputs": {
        "sat": 15.0,
        "sat_sp": 21.0,
        "htg_vlv_cmd": [
          {
            "t": 0,
            "value": 100.0
          },
          {
            "t": 1200,
            "value": 70.0
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "fault_clears_on_recovery",
      "description": "A sustained shortfall alarms at 1800 s; hot water returns at t = 3000 s and SAT reaches 20.5 \u00b0C, dropping the alarm on that tick \u2014 TrueDelay has no off-delay",
      "inputs": {
        "sat": [
          {
            "t": 0,
            "value": 15.0
          },
          {
            "t": 3000,
            "value": 20.5
          }
        ],
        "sat_sp": 21.0,
        "htg_vlv_cmd": 100.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 2700,
          "equals": true
        },
        {
          "output": "yFault",
          "from_s": 3300,
          "to_s": 5400,
          "equals": false
        }
      ]
    }
  ]
}

AHU-0008 — SAT ≠ MAT in economizer mode

Preconditions (host-enforced): The unit must have a MAT sensor; G36 omits FC#8 where there is none. Evaluate only in OS#2, which G36 Table 5.16.14.2 defines by actuator signature: heating coil = 0, cooling coil = 0, minimum OA position < OA damper < 100%. Outside that state a coil is legitimately working and SAT is supposed to differ from MAT, so the equation means nothing. Supply fan running, since neither temperature describes a stream that is not moving. Per §5.16.14.11 the host suspends evaluation while the AHU is off and for ModeDelay (30 min) after a mode change in any zone group the AHU serves, while the coils and damper are still stroking. Silence this rule while AHU-0028 is active: MAT is an input here and FC-062 is its integrity gate. When any gate is unmet the verdict is NO_EVAL, not healthy.

Points: sat, mat

Outputs:

• yFault — True while |sat − fan_rise − mat| has stayed above combined_error for at least alarm_delay

Parameters:

Description

In OS#2 the air handler runs as a modulating economizer: both coils are commanded shut, so the only thing between the mixed-air sensor and the supply-air sensor doing any work is the supply fan. Air should leave at the temperature it arrived plus the degree or so the fan puts in. A disagreement larger than the two sensors’ combined error after that fan rise is taken out means something in between is adding or removing heat, or a sensor is not reporting the stream it is mounted in.

This is the one state where the two sensors can be audited against each other at no cost — everywhere else a coil is doing work and SAT is supposed to differ from MAT. The fault is deliberately non-committal about direction: air leaving too warm points at hot water leaking through a seated heating valve, too cold at chilled water doing the same. Either way the plant is serving a coil nobody commanded, which no command-following check can see.

Detection Logic

G36 §5.16.14 FC#8, applies to OS#2 (omitted if the unit has no MAT sensor):

    | SAT_AVG − dTSF − MAT_AVG | > sqrt(eSAT² + eMAT²)

with the Table 5.16.14.5 defaults:

    | sat − 1.0 − mat | > sqrt(1² + 3²) = 3.1623 °C

yFault = (|sat − fan_rise − mat| > combined_error), sustained for alarm_delay

Block graph (rule.cxf.jsonld):

Fan rise and sensor error do different jobs, which is why they are separate parameters: fan_rise positions the center of the acceptance band — the difference the unit is expected to show — and combined_error sets its half-width. Retuning one does not imply retuning the other. The fan-heat term is a constant source into a Subtract rather than an AddParameter with a negative parameter, so fanConst.k holds the physical quantity with its physical sign and a host that measures a 1.4 °C rise can set 1.4 (precedent: AHU-0021’s designConst).

G36’s comparison is already strict, so GreaterThreshold reproduces it exactly and a deviation of exactly 3.1623 °C reads healthy in both. persist requires 30 minutes of continuous violation and any interruption restarts the timer.

Possible Diagnoses

Per G36 §5.16.14 Table 5.16.14.8, FC#8:

1. SAT sensor error — cheapest to rule out with a hand-held reference in the supply duct
2. MAT sensor error — harder, since a mixed-air sensor can be in calibration and still read a stratified slice of the plenum instead of the mixture (AHU-0028 catches the gross version)
3. Cooling coil valve leaking or stuck open — chilled water through a valve commanded to 0 shows up here and nowhere in the command stream
4. Heating coil valve leaking or stuck open — the mirror case, and the more expensive one in this state: the unit chose free cooling because outdoor air was useful, and boiler energy is being spent to undo it

Energy Impact

COMFORT_ENERGY, LOW confidence, QUALITATIVE_ONLY — the grades in the reference’s §5.8.1 index row, which maps the fault to PNNL-25985 EEM-01 (sensor recalibration) and publishes savings as sensor-dependent. Nothing is estimated from the rule’s inputs: two temperatures and no airflow give no power term, and the difference is ambiguous between a lying sensor and a leaking valve. Those have very different costs — a drifted sensor burns nothing directly, while a valve leaking through in free cooling burns plant energy continuously, and worse than the same leak elsewhere because the unit entered OS#2 on the finding that outdoor air could do the job unaided. Climate-neutral.

Emissions Impact

QUALITATIVE_EMISSIONS, LOW confidence; the block is library-assigned, as the §5.8.1 index carries no emissions column. Scope 1|2 because the equation cannot tell which coil is leaking: a hot water valve passing flow lands in Scope 1 (Scope 2 for electric resistance or heat pump heat), a chilled water valve or stuck DX circuit in Scope 2. The sensor-error diagnoses have no direct emissions. Avoided-emissions basis: N/A — no quantity is estimated.

Deviations

• The reference card is an index row, so this card is built from G36. §5.8.1 gives the code, the name, and the energy grades, with no equation, vectors, or severity. The equation, OS#2 applicability, four diagnoses, and internal-variable defaults are transcribed from ASHRAE Guideline 36 §5.16.14 as it appears in Addendum u to Guideline 36-2018 (first public review, 2021).
• Severity 3 is library-assigned. The index has no severity column, and G36’s Level 3 alarm grading (§5.16.14.16) is a reporting priority rather than a ranking. The value matches every other G36 001-range card here.
• Energy profile follows the §5.8.1 index row (COMFORT_ENERGY / LOW / QUAL, EEM-01, savings “sensor-dependent”); the emissions block is library-assigned.
• Root-sum-square threshold shipped as one number. G36 writes the bound as sqrt(eSAT² + eMAT²); the graph carries the evaluated 3.1623 °C in devBig.t, so a host retunes one parameter and no square root runs at runtime. The composition is spelled out in the parameter description because the arithmetic is not linear: a 4 °C mixed-air sensor gives sqrt(1 + 16) = 4.1231 °C, not 1 + 4.
• No boundary deviation for this fault. FC#8’s comparison is already strict (>), unlike the ≥/≤ forms elsewhere in Table 5.16.14.8 (FC#5, FC#12, FC#14, FC#15), so no measure-zero rewrite is involved. Same finding as AHU-0009 and AHU-0011.
• Fan heat enters as a constant signal, not a negative parameter. An AddParameter with p = −1.0 computes the same deviation but stores the fan rise with an inverted sign, so a host setting a measured value through set_param would double the error instead of correcting it.
• Instantaneous samples instead of averaged signals. G36 compares 5-minute rolling averages sampled at 1-minute intervals; this rule compares raw samples and leans on the 30-minute persist delay. Not equivalent — persistence resets on every compliant tick, so an oscillating difference can hide indefinitely, while a drifted sensor and a leaking valve are steady offsets and read the same either way. (Honesty note carried from AHU-0002.)
• Suppression is declared, not encoded. AHU-0028 gates MAT integrity and silences this rule while active; the engine is status-blind, so the relationship lives in suppressed_by for the host to enforce.
• Operating-state gating and NO_EVAL are frontmatter, not graph. G36 scopes FC#8 to OS#2 (§5.16.14.9b), suspends evaluation for ModeDelay after a mode change, and suspends it entirely when the AHU is off (§5.16.14.11). A host that evaluates in OS#1 or OS#4 will see this rule assert continuously — correctly by the equation and meaninglessly in fact, because a working coil is exactly what the difference is measuring.
• persist.delayOnInit = true (Modelica/CDL default is false): a deviation already present at load waits out the full 30 minutes rather than alarming on the first tick after a controller restart. Library-wide choice, per AHU-0016.

Notes

This rule and AHU-0010 are the G36 pair testing whether two temperatures that ought to be equal actually are, and both are close cousins of AHU-0028. FC-062 tests containment — MAT inside the OAT–RAT envelope — a law that holds in every operating state; these two test equality, which holds in one state each, and size their bands as the root-sum-square of two specific sensors’ error. The pair also splits the AHU at the fan: FC-010 compares MAT against OAT, both upstream, and carries no fan-heat term. Run the sensor-drift playbook before touching a valve — a hand-held reference settles the SAT question in minutes, and a sensor runs $30–$80.

Test Vectors

10 scenarios, clock step 300 s over 7200 s.

{
  "schema": "cxf-library/vectors/v1",
  "clock": {
    "step_s": 300,
    "horizon_s": 7200
  },
  "scenarios": [
    {
      "name": "sat_is_mat_plus_fan_rise",
      "description": "Textbook OS#2: 13.0 \u00b0C mixed air arrives at the supply sensor as 14.0 \u00b0C, the whole difference being the 1 \u00b0C the supply fan puts in. dev = sat \u2212 mat \u2212 dTSF = 0 exactly, which is what the fanConst term exists to produce. No coil is doing anything and neither sensor is lying.",
      "inputs": {
        "sat": 14.0,
        "mat": 13.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 7200,
          "equals": false
        }
      ]
    },
    {
      "name": "sat_equals_mat_no_fan_rise",
      "description": "SAT and MAT read identically, so dev = \u22121.0 \u00b0C: the fan heat G36 expects is missing. That is well inside the 3.1623 \u00b0C root-sum-square band \u2014 a fan that adds less than its nameplate rise, or a pair of sensors each off by half a degree, is not a fault.",
      "inputs": {
        "sat": 13.0,
        "mat": 13.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 7200,
          "equals": false
        }
      ]
    },
    {
      "name": "heating_valve_leaking_sat_too_warm",
      "description": "13.0 \u00b0C mixed air leaves at 18.0 \u00b0C: dev = +4.0 \u00b0C, past the threshold. In OS#2 the heating coil is commanded shut, so the only ways air gains four degrees more than fan heat are hot water leaking through a closed valve or a sensor reading wrong. Alarms once the 30 min delay expires.",
      "inputs": {
        "sat": 18.0,
        "mat": 13.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 7200,
          "equals": true
        }
      ]
    },
    {
      "name": "cooling_valve_leaking_sat_too_cold",
      "description": "14.0 \u00b0C mixed air leaves at 10.0 \u00b0C: dev = \u22125.0 \u00b0C. Negative disagreement pins the Abs \u2014 without it the rule would only see air that got too warm. Physically this is chilled water leaking through a closed valve, cooling nobody asked for and nobody is paying attention to, since the valve command reads 0.",
      "inputs": {
        "sat": 10.0,
        "mat": 14.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 7200,
          "equals": true
        }
      ]
    },
    {
      "name": "edge_positive_dev_equals_threshold",
      "description": "Strict boundary, clear side: sat \u2212 mat \u2212 1.0 = 3.1623 \u00b0C exactly, the full root-sum-square of eSAT and eMAT. GreaterThreshold is u > t, so a unit sitting precisely on its combined sensor budget reads healthy.",
      "inputs": {
        "sat": 17.2623,
        "mat": 13.1
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 7200,
          "equals": false
        }
      ]
    },
    {
      "name": "edge_positive_dev_just_over_threshold",
      "description": "Strict boundary, fault side: the same mixed air with SAT 0.04 \u00b0C warmer puts dev at 3.2 \u00b0C, which clears u > t and alarms after the delay. Pins the edge from the other direction.",
      "inputs": {
        "sat": 17.3,
        "mat": 13.1
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 7200,
          "equals": true
        }
      ]
    },
    {
      "name": "edge_negative_dev_equals_threshold",
      "description": "Same boundary on the cold side: dev = \u22123.1623 \u00b0C exactly, |dev| = t, clear. Together with the positive edge this shows the band is symmetric about the fan-heat-corrected zero rather than about zero itself.",
      "inputs": {
        "sat": 10.8377,
        "mat": 13.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 7200,
          "equals": false
        }
      ]
    },
    {
      "name": "edge_negative_dev_just_over_threshold",
      "description": "Cold side, fault: dev = \u22123.2 \u00b0C. |dev| clears the threshold and the alarm asserts after 30 min, at the same magnitude the positive case does.",
      "inputs": {
        "sat": 10.8,
        "mat": 13.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 7200,
          "equals": true
        }
      ]
    },
    {
      "name": "transient_disagreement_never_alarms",
      "description": "SAT jumps to 18 \u00b0C for 1200 s \u2014 shorter than the 1800 s alarm delay \u2014 then returns. A damper stroke or a load step moves the mixed-air stream past the SAT sensor before the MAT sensor settles, and the timer resets on the first compliant tick, so nothing is reported.",
      "inputs": {
        "sat": [
          {
            "t": 0,
            "value": 14.0
          },
          {
            "t": 600,
            "value": 18.0
          },
          {
            "t": 1800,
            "value": 14.0
          }
        ],
        "mat": 13.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 7200,
          "equals": false
        }
      ]
    },
    {
      "name": "fault_clears_when_valve_seats",
      "description": "A leaking heating valve holds SAT at 18 \u00b0C, the alarm asserts at 1800 s, and at 3600 s the valve seats and SAT falls back to 14 \u00b0C. The alarm drops on that tick: assertion waits out the delay, recovery does not.",
      "inputs": {
        "sat": [
          {
            "t": 0,
            "value": 18.0
          },
          {
            "t": 3600,
            "value": 14.0
          }
        ],
        "mat": 13.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 3300,
          "equals": true
        },
        {
          "output": "yFault",
          "from_s": 3900,
          "to_s": 7200,
          "equals": false
        }
      ]
    }
  ]
}

AHU-0009 — OAT too high for free cooling

Preconditions (host-enforced): Evaluate only in G36 OS#2, which Table 5.16.14.2 defines by actuator signature: heating coil = 0, cooling coil = 0, minimum OA position < OA damper < 100%. Per §5.16.14.11 the host suspends evaluation while the AHU is not operating and for ModeDelay (30 min) after a mode change in any zone group the AHU serves; per §5.16.14.12 fault conditions not applicable to the current OS are not evaluated at all. Verdicts outside OS#2, and verdicts inside a transition window, are NO_EVAL — never healthy. sat_sp must be the setpoint the economizer is controlling to (G36’s SATsp for heating-coil and economizer control), not the cooling-coil setpoint SATsp-C. The 1.0 °C default threshold assumes a local OAT sensor at the unit; a site on a global OAT sensor must retune it before trusting the verdict.

Points: oat, sat_sp

Outputs:

• yFault — True while outdoor air has stayed more than oat_excess_threshold above the supply air setpoint continuously for at least alarm_delay

Parameters:

Description

The unit is running as a modulating economizer while outdoor air is too warm to reach the supply setpoint. In OS#2 both coils are shut and outdoor air is the only cooling in the machine; it enters at OAT and picks up roughly 1 °C crossing the supply fan, so once OAT is above SATSP − dTSF no damper position gets supply air down to setpoint. The unit belongs in OS#3, with mechanical cooling on top of a fully open damper.

The fault names a changeover that did not happen: the high-limit logic should have handed off and did not, or the OAT the logic reads is not the OAT the unit is breathing, or something is quietly supplying cooling that keeps the SAT loop looking satisfied. Within CLU-03 (Economizer Failure) this is the mirror of the trigger AHU-0017 — that rule catches an economizer that will not open when outdoor air is useful, this one catches one still open after it stopped being.

Detection Logic

G36 §5.16.14 FC#9, applies to OS#2:

    OAT_AVG − eOAT > SATSP − dTSF + eSAT

rearranged to gap form:

    oat − sat_sp > eOAT + eSAT − dTSF = 1 + 1 − 1 = 1.0 °C

yFault = (oat − sat_sp > oat_excess_threshold), sustained for alarm_delay

Block graph (rule.cxf.jsonld):

Everything G36 spreads across both sides of the inequality — two sensor error bands and the fan-heat correction — collapses into the single positive gapBig.t, so a host retunes one parameter instead of reasoning about which side each term lives on. The gap is signed, and its sign is the physics: negative means free cooling has headroom, positive means the damper is out of moves, and the threshold sets how far past zero the gap must go before sensor error stops being a plausible explanation.

G36’s comparison is already strict, so GreaterThreshold reproduces it exactly and a gap of exactly 1.0 °C reads healthy in both. persist requires 30 minutes of continuous violation and any interruption restarts the timer; recovery is immediate on the tick the gap falls back under the threshold. Either input can open the gap — a setpoint reset walking toward a colder target crosses the same line a warming afternoon does.

Possible Diagnoses

Per G36 §5.16.14 Table 5.16.14.8, FC#9:

1. SAT sensor error — the SAT loop chases a reading that is not the supply air and holds the unit in economizer mode at a setpoint outdoor air cannot reach
2. OAT sensor error — a sensor reading low keeps the changeover logic convinced free cooling is viable; cheapest of the three to rule out
3. Cooling coil valve leaking or stuck open — invisible to the command in OS#2, but real cooling, and it can hold SAT near setpoint where outdoor air alone never could, so the unit has no reason to change over

Energy Impact

COMFORT_ENERGY, LOW confidence, QUALITATIVE_ONLY — the reference’s §5.8.1 index row, which maps the fault to PNNL-25985 EEM-06 (OA damper faults). The immediate symptom is lost cooling capacity: the unit cannot make setpoint, zones drift warm, and VAV boxes open chasing supply air that never gets cold enough. No waste term is computable from two temperatures with no airflow, coil state, or counterfactual mode. The secondary cost depends on the diagnosis — a leaking cooling valve runs a chiller against a coil nobody commanded, while a delayed changeover mostly costs comfort until mechanical cooling engages. Cooling-dominant by construction.

Emissions Impact

QUALITATIVE_EMISSIONS, LOW confidence, Scope 2. Every path out of this fault runs on purchased electricity — chiller or DX capacity engaging late, fan energy moving air that is not cold enough, and in the leaking-valve case compressor work nobody asked for. No on-site combustion is involved: OS#2 has the heating coil commanded shut, and a heating valve leaking in this state is FC#15’s finding, not this one’s. Avoided-emissions basis: N/A.

Deviations

• The reference card is an index row, so this card is built from G36. §5.8.1 gives the code and the name and nothing else. The equation, OS#2 applicability, three diagnoses, and internal-variable defaults are transcribed from ASHRAE Guideline 36 §5.16.14 as it appears in Addendum u to Guideline 36-2018 (first public review, 2021).
• Severity 3 is library-assigned. The reference publishes none; the value matches this chapter’s scaffold row and every other G36 001-range card here. G36’s own Level 3 alarm grading (§5.16.14.16) is a reporting priority rather than a ranking, but it points the same direction.
• Energy profile matches the §5.8.1 index row (COMFORT_ENERGY / LOW / QUAL, EEM-06, savings “sensor-dependent”), mirroring AHU-0002 and AHU-0003; the emissions block is library-assigned. Scope 2 is narrower than the 1|2 those cards use, because unlike a mis-read MAT this fault cannot drive heating: OS#2 has the heating coil shut by definition.
• Combined-epsilon threshold. G36 puts eOAT on the measured side and dTSF and eSAT on the setpoint side, which would bind one card parameter to three block parameters with two signs. oat − sat_sp > eOAT + eSAT − dTSF puts one positive number on one CXF path, algebraically identical, with the composition recorded in the parameter description. Same move as AHU-0028 and AHU-0002.
• The default assumes a local OAT sensor. G36 gives eOAT as 1 °C at the unit and 3 °C for a global sensor, and the library ships the local value. A site feeding this rule from a campus or weather-service OAT must set oat_excess_threshold to 3.0 °C (3 + 1 − 1); leaving it at 1.0 makes the rule fire on sensor disagreement G36 considers within tolerance.
• No boundary deviation for this fault. FC#9’s comparison is already strict (>), unlike the ≥/≤ forms elsewhere in Table 5.16.14.8 (FC#5, FC#12, FC#14, FC#15), so no measure-zero rewrite is involved.
• Instantaneous samples instead of averaged signals. G36 compares 5-minute rolling averages sampled at 1-minute intervals; this rule compares raw samples and leans on the 30-minute persist delay. Not equivalent — persistence resets on every compliant tick, so an oscillating OAT can hide indefinitely, while the steady offset this rule is for reads the same either way. (Honesty note carried from AHU-0002.)
• Operating-state gating and NO_EVAL are frontmatter, not graph. G36 scopes FC#9 to OS#2 (§5.16.14.9b), suspends evaluation for ModeDelay after a mode change, and suspends it entirely when the AHU is off (§5.16.14.11). The engine is status-blind and the graph computes fault-given-valid-data only (precedent AHU-0029). A host that evaluates in OS#3 will see this rule assert on every warm afternoon, correctly by the equation and meaninglessly in fact.
• persist.delayOnInit = true (Modelica/CDL default is false): a gap already open at load waits out the full 30 minutes rather than alarming on the first tick after a controller restart. Library-wide choice, per AHU-0016.

Notes

The instructive property of this rule is only visible next to its pair. AHU-0009 and AHU-0011 test the same two points against the same epsilons and both account for the same 1 °C fan rise, but FC#9 subtracts fan heat (threshold 1.0 °C) while FC#11 adds it (3.0 °C): fan heat narrows the usable free-cooling band from the top and widens it from the bottom, so the too-warm test fires sooner and the too-cold test waits longer. A site on a global OAT sensor recomputes both — 3.0 °C here, 5.0 °C for AHU-0011 — and they do not scale together. Check the OAT sensor before anyone edits changeover logic (step 1.2 of the economizer-failure playbook): a sensor reading low produces this exact signature with the sequence working.

Test Vectors

8 scenarios, clock step 300 s over 7200 s.

{
  "schema": "cxf-library/vectors/v1",
  "clock": {
    "step_s": 300,
    "horizon_s": 7200
  },
  "scenarios": [
    {
      "name": "favorable_free_cooling",
      "description": "Normal OS#2: 10 \u00b0C outdoor air against a 13 \u00b0C setpoint. Even after the 1 \u00b0C fan rise the air arrives at 11 \u00b0C, so the damper has room to modulate and the changeover is correct.",
      "inputs": {
        "oat": 10.0,
        "sat_sp": 13.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 7200,
          "equals": false
        }
      ]
    },
    {
      "name": "oat_well_above_setpoint",
      "description": "20 \u00b0C outdoor air against a 13 \u00b0C setpoint: the gap is 7 \u00b0C, far past the 1.0 \u00b0C threshold. Free cooling cannot reach setpoint at any damper position, so the alarm asserts once the 30 min delay expires.",
      "inputs": {
        "oat": 20.0,
        "sat_sp": 13.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 7200,
          "equals": true
        }
      ]
    },
    {
      "name": "edge_gap_equals_threshold",
      "description": "Strict boundary, clear side: oat \u2212 sat_sp = 1.0 \u00b0C exactly. GreaterThreshold is u > t, so sitting precisely on the composed epsilon budget is not a fault.",
      "inputs": {
        "oat": 14.0,
        "sat_sp": 13.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 7200,
          "equals": false
        }
      ]
    },
    {
      "name": "edge_gap_just_over_threshold",
      "description": "Strict boundary, fault side: oat \u2212 sat_sp = 1.1 \u00b0C clears u > t and alarms after the delay. Pins the same edge as edge_gap_equals_threshold from the other direction.",
      "inputs": {
        "oat": 14.1,
        "sat_sp": 13.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 7200,
          "equals": true
        }
      ]
    },
    {
      "name": "fan_heat_narrows_the_band",
      "description": "Teaching case for the sign of dTSF: a 1.5 \u00b0C gap faults because fan heat is subtracted from the epsilon budget (1 + 1 \u2212 1 = 1.0). Had the threshold been sensor error alone (2.0 \u00b0C), this unit would read healthy while outdoor air 0.5 \u00b0C above setpoint gains another 1 \u00b0C crossing the fan.",
      "inputs": {
        "oat": 14.5,
        "sat_sp": 13.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 7200,
          "equals": true
        }
      ]
    },
    {
      "name": "setpoint_drop_opens_the_gap",
      "description": "Outdoor air holds at 13.5 \u00b0C while the SAT reset walks the setpoint from 14 \u00b0C down to 12 \u00b0C at t = 600 s. Nothing outdoors changed; the unit simply now demands colder supply air than free cooling can deliver. The delay runs from the setpoint step, so the alarm lands at 2400 s.",
      "inputs": {
        "oat": 13.5,
        "sat_sp": [
          {
            "t": 0,
            "value": 14.0
          },
          {
            "t": 600,
            "value": 12.0
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 2100,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2700,
          "to_s": 7200,
          "equals": true
        }
      ]
    },
    {
      "name": "transient_warm_spell_never_alarms",
      "description": "A 1200 s excursion to 20 \u00b0C \u2014 shorter than the 1800 s alarm delay \u2014 then back to 10 \u00b0C. The persistence timer resets on the first compliant tick and nothing is reported.",
      "inputs": {
        "oat": [
          {
            "t": 0,
            "value": 10.0
          },
          {
            "t": 600,
            "value": 20.0
          },
          {
            "t": 1800,
            "value": 10.0
          }
        ],
        "sat_sp": 13.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 7200,
          "equals": false
        }
      ]
    },
    {
      "name": "fault_clears_on_recovery",
      "description": "Sustained 7 \u00b0C gap alarms at 1800 s; outdoor air falls back to 10 \u00b0C at 3600 s and the alarm drops on that tick. Recovery has no delay \u2014 only the assertion does.",
      "inputs": {
        "oat": [
          {
            "t": 0,
            "value": 20.0
          },
          {
            "t": 3600,
            "value": 10.0
          }
        ],
        "sat_sp": 13.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 3300,
          "equals": true
        },
        {
          "output": "yFault",
          "from_s": 3900,
          "to_s": 7200,
          "equals": false
        }
      ]
    }
  ]
}

AHU-0010 — OAT ≠ MAT in mechanical + economizer cooling

Preconditions (host-enforced): The unit must have a MAT sensor; G36 omits FC#10 where there is none. Evaluate only in OS#3, which G36 Table 5.16.14.2 defines by actuator signature: heating coil = 0, cooling coil > 0, OA damper at 100%. At any smaller damper position return air is supposed to be in the mixture and the equation is simply false. Supply fan running, since neither temperature describes a stream that is not moving. Per §5.16.14.11 the host suspends evaluation while the AHU is off and for ModeDelay (30 min) after a mode change in any zone group the AHU serves — a damper still stroking toward 100% leaves return air in the plenum that no fault caused. Silence this rule while AHU-0028 is active: MAT is an input here and FC-062 is its integrity gate. When any gate is unmet the verdict is NO_EVAL, not healthy.

Points: mat, oat

Outputs:

• yFault — True while |mat − oat| has stayed above combined_error for at least alarm_delay

Parameters:

Description

In OS#3 the unit has opened the outdoor air damper to 100% and closed the return damper, and is running mechanical cooling on top. Mixed air is then not a mixture at all — it is outdoor air, one plenum downstream — so the two sensors are measuring the same stream at two points and should agree to within their combined accuracy.

When they do not, either a sensor is lying or the return damper is not where the command says it is. The second case is the expensive one: return air in a building that needs cooling is warmer than the outdoor air the economizer just chose, so every degree of leak-through arrives at the coil as load the unit did not need to buy, and the damper feedback will not show it. This is the outdoor-air-side counterpart to AHU-0008, which audits the supply and mixed-air sensors in free cooling; between them the two G36 equality tests cover most of the unit’s temperature instrumentation using only operating states the sequence already visits.

Detection Logic

G36 §5.16.14 FC#10, applies to OS#3 (omitted if the unit has no MAT sensor):

    | MAT_AVG − OAT_AVG | > sqrt(eMAT² + eOAT²)

with the Table 5.16.14.5 defaults and a local OAT sensor:

    | mat − oat | > sqrt(3² + 1²) = 3.1623 °C

yFault = (|mat − oat| > combined_error), sustained for alarm_delay

Block graph (rule.cxf.jsonld):

There is no fan-heat term, and its absence is physics rather than omission: both sensors sit upstream of the supply fan, so whatever the fan adds is added after the comparison and cancels out of it. AHU-0008 straddles the fan and must correct for it.

The sign of dev carries the diagnosis even though the rule discards it. Positive — mixed air warmer than outdoor — is the leaking return damper in cooling weather. Negative is a sensor story: no amount of recirculated building air pulls a mixture below the outdoor stream when the building is warmer than outdoors. A host that wants the direction keeps the two temperatures alongside the verdict.

G36’s comparison is already strict, so GreaterThreshold reproduces it exactly and a deviation of exactly 3.1623 °C reads healthy in both. persist requires 30 minutes of continuous violation and any interruption restarts the timer.

Possible Diagnoses

Per G36 §5.16.14 Table 5.16.14.8, FC#10:

1. MAT sensor error — out of calibration, or reading a stratified slice of the plenum rather than the stream (AHU-0028 catches the gross version)
2. OAT sensor error — cheapest to rule out, and usually placement: a sensor on a sun-struck wall or above a condenser reads high all afternoon
3. Leaking or stuck economizer damper or actuator — the return damper is not sealing, or the outdoor damper never reached the 100% it reports

Energy Impact

COMFORT_ENERGY, LOW confidence, QUALITATIVE_ONLY — the grades in the reference’s §5.8.1 index row, which maps the fault to PNNL-25985 EEM-01 (sensor recalibration) and publishes savings as sensor-dependent. Two temperatures and no airflow give no power term, and the difference is ambiguous between a lying sensor and a leaking damper. On the damper diagnosis the waste is direct and continuous: recirculated return air arrives at the coil warmer than the outdoor air the economizer selected, and the chiller pays for as long as the leak lasts. On the sensor diagnoses the cost is indirect — the same bad reading feeds AHU-0021, AHU-0030, and the changeover logic. Cooling-dominant, since OS#3 exists only when the unit is making cold air.

Emissions Impact

QUALITATIVE_EMISSIONS, LOW confidence; the block is library-assigned, as the §5.8.1 index carries no emissions column. Scope 2: every path out of this fault lands on the cooling plant — chiller or DX work spent on recirculated air, and fan energy moving it. No on-site combustion is involved, since OS#3 has the heating coil commanded shut and a heating valve leaking in this state reports as FC#15. That is why this card is narrower than AHU-0008’s 1|2, which cannot tell which coil is leaking. Avoided-emissions basis: N/A.

Deviations

• The reference card is an index row, so this card is built from G36. §5.8.1 gives the code, the name, and the energy grades, with no equation, vectors, or severity. The equation, OS#3 applicability, three diagnoses, and internal-variable defaults are transcribed from ASHRAE Guideline 36 §5.16.14 as it appears in Addendum u to Guideline 36-2018 (first public review, 2021).
• Severity 3 is library-assigned. The index has no severity column, and G36’s Level 3 alarm grading (§5.16.14.16) is a reporting priority rather than a ranking. The value matches every other G36 001-range card here.
• Energy profile follows the §5.8.1 index row (COMFORT_ENERGY / LOW / QUAL, EEM-01, savings “sensor-dependent”); the emissions block is library-assigned.
• Root-sum-square threshold shipped as one number. G36 writes the bound as sqrt(eMAT² + eOAT²); the graph carries the evaluated 3.1623 °C in devBig.t, so a host retunes one parameter and no square root runs at runtime. The composition is spelled out in the parameter description because the arithmetic is not linear.
• The default assumes a local OAT sensor. G36 gives eOAT as 1 °C at the unit and 3 °C for a global one. A site feeding this rule from a campus sensor or weather service must set combined_error to sqrt(9 + 9) = 4.2426 °C; leaving it at the local value makes the rule fire on disagreement G36 considers within tolerance. The two G36 equality tests do not retune together — AHU-0008’s threshold does not move at all, since it contains no OAT term.
• No boundary deviation for this fault. FC#10’s comparison is already strict (>), unlike the ≥/≤ forms elsewhere in Table 5.16.14.8 (FC#5, FC#12, FC#14, FC#15), so no measure-zero rewrite is involved. Same finding as AHU-0009 and AHU-0011.
• Instantaneous samples instead of averaged signals. G36 compares 5-minute rolling averages sampled at 1-minute intervals; this rule compares raw samples and leans on the 30-minute persist delay. Not equivalent — persistence resets on every compliant tick, so an oscillating difference can hide indefinitely, while a drifted sensor and a leaking damper are steady offsets and read the same either way. (Honesty note carried from AHU-0002.)
• Suppression is declared, not encoded. AHU-0028 gates MAT integrity and silences this rule while active; the engine is status-blind, so the relationship lives in suppressed_by for the host to enforce.
• Operating-state gating and NO_EVAL are frontmatter, not graph. G36 scopes FC#10 to OS#3 (§5.16.14.9c), suspends evaluation for ModeDelay after a mode change, and suspends it entirely when the AHU is off (§5.16.14.11). A host that evaluates at minimum outdoor air will see this rule assert on every cold morning, correctly by the equation and meaninglessly in fact, because mixing return air is what the damper is for.
• persist.delayOnInit = true (Modelica/CDL default is false): a deviation already present at load waits out the full 30 minutes rather than alarming on the first tick after a controller restart. Library-wide choice, per AHU-0016.

Notes

This rule and AHU-0008 are the G36 pair testing whether two temperatures that ought to be equal actually are, and both are close cousins of AHU-0028. FC-062 tests containment — MAT inside the OAT–RAT envelope — a law that holds in every operating state; these two test equality, which holds in one state each. A unit whose MAT sits inside the envelope and still disagrees with outdoor air by 4 °C on full outdoor air passes the gate and fails here, which is the point of running both. The outdoor air fraction AHU-0021 and AHU-0030 compute puts MAT and OAT in numerator and denominator at once, so an error big enough to trip this rule moves that ratio further still. Run the sensor-drift playbook before anyone opens the mixing box, and check where the outdoor sensor is mounted — sun on the housing produces this signature with a calibrated element inside.

Test Vectors

9 scenarios, clock step 300 s over 7200 s.

{
  "schema": "cxf-library/vectors/v1",
  "clock": {
    "step_s": 300,
    "horizon_s": 7200
  },
  "scenarios": [
    {
      "name": "mat_tracks_oat",
      "description": "Healthy OS#3: the OA damper is at 100%, the return damper is shut, and 15.5 \u00b0C outdoor air reaches the mixed-air sensor at 15.8 \u00b0C. The 0.3 \u00b0C residual is plenum warming and sensor spread, far inside the 3.1623 \u00b0C band.",
      "inputs": {
        "mat": 15.8,
        "oat": 15.5
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 7200,
          "equals": false
        }
      ]
    },
    {
      "name": "return_air_leaking_past_shut_damper",
      "description": "15.0 \u00b0C outdoor air, 20.0 \u00b0C mixed air: 5 \u00b0C of warm return air is finding its way into a plenum that is supposed to be on 100% outdoor air. The return damper reads closed, so only the temperature pair can see it. Alarms after the 30 min delay.",
      "inputs": {
        "mat": 20.0,
        "oat": 15.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 7200,
          "equals": true
        }
      ]
    },
    {
      "name": "oat_sensor_reads_high",
      "description": "Mixed air 4 \u00b0C below outdoor air. Return air cannot cool a mixture below the outdoor stream, so this direction is a sensor story: an OAT sensor in afternoon sun, or a MAT sensor drifted low. Negative disagreement pins the Abs \u2014 without it the rule would be blind to half its diagnoses.",
      "inputs": {
        "mat": 15.0,
        "oat": 19.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 7200,
          "equals": true
        }
      ]
    },
    {
      "name": "edge_positive_dev_equals_threshold",
      "description": "Strict boundary, clear side: mat \u2212 oat = 3.1623 \u00b0C exactly, the full root-sum-square of eMAT and eOAT. GreaterThreshold is u > t, so a unit sitting precisely on its combined sensor budget reads healthy.",
      "inputs": {
        "mat": 18.5623,
        "oat": 15.4
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 7200,
          "equals": false
        }
      ]
    },
    {
      "name": "edge_positive_dev_just_over_threshold",
      "description": "Strict boundary, fault side: the same outdoor air with MAT 0.04 \u00b0C warmer puts the deviation at 3.2 \u00b0C, which clears u > t and alarms after the delay. Pins the edge from the other direction.",
      "inputs": {
        "mat": 18.6,
        "oat": 15.4
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 7200,
          "equals": true
        }
      ]
    },
    {
      "name": "edge_negative_dev_equals_threshold",
      "description": "Same boundary on the cold side: mat \u2212 oat = \u22123.1623 \u00b0C exactly, |dev| = t, clear. The band is symmetric, so both signs have to be pinned.",
      "inputs": {
        "mat": 14.8377,
        "oat": 18.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 7200,
          "equals": false
        }
      ]
    },
    {
      "name": "edge_negative_dev_just_over_threshold",
      "description": "Cold side, fault: mat \u2212 oat = \u22123.2 \u00b0C. |dev| clears the threshold and the alarm asserts at the same magnitude the positive case does.",
      "inputs": {
        "mat": 14.8,
        "oat": 18.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 7200,
          "equals": true
        }
      ]
    },
    {
      "name": "transient_disagreement_never_alarms",
      "description": "MAT rises to 20 \u00b0C for 1200 s \u2014 shorter than the 1800 s alarm delay \u2014 then settles back. A damper still stroking toward 100% leaves return air in the plenum for a few minutes; the timer resets on the first compliant tick and nothing is reported.",
      "inputs": {
        "mat": [
          {
            "t": 0,
            "value": 15.3
          },
          {
            "t": 600,
            "value": 20.0
          },
          {
            "t": 1800,
            "value": 15.3
          }
        ],
        "oat": 15.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 7200,
          "equals": false
        }
      ]
    },
    {
      "name": "fault_clears_when_damper_seats",
      "description": "A leaking return damper holds MAT at 20 \u00b0C against 15 \u00b0C outdoor air; the alarm asserts at 1800 s. At 3600 s the damper seats and MAT falls to 15.3 \u00b0C, and the alarm drops on that tick \u2014 assertion waits out the delay, recovery does not.",
      "inputs": {
        "mat": [
          {
            "t": 0,
            "value": 20.0
          },
          {
            "t": 3600,
            "value": 15.3
          }
        ],
        "oat": 15.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 3300,
          "equals": true
        },
        {
          "output": "yFault",
          "from_s": 3900,
          "to_s": 7200,
          "equals": false
        }
      ]
    }
  ]
}

AHU-0011 — OAT too low for mechanical cooling

Preconditions (host-enforced): Evaluate only in G36 OS#3, which Table 5.16.14.2 defines by actuator signature: heating coil = 0, cooling coil > 0, OA damper = 100%. Per §5.16.14.11 the host suspends evaluation while the AHU is not operating and for ModeDelay (30 min) after a mode change in any zone group the AHU serves; per §5.16.14.12 fault conditions not applicable to the current OS are not evaluated at all. Verdicts outside OS#3, and verdicts inside a transition window, are NO_EVAL — never healthy. sat_sp must be the setpoint the economizer is controlling to (G36’s SATsp for heating-coil and economizer control), not the cooling-coil setpoint SATsp-C. The 3.0 °C default threshold assumes a local OAT sensor at the unit; a site on a global OAT sensor must retune it before trusting the verdict.

Points: oat, sat_sp

Outputs:

• yFault — True while outdoor air has stayed more than oat_deficit_threshold below the supply air setpoint continuously for at least alarm_delay

Parameters:

Description

The unit is running mechanical cooling on top of a fully open outdoor air damper while outdoor air is already colder than the supply setpoint by more than the fan will add back. In OS#3 the dampers sit at 100% and the chiller trims what the economizer cannot deliver, which is legitimate — until OAT is more than dTSF below setpoint, at which point free cooling alone would overshoot and the unit belongs in OS#2 modulating back toward a blend.

Something is holding the machine in the wrong state: the sequence never changed over, a sensor is lying about which side of setpoint the air is on, or a heating coil is leaking warmth into a stream the chiller then removes — the expensive version, two subsystems paying to cancel each other. Within CLU-03 (Economizer Failure) this is the third face of the same changeover problem: AHU-0017 catches a damper that stays shut when outdoor air is useful, AHU-0009 an economizer still modulating after outdoor air stopped being useful, and this one mechanical cooling still running when the economizer alone had it covered.

Detection Logic

G36 §5.16.14 FC#11, applies to OS#3:

    OAT_AVG + eOAT < SATSP − dTSF − eSAT

rearranged to gap form:

    sat_sp − oat > eOAT + eSAT + dTSF = 1 + 1 + 1 = 3.0 °C

yFault = (sat_sp − oat > oat_deficit_threshold), sustained for alarm_delay

Block graph (rule.cxf.jsonld):

G36 spreads the two sensor error bands and the fan-heat correction across both sides of the inequality; the rearrangement collapses them into the single positive gapBig.t, so a host retunes one parameter instead of tracking which side each term sits on. Note the operand order: gap is sat_sp − oat, the reverse of AHU-0009’s, because the two rules look at opposite ends of the same band and each wants its own end positive.

G36’s comparison is already strict, so the rearranged GreaterThreshold reproduces it exactly and a gap of exactly 3.0 °C reads healthy in both. persist requires 30 minutes of continuous violation and any interruption restarts the timer; recovery is immediate on the tick the gap falls back under the threshold. Either input can open the gap — raising the supply setpoint does it as surely as a cold front.

Possible Diagnoses

Per G36 §5.16.14 Table 5.16.14.8, FC#11:

1. SAT sensor error — a supply reading biased high keeps the cooling loop calling for capacity the air does not need
2. OAT sensor error — a sensor reading high keeps the changeover logic from recognizing that free cooling would now overshoot
3. Heating coil valve leaking or stuck open — warmth upstream of the cooling coil is heat the chiller then removes, and the reason the unit needs mechanical cooling on air that arrived cold. The most expensive diagnosis here, and the one that also lights up FC#15 where that rule is deployed
4. Leaking or stuck economizer damper or actuator — a damper reported at 100% but physically short of it, or a return damper that will not close, delivers a warmer mixture than OAT implies

Energy Impact

COMFORT_ENERGY, LOW confidence, QUALITATIVE_ONLY — the reference’s §5.8.1 index row, which maps the fault to PNNL-25985 EEM-06 (OA damper faults). Mechanical cooling is doing free cooling’s job: every kilowatt at the chiller buys a temperature drop the outdoor air had already made. The waste is real and continuous but not computable here — two temperatures carry no airflow, no coil load, and no counterfactual for the correct state. An upper bound is the cooling energy spent over the fault’s duration; a host with airflow and coil data can substitute the direct measurement AHU-0017 uses. Cooling-dominant, and most common in shoulder seasons when outdoor air swings across the changeover point.

Emissions Impact

QUALITATIVE_EMISSIONS, LOW confidence, Scope 2. The waste is chiller or DX compressor electricity plus fan energy already being spent. Diagnosis 3 adds on-site combustion at the boiler, which would be Scope 1 — but that heat is inferred rather than observed, and the coil it feeds is commanded shut in OS#3, so the emissions this rule can honestly claim are the purchased-electricity ones. Avoided-emissions basis: N/A.

Deviations

• The reference card is an index row, so this card is built from G36. §5.8.1 gives the code and the name and nothing else. The equation, OS#3 applicability, four diagnoses, and internal-variable defaults are transcribed from ASHRAE Guideline 36 §5.16.14 as it appears in Addendum u to Guideline 36-2018 (first public review, 2021).
• Severity 3 is library-assigned. The reference publishes none; the value matches this chapter’s scaffold row and every other G36 001-range card here. G36’s Level 3 alarm grading (§5.16.14.16) is a reporting priority rather than a ranking, but it points the same direction.
• Energy profile follows the §5.8.1 index row (COMFORT_ENERGY / LOW / QUAL, EEM-06, savings “sensor-dependent”), and the published row wins where one exists. EXCESS_CONSUMPTION is a defensible alternative — setpoint is being met, so the unit is comfortable and wasteful rather than uncomfortable — and is recorded, not adopted. The emissions block is library-assigned.
• Combined-epsilon threshold. G36 puts eOAT on the measured side and dTSF and eSAT on the setpoint side, which would bind one card parameter to three block parameters. sat_sp − oat > eOAT + eSAT + dTSF puts one positive number on one CXF path, algebraically identical, with the composition recorded in the parameter description. Same move as AHU-0028 and AHU-0009.
• The default assumes a local OAT sensor. G36 gives eOAT as 1 °C at the unit and 3 °C for a global sensor. A site feeding this rule from a campus or weather-service OAT must set oat_deficit_threshold to 5.0 °C (3 + 1 + 1); leaving it at 3.0 makes the rule fire on sensor disagreement G36 considers within tolerance.
• No boundary deviation for this fault. FC#11’s comparison is already strict (<), unlike the ≥/≤ forms elsewhere in Table 5.16.14.8 (FC#5, FC#12, FC#14, FC#15), so GreaterThreshold on the rearranged gap reproduces the source exactly.
• Instantaneous samples instead of averaged signals. G36 compares 5-minute rolling averages sampled at 1-minute intervals; this rule compares raw samples and leans on the 30-minute persist delay. Not equivalent — persistence resets on every compliant tick, so an oscillating OAT can hide indefinitely, while the steady offset this rule is for reads the same either way. (Honesty note carried from AHU-0002.)
• Operating-state gating and NO_EVAL are frontmatter, not graph. G36 scopes FC#11 to OS#3 (§5.16.14.9c), suspends evaluation for ModeDelay after a mode change, and suspends it entirely when the AHU is off (§5.16.14.11). The engine is status-blind and the graph computes fault-given-valid-data only (precedent AHU-0029). A host that evaluates in OS#2 will see this rule assert on every cold morning — cold outdoor air with the dampers modulating is free cooling working.
• persist.delayOnInit = true (Modelica/CDL default is false): a gap already open at load waits out the full 30 minutes rather than alarming on the first tick after a controller restart. Library-wide choice, per AHU-0016.

Notes

The instructive property of this rule is only visible next to its pair. AHU-0009 and AHU-0011 test the same two points against the same epsilons and both account for the same 1 °C fan rise, but FC#9 subtracts fan heat (threshold 1.0 °C) while FC#11 adds it (3.0 °C): fan heat narrows the usable free-cooling band from the top and widens it from the bottom. A site on a global OAT sensor recomputes both — 5.0 °C here, 3.0 °C for AHU-0009 — and they do not scale together. The two cannot fire at once, since one needs OS#2 and the other OS#3; a unit that alternates between them across a day is saying the changeover point is in the wrong place or the OAT sensor is unreliable. Check that sensor before anyone edits changeover logic — step 1.2 of the economizer-failure playbook.

Test Vectors

8 scenarios, clock step 300 s over 7200 s.

{
  "schema": "cxf-library/vectors/v1",
  "clock": {
    "step_s": 300,
    "horizon_s": 7200
  },
  "scenarios": [
    {
      "name": "mech_cooling_with_mild_oa",
      "description": "Normal OS#3: 16 \u00b0C outdoor air against a 13 \u00b0C setpoint. Outdoor air is warmer than the supply target, so the dampers at 100% plus mechanical cooling on top is exactly the right arrangement.",
      "inputs": {
        "oat": 16.0,
        "sat_sp": 13.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 7200,
          "equals": false
        }
      ]
    },
    {
      "name": "oat_far_below_setpoint",
      "description": "5 \u00b0C outdoor air against a 13 \u00b0C setpoint: the gap is 8 \u00b0C, well past the 3.0 \u00b0C threshold. Free cooling alone would overshoot, so the chiller is removing heat from air that was already cold enough. Alarms after the 30 min delay.",
      "inputs": {
        "oat": 5.0,
        "sat_sp": 13.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 7200,
          "equals": true
        }
      ]
    },
    {
      "name": "edge_gap_equals_threshold",
      "description": "Strict boundary, clear side: sat_sp \u2212 oat = 3.0 \u00b0C exactly. GreaterThreshold is u > t, so sitting precisely on the composed epsilon-plus-fan-heat budget is not a fault.",
      "inputs": {
        "oat": 10.0,
        "sat_sp": 13.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 7200,
          "equals": false
        }
      ]
    },
    {
      "name": "edge_gap_just_over_threshold",
      "description": "Strict boundary, fault side: sat_sp \u2212 oat = 3.1 \u00b0C clears u > t and alarms after the delay. Pins the same edge as edge_gap_equals_threshold from the other direction.",
      "inputs": {
        "oat": 9.9,
        "sat_sp": 13.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 7200,
          "equals": true
        }
      ]
    },
    {
      "name": "fan_heat_widens_the_band",
      "description": "Teaching case for the sign of dTSF: a 2.5 \u00b0C gap reads healthy because fan heat is added to the epsilon budget (1 + 1 + 1 = 3.0). Outdoor air 2.5 \u00b0C below setpoint arrives only 1.5 \u00b0C below it after the fan, which mechanical cooling can legitimately still be trimming. An epsilon-only threshold of 2.0 \u00b0C would have called this a fault.",
      "inputs": {
        "oat": 10.5,
        "sat_sp": 13.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 7200,
          "equals": false
        }
      ]
    },
    {
      "name": "setpoint_raised_opens_the_gap",
      "description": "Outdoor air holds at 11 \u00b0C while the setpoint is raised from 13 \u00b0C to 15 \u00b0C at t = 600 s. Weather did not change; the unit now asks for supply air that free cooling alone would overshoot. The delay runs from the setpoint step, so the alarm lands at 2400 s.",
      "inputs": {
        "oat": 11.0,
        "sat_sp": [
          {
            "t": 0,
            "value": 13.0
          },
          {
            "t": 600,
            "value": 15.0
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 2100,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2700,
          "to_s": 7200,
          "equals": true
        }
      ]
    },
    {
      "name": "transient_cold_snap_never_alarms",
      "description": "A 1200 s excursion to 5 \u00b0C \u2014 shorter than the 1800 s alarm delay \u2014 then back to 16 \u00b0C. The persistence timer resets on the first compliant tick and nothing is reported.",
      "inputs": {
        "oat": [
          {
            "t": 0,
            "value": 16.0
          },
          {
            "t": 600,
            "value": 5.0
          },
          {
            "t": 1800,
            "value": 16.0
          }
        ],
        "sat_sp": 13.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 7200,
          "equals": false
        }
      ]
    },
    {
      "name": "fault_clears_on_recovery",
      "description": "Sustained 8 \u00b0C gap alarms at 1800 s; outdoor air warms back to 16 \u00b0C at 3600 s and the alarm drops on that tick. Recovery has no delay \u2014 only the assertion does.",
      "inputs": {
        "oat": [
          {
            "t": 0,
            "value": 5.0
          },
          {
            "t": 3600,
            "value": 16.0
          }
        ],
        "sat_sp": 13.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 3300,
          "equals": true
        },
        {
          "output": "yFault",
          "from_s": 3900,
          "to_s": 7200,
          "equals": false
        }
      ]
    }
  ]
}

AHU-0012 — SAT too high vs MAT in cooling

Preconditions (host-enforced): Supply fan running, and the unit in one of the cooling-side operating states G36 defines by actuator signature: OS#2 (HC = 0, CC = 0, minimum < OA damper < 100%), OS#3 (HC = 0, CC > 0, OA damper = 100%), or OS#4 (HC = 0, CC > 0, OA damper at minimum). Omit the rule on a unit with no MAT sensor — G36 marks FC#12 omit if no MAT sensor, and a MAT inferred from a mixing model rather than measured makes the comparison circular. Suspend evaluation for ModeDelay (30 min) after any mode or operating-state change in a zone group the AHU serves, while actuators are still stroking to their new positions. Silence the rule while AHU-0028 is active: a MAT outside the OAT/RAT envelope is not a number to compare anything against. When any gate is unmet the verdict is NO_EVAL, not healthy.

Points: sat, mat

Outputs:

• yFault — True while SAT has stayed more than sat_mat_gap_threshold above MAT for at least alarm_delay

Parameters:

Description

Air crossing an air handler in a cooling-side state can gain a little heat from the supply fan and nothing else. When SAT reads more than the combined sensor and fan-heat allowance above MAT, the stream is picking up heat from a source that should not be running: a gas or electric stage stuck on, a heating valve leaking through, or a heating coil that never closed when the unit left OS#1. The alternative is that one of the two sensors is lying.

This is G36 §5.16.14 FC#12, AHU-0005 read in the mirror; both are statements about the sign of the temperature change across the unit, each evaluated only in the states where its sign is the expected one. A heating source active while the unit is cooling is simultaneous heating and cooling under another name, which puts this rule in CLU-01 behind AHU-0016. The difference is what each can see: AHU-0016 needs both valve commands and catches the conflict at the command layer, while this rule reads two temperatures and catches it at the air stream — including the case AHU-0016 misses, where the heating command reads zero and heat arrives anyway.

Detection Logic

gap    = sat − mat
yFault = gap > sat_mat_gap_threshold,
         sustained continuously for alarm_delay

Block graph (rule.cxf.jsonld):

G36 writes the test as SAT_AVG − eSAT − ΔTSF ≥ MAT_AVG + eMAT; moving the constants to one side gives SAT − MAT ≥ eSAT + eMAT + ΔTSF, one subtraction against the composed 5.0 °C threshold. The comparison is strict, so a gap sitting exactly on 5.0 °C reads healthy where G36 would report the fault. persist requires 30 minutes of continuous violation and any interruption restarts the timer, which separates a stuck heat source from a heating stage finishing its off-cycle purge; recovery is immediate on the tick the gap falls back inside the allowance.

Nothing below the threshold can trip this rule, including a gap of −20 °C. A cooling coil that has stopped cooling shows up here only once the air is actively being heated; the case where SAT merely fails to reach setpoint with the valve wide open is AHU-0013’s.

Possible Diagnoses

Transcribed from G36 §5.16.14 FC#12:

1. SAT sensor error
2. MAT sensor error
3. Cooling coil valve stuck closed or actuator failure
4. Fouled or undersized cooling coil
5. CHW temperature too high or CHW unavailable
6. DX cooling unavailable
7. Gas or electric heat stuck on
8. Heating coil valve leaking or stuck open

Diagnoses 7 and 8 are what make this a waste fault rather than a capacity fault: they are the only entries that put energy into the stream. Air merely failing to be cooled lands about one fan-heat rise above MAT, not five degrees, so the cooling-side entries usually reach this rule in combination — a leaking heating coil that a working chilled-water coil had been masking becomes visible the moment the cooling capacity goes away.

Energy Impact

EXCESS_CONSUMPTION, MEDIUM confidence, PROXY_ESTIMATION, savings 2–5% of AHU energy — the §5.8.1 index row, the only energy statement the reference makes here (no EEM mapped). The waste has two halves, the heat someone paid to add and the cooling paid to remove it again:

waste_kw = supply_airflow_m3s × 1.2 × 1.005 × (sat − (mat + dTSF))

That sizes the first half; the second is a further charge of roughly the same magnitude at the plant’s efficiency. Design airflow substituting for a measured one keeps the term a proxy, and MEDIUM rather than HIGH because the rule cannot separate its waste diagnoses from its sensor diagnoses — a mis-calibrated SAT sensor draws the identical trace and wastes nothing. Cooling-dominant, since the rule is evaluated only in cooling-side states.

Emissions Impact

PROXY_EMISSIONS, MEDIUM confidence. Scope 1+2, following AHU-0016: when the fault is real both inventories are paid into at the same moment — gas heat adding energy (Scope 1) and purchased electricity driving the chiller that removes it (Scope 2). The 1 is contingent on the heat being combustion; on an all-electric unit the exchange collapses to Scope 2. The heating-side mirror AHU-0005 records the same exchange as 1|2 for that contingency, so the pair differs on notation rather than physics. When the cause is a sensor there is nothing to attribute. Avoided-emissions basis: marginal operating emissions rate (MOER) for the electric half, static combustion factor for the fuel half.

Deviations

• The reference card is abbreviated; G36 is the normative text. The HVAC FDD Reference carries AHU-0012 only as a §5.8.1 index row — no equation, internal variables, vectors, severity, diagnoses, or preconditions. Detection logic and the diagnosis list are transcribed from ASHRAE Guideline 36 §5.16.14 FC#12 as it appears in Addendum u to Guideline 36-2018 (First Public Review, 2021).
• Combined threshold instead of three separate allowances. eSAT = 1 °C, eMAT = 3 °C, and ΔTSF = 1 °C (NISTIR 7365 defaults the addendum notes are “intentionally biased toward minimizing false alarms”) compose into one positive 5.0 °C threshold on one CXF path, so a host retunes one number instead of three. Recompute as eSAT + eMAT + ΔTSF: a local calibrated MAT sensor at eMAT = 1 °C gives 3.0, a measured 2 °C fan rise gives 6.0. Same rearrangement as AHU-0028 and AHU-0001.
• G36’s ≥ becomes a strict >. CDL Reals offers only strict comparisons, so a gap of exactly 5.000 °C reads healthy where G36 reports the fault. Measure zero on a real temperature signal, and it errs toward silence. A host binding coarsely quantized temperatures (integer °C, or a BAS that rounds to 0.5) should retune sat_mat_gap_threshold to 4.9.
• Instantaneous samples instead of 5-minute rolling averages. G36 computes every §5.16.14 signal as a 5-minute rolling average with 1-minute sampling; this library consumes instantaneous points and lets the 30-minute AlarmDelay stand in. Not equivalent — persistence resets on every compliant tick, so an oscillating gap can hide indefinitely, while the steady offset of a stuck heat source or a drifted sensor reads the same either way. (Honesty note from AHU-0002.)
• Operating states and ModeDelay are host-side preconditions. G36 scopes FC#12 to OS#2–#4, suspends evaluation for ModeDelay (30 min) after a mode change in a served zone group, and suspends it entirely while the AHU is off. None of it is in the graph, per the library’s stance (precedent AHU-0029). G36’s omit if no MAT sensor qualifier is a deployment decision of the same kind and lives in preconditions too.
• OS#2 is included on the addendum’s own authority. The published FC#12 row applies to OS#3–#4; Addendum u shows the applicability edited to OS#2–#4, which is what is transcribed here — free cooling with a modulating damper is a cooling-side state like the other two. A host running the unedited 2018 text gates OS#3–#4 only; the graph is identical either way.
• Severity 3 is the library’s. No chapter card states one and the §5.8.1 index carries no severity column. G36’s Level 3 alarm grading is a reporting priority rather than this library’s 1–4 scale, so it corroborates without supplying.
• The energy profile is the index row’s; the runtime formula and scope are the library’s. category, confidence, estimation_method, and savings_range are copied from §5.8.1. The proxy formula is mirrored from AHU-0005 with the sign flipped — that rule counts heat removed from air the heating coil paid to warm, this one heat added to air the cooling coil pays to remove.
• persist.delayOnInit = true (Modelica/CDL default is false), the library’s standing choice: a violation already present at load waits out the full 30 minutes instead of alarming on the first tick after a controller restart.

Notes

The threshold asymmetry with AHU-0005 is worth understanding before either number is retuned. The heating-side rule tests MAT − SAT against eSAT + eMAT − ΔTSF = 3.0 °C; this one tests SAT − MAT against eSAT + eMAT + ΔTSF = 5.0 °C. The sensor allowances are identical and the fan heat is what differs: expected warming excuses SAT running warm and indicts SAT running cold. Start with the two sensor diagnoses — cheapest to eliminate and most likely to be right — and note that an active AHU-0028 should already be suppressing this rule. If the sensors check out, the simultaneous-hc playbook covers the rest: the heat source is on, and what remains is whether the command, the valve, or the sequence is responsible.

Test Vectors

9 scenarios, clock step 300 s over 5400 s.

{
  "schema": "cxf-library/vectors/v1",
  "clock": {
    "step_s": 300,
    "horizon_s": 5400
  },
  "scenarios": [
    {
      "name": "cooling_coil_doing_its_job",
      "description": "Minimum-OA mechanical cooling on a warm day: a 24 \u00b0C mixture leaves the coil at 13 \u00b0C. SAT is 11 \u00b0C below MAT, the sign the rule expects in every cooling-side state, so there is nothing to report",
      "inputs": {
        "sat": 13.0,
        "mat": 24.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "fan_heat_with_no_cooling_demand",
      "description": "SAT sits 1.5 \u00b0C above MAT with the coil idle \u2014 about what the supply fan alone adds (dTSF = 1 \u00b0C) plus a fraction of the sensor allowances. The 5 \u00b0C threshold is built to absorb exactly this case, so the rule stays silent",
      "inputs": {
        "sat": 25.5,
        "mat": 24.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "gap_exactly_at_threshold",
      "description": "Threshold edge: SAT \u2212 MAT = 5.0 \u00b0C exactly, the full eSAT + eMAT + dTSF allowance. `gapBig` is a strict `>`, so a gap sitting precisely on the composed allowance reads healthy",
      "inputs": {
        "sat": 29.0,
        "mat": 24.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "gap_just_over_threshold",
      "description": "Threshold edge, other side: SAT \u2212 MAT = 5.1 \u00b0C clears the strict comparison and the alarm asserts one alarm_delay (1800 s) later",
      "inputs": {
        "sat": 29.1,
        "mat": 24.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 5400,
          "equals": true
        }
      ]
    },
    {
      "name": "heat_stuck_on_during_mechanical_cooling",
      "description": "The unit is in a cooling state and the air still gains 9 \u00b0C crossing the AHU \u2014 a gas or electric heating stage stuck on, or a heating valve leaking through. Air cannot warm itself, so this is the CLU-01 waste case: energy added and removed on the same stream",
      "inputs": {
        "sat": 31.0,
        "mat": 22.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 5400,
          "equals": true
        }
      ]
    },
    {
      "name": "mat_sensor_reading_low",
      "description": "A plausible SAT of 18 \u00b0C against a MAT of 12 \u00b0C on a day with no 12 \u00b0C air anywhere in the building \u2014 the same 6 \u00b0C violation, but here the mixed-air sensor is what is wrong. The rule reports the contradiction; it cannot say which of the two sensors is lying",
      "inputs": {
        "sat": 18.0,
        "mat": 12.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 5400,
          "equals": true
        }
      ]
    },
    {
      "name": "transient_clears_before_alarm_delay",
      "description": "Transient: the gap holds at 9 \u00b0C for 1200 s while a heating stage finishes its off-cycle purge, then SAT drops to 15 \u00b0C. Anything shorter than alarm_delay never reaches the operator",
      "inputs": {
        "sat": [
          {
            "t": 0,
            "value": 31.0
          },
          {
            "t": 1200,
            "value": 15.0
          }
        ],
        "mat": 22.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "fault_clears_on_recovery",
      "description": "A sustained 9 \u00b0C gap alarms at 1800 s; the stuck heating stage is switched off at t = 3000 and SAT falls to 14 \u00b0C. `TrueDelay` has no off-delay, so the alarm drops on that tick",
      "inputs": {
        "sat": [
          {
            "t": 0,
            "value": 31.0
          },
          {
            "t": 3000,
            "value": 14.0
          }
        ],
        "mat": 22.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 2700,
          "equals": true
        },
        {
          "output": "yFault",
          "from_s": 3300,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "oscillating_gap_never_alarms",
      "description": "A staging heater cycling on a 10-minute period drives the gap between 9 \u00b0C and 0 \u00b0C. Its mean is well outside the threshold and G36's 5-minute rolling average would report the fault, but persistence restarts on every compliant tick, so this rule stays silent \u2014 the limit of substituting TrueDelay for averaging (see Deviations)",
      "inputs": {
        "sat": [
          {
            "t": 0,
            "value": 31.0
          },
          {
            "t": 600,
            "value": 22.0
          },
          {
            "t": 1200,
            "value": 31.0
          },
          {
            "t": 1800,
            "value": 22.0
          },
          {
            "t": 2400,
            "value": 31.0
          },
          {
            "t": 3000,
            "value": 22.0
          },
          {
            "t": 3600,
            "value": 31.0
          },
          {
            "t": 4200,
            "value": 22.0
          },
          {
            "t": 4800,
            "value": 31.0
          }
        ],
        "mat": 22.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    }
  ]
}

AHU-0013 — SAT too high at full cooling

Preconditions (host-enforced): Supply fan running, and the unit in one of the two mechanical-cooling operating states G36 defines by actuator signature: OS#3 (HC = 0, CC > 0, OA damper = 100%) or OS#4 (HC = 0, CC > 0, OA damper at minimum). Suspend evaluation for ModeDelay (30 min) after any mode or operating-state change in a zone group the AHU serves, while actuators are still stroking and the coil has not caught up. clg_vlv_cmd must be the command the AHU controller is issuing, not a position feedback: this rule asks whether the loop has run out of capacity to ask for, and a feedback that disagrees with its command is a stuck-actuator finding (AHU-0020), not this one. sat_sp must be the active setpoint, including any reset — comparing against a design value the sequence is no longer holding produces a fault every mild afternoon. When any gate is unmet the verdict is NO_EVAL, not healthy.

Points: sat, sat_sp, clg_vlv_cmd

Outputs:

• yFault — True while SAT has stayed more than sat_error_threshold above its setpoint with the cooling valve commanded above cc_full_threshold, for at least alarm_delay

Parameters:

Description

The cooling valve is wide open and the supply air is still above setpoint. The control loop has already asked for everything it has, so whatever is wrong is not tuning: either the coil cannot deliver, the chilled water or refrigerant behind it cannot deliver, or the sensor reporting the miss is wrong. Downstream the effect is the ordinary one — zones that cannot get cold enough, VAV boxes opening toward maximum flow, and a fan pushing more air to make up the degrees the coil failed to remove.

This is G36 §5.16.14 FC#13, the exact mirror of AHU-0007 on the heating side. Both rules make the same statement: an actuator at its stop with the controlled variable still on the wrong side of its target is evidence of a defect, and until the actuator saturates it is evidence of nothing.

Detection Logic

sp_gap = sat − sat_sp
yFault = (sp_gap      > sat_error_threshold)   SAT above setpoint by more than sensor accuracy
     AND (clg_vlv_cmd > cc_full_threshold)     cooling loop has nothing left to ask for
         sustained continuously for alarm_delay

Block graph (rule.cxf.jsonld):

The gap form is G36’s SAT_AVG > SATSP + eSAT rearranged so the allowance stays a single positive number at one CXF path. clgFull is the half that gives the miss its meaning: SAT above setpoint at a part-open valve is a control loop doing its job, and only a loop that has run out of coil is evidence of a defect. Both comparisons are strict, so a miss sitting exactly on 1.0 °C and a command parked exactly on 99.0% both read healthy. persist requires 30 minutes of continuous violation and any interruption restarts the timer, which separates a failed coil from a morning pulldown or the minutes after a large block of zones opens at once.

Possible Diagnoses

Transcribed from G36 §5.16.14 FC#13:

1. SAT sensor error
2. Cooling coil valve stuck closed or actuator failure
3. Fouled or undersized cooling coil
4. CHW temperature too high or CHW unavailable
5. DX cooling unavailable
6. Gas or electric heat stuck on
7. Heating coil valve leaking or stuck open

The list is FC#12’s minus the MAT sensor, which this rule does not read. Entries 6 and 7 are heat sources fighting the coil, so a unit that trips this rule and AHU-0012 together is pointing at those two rather than at the coil.

Energy Impact

EXCESS_CONSUMPTION, MEDIUM confidence, PROXY_ESTIMATION, savings 2–5% of AHU energy — the §5.8.1 index row, the only energy statement the reference makes here (no EEM mapped). The estimate is branched because the rule does not say which branch you are in. If a heat source is fighting the coil, the waste is immediate and AHU-0016’s term sizes it. If the coil, the chilled water, or the compressor is simply not delivering, the AHU wastes nothing at the coil and the cost lands downstream: shortfall_kw = supply_airflow_m3s × 1.2 × 1.005 × (sat − sat_sp), made up by extra airflow at fan power if it is made up at all. Design airflow substituting for a measured one keeps it a proxy. Cooling-dominant, since the rule is evaluated only in mechanical-cooling states.

Emissions Impact

PROXY_EMISSIONS, MEDIUM confidence. Scope 2: everything this fault spends is purchased electricity — the chiller or DX compressor running longer, and the fan power moving extra air. Diagnoses 6 and 7 can put a combustion stream behind the fault, but that is heat this rule cannot see; AHU-0012 measures it and carries the Scope 1 half. Emissions can rise rather than fall when the fault is fixed, since a coil restored to capacity finally delivers the cooling the building has been asking for — this rule buys comfort and diagnosis, and the avoided-emissions claim belongs to whatever waste the repair uncovers. Avoided-emissions basis: marginal operating emissions rate (MOER), applicable only to the fighting-heat-source branch.

Deviations

• The reference card is abbreviated; G36 is the normative text. The HVAC FDD Reference carries AHU-0013 only as a §5.8.1 index row — no equation, internal variables, vectors, severity, diagnoses, or preconditions. Detection logic and the diagnosis list are transcribed from ASHRAE Guideline 36 §5.16.14 FC#13 as it appears in Addendum u to Guideline 36-2018 (First Public Review, 2021).
• Setpoint comparison rewritten as gap comparison. Subtracting first and testing sat − sat_sp > eSAT keeps the allowance the positive number G36 publishes at one CXF path, instead of an offset added to the setpoint ahead of a two-signal comparison. Same rearrangement as AHU-0001 and AHU-0028. The threshold is a single G36 constant rather than a composition — eSAT = 1 °C, the NISTIR 7365 supply-air sensor accuracy — so recalibrating that sensor changes sat_error_threshold directly, with no arithmetic.
• CC >= 99% becomes a strict > 99.0. CDL Reals offers only strict comparisons, so a command parked at exactly 99.000% reads as not-saturated and the rule stays silent where G36 would evaluate it. Same deviation and retune hint as AHU-0001 and AHU-0007: a host binding a coarsely quantized command should set cc_full_threshold to 98.9 rather than rely on the signal overshooting.
• Instantaneous samples instead of 5-minute rolling averages. G36 computes every §5.16.14 signal as a 5-minute rolling average with 1-minute sampling; this library consumes instantaneous points and lets the 30-minute AlarmDelay stand in. Not equivalent — persistence resets on every compliant tick, so an oscillating signal can hide indefinitely; the realistic instance here is a hunting SAT loop, which is AHU-0022’s fault to report. A steady miss against a saturated valve reads the same either way. (Honesty note from AHU-0002.)
• Operating states and ModeDelay are host-side preconditions. G36 scopes FC#13 to OS#3–#4, suspends evaluation for ModeDelay (30 min) after a mode change in a served zone group, and suspends it entirely while the AHU is off; none of it is in the graph, per the library’s stance (precedent AHU-0029). CC > 0 is part of both applicable state definitions, so the host’s gate already implies a cooling call — the graph’s clgFull test is the stronger statement that the call has saturated.
• Severity 3 is the library’s. No chapter card states one and the §5.8.1 index carries no severity column. G36’s Level 3 alarm grading is a reporting priority rather than this library’s 1–4 scale, so it corroborates without supplying.
• The energy profile is the index row’s; the runtime formula and scope are the library’s. category, confidence, estimation_method, and savings_range are copied from §5.8.1 — the identical row the reference gives AHU-0007, this rule’s heating-side mirror. The branched formula is mirrored from FC-007’s, but the scope departs from it: FC-007 records 1|2 because the heat making up its deficit may be gas or electric, while nothing on the cooling side burns fuel, so this card records 2 and leaves the Scope 1 half of the shared diagnoses to AHU-0012.
• persist.delayOnInit = true (Modelica/CDL default is false), the library’s standing choice: a violation already present at load waits out the full 30 minutes instead of alarming on the first tick after a controller restart.

Notes

The setpoint this rule compares against is the one the sequence is actually holding, which makes it quietly dependent on the reset strategy. Where SAT reset has been disabled or never commissioned — the condition AHU-0023 detects — the active setpoint may be a design-day value, and a coil that cannot reach it in August is being asked for capacity nobody budgeted. Read this rule together with AHU-0012: every diagnosis here appears there, and what differs is that FC#12 finds heat entering the stream while FC#13 finds heat failing to leave it. A coil that has lost capacity trips this rule alone; a heat source fighting the coil trips both, which is the cheapest discriminator available before anyone opens an access panel.

Test Vectors

10 scenarios, clock step 300 s over 5400 s.

{
  "schema": "cxf-library/vectors/v1",
  "clock": {
    "step_s": 300,
    "horizon_s": 5400
  },
  "scenarios": [
    {
      "name": "coil_modulating_on_setpoint",
      "description": "Ordinary mechanical cooling: SAT is on its 13 \u00b0C setpoint with the valve at 65%. The loop has reserve in both directions, which is what a healthy cooling coil looks like",
      "inputs": {
        "sat": 13.0,
        "sat_sp": 13.0,
        "clg_vlv_cmd": 65.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "valve_wide_open_holding_setpoint",
      "description": "The valve is at 100% and SAT is 0.5 \u00b0C high \u2014 a coil sized close to its design point on a design day. Half a degree is inside eSAT, so this is a unit at capacity, not a unit that has lost capacity",
      "inputs": {
        "sat": 13.5,
        "sat_sp": 13.0,
        "clg_vlv_cmd": 100.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "sat_error_exactly_at_threshold",
      "description": "Threshold edge: SAT \u2212 SATSP = 1.0 \u00b0C exactly, the whole eSAT allowance, with the valve at 100%. `spMiss` is a strict `>`, so an error sitting precisely on the sensor allowance reads healthy",
      "inputs": {
        "sat": 14.0,
        "sat_sp": 13.0,
        "clg_vlv_cmd": 100.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "sat_error_just_over_threshold",
      "description": "Threshold edge, other side: 1.1 \u00b0C above setpoint at 100% valve clears the strict comparison, and the alarm asserts one alarm_delay (1800 s) later",
      "inputs": {
        "sat": 14.1,
        "sat_sp": 13.0,
        "clg_vlv_cmd": 100.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 5400,
          "equals": true
        }
      ]
    },
    {
      "name": "valve_exactly_at_full_threshold",
      "description": "Threshold edge: a 5 \u00b0C setpoint miss with the valve parked on exactly 99.0%. `clgFull` is a strict `>`, so a command sitting on cc_full_threshold does not count as saturated and the rule stays silent",
      "inputs": {
        "sat": 18.0,
        "sat_sp": 13.0,
        "clg_vlv_cmd": 99.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "valve_just_over_full_threshold",
      "description": "Threshold edge, other side: the same 5 \u00b0C miss with the valve at 99.5% clears the strict comparison and alarms after alarm_delay",
      "inputs": {
        "sat": 18.0,
        "sat_sp": 13.0,
        "clg_vlv_cmd": 99.5
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 5400,
          "equals": true
        }
      ]
    },
    {
      "name": "coil_saturated_and_missing_setpoint",
      "description": "The valve is wide open and SAT is stuck 5 \u00b0C above setpoint \u2014 the control loop has asked for everything and the temperature has not moved. Chilled water too warm, a fouled or undersized coil, or a valve that reports open and is not: capacity, supply, or sensor, never tuning",
      "inputs": {
        "sat": 18.0,
        "sat_sp": 13.0,
        "clg_vlv_cmd": 100.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 5400,
          "equals": true
        }
      ]
    },
    {
      "name": "morning_pulldown_clears_before_delay",
      "description": "Transient: the valve pins at 100% and SAT runs 5 \u00b0C high while the coil pulls the building down after a warm night, reaching setpoint at t = 1200. A pulldown is shorter than alarm_delay, so nothing alarms",
      "inputs": {
        "sat": [
          {
            "t": 0,
            "value": 18.0
          },
          {
            "t": 1200,
            "value": 13.2
          }
        ],
        "sat_sp": 13.0,
        "clg_vlv_cmd": 100.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "fault_clears_when_chilled_water_returns",
      "description": "A saturated valve missing setpoint alarms at 1800 s; the chiller comes back at t = 3000 and SAT reaches setpoint. `TrueDelay` has no off-delay, so the alarm drops on that tick",
      "inputs": {
        "sat": [
          {
            "t": 0,
            "value": 18.0
          },
          {
            "t": 3000,
            "value": 13.0
          }
        ],
        "sat_sp": 13.0,
        "clg_vlv_cmd": 100.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 2700,
          "equals": true
        },
        {
          "output": "yFault",
          "from_s": 3300,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "valve_backs_off_before_delay",
      "description": "Transient: SAT stays 5 \u00b0C high but the valve modulates back to 85% at t = 1200. A loop with reserve left is a loop still working, so persistence restarts and no alarm follows \u2014 the saturation half is what makes the setpoint miss evidence of a defect",
      "inputs": {
        "sat": 18.0,
        "sat_sp": 13.0,
        "clg_vlv_cmd": [
          {
            "t": 0,
            "value": 100.0
          },
          {
            "t": 1200,
            "value": 85.0
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    }
  ]
}

AHU-0014 — Inactive cooling coil temperature drop

Preconditions (host-enforced): Supply fan running, and the unit in one of the two states where G36 requires the cooling coil to be off: OS#1 heating (Table 5.16.14.2: HC > 0, CC = 0, OA damper at minimum) or OS#2 free cooling (HC = 0, CC = 0, minimum < OA damper < 100%). In OS#3 and OS#4 the coil is commanded to cool and a drop across it is the intended result, not a fault. Suspend evaluation for ModeDelay (30 min) after any mode or operating-state change in a zone group the AHU serves, and whenever the AHU is not operating (G36 §5.16.14.11) — a coil coasting down still shows its drop. This binding reads the coil through MAT and SAT, so a unit with no MAT sensor cannot run the rule as shipped: install dedicated coil sensors and rebind, or omit. Silence the rule while AHU-0028 is active: a MAT outside the OAT/RAT envelope is not a coil entering temperature. When any gate is unmet the verdict is NO_EVAL, not healthy.

Points: mat, sat

Outputs:

• yFault — True while mat has stayed more than coil_drop_threshold above sat for at least alarm_delay

Parameters:

Description

In OS#1 and OS#2 the cooling coil is closed by definition — G36 identifies both states partly by CC = 0. Air crossing the unit meets the supply fan and nothing else, so it reaches the supply sensor about a degree warmer than it left the mixing box. When SAT instead reads several degrees below MAT, something is pulling heat out of the stream: chilled water past a valve that reports itself shut, or a DX circuit that never got the message to stop.

The waste is worst in OS#1, where every kilowatt the leaking coil removes is a kilowatt the heating coil is paid to put back — the AHU-0016 failure arriving through a different door. In OS#2 there is no heating bill, but chilled water is still being made and pumped for air the economizer was cooling for nothing. This rule and AHU-0015 are AHU-0016’s silent siblings: that rule reads the two valve commands and needs both past 5% open, so a valve reporting 0% and flowing anyway is invisible to it. This pair reads the temperature signature and does not care what the command says.

Detection Logic

drop   = mat − sat
yFault = drop > coil_drop_threshold,
         sustained continuously for alarm_delay

Block graph (rule.cxf.jsonld):

G36 writes the test as CCET_AVG − CCLT_AVG ≥ sqrt(eCCET² + eCCLT²) + ΔTSF*, footnoting the fan-heat factor as included or not depending on where the coil sensors sit. This library binds CCET := mat and CCLT := sat — the instrumentation most air handlers actually have — which brings the proxied epsilons (3 °C mixed-air, 1 °C supply-air, root-sum-square 3.1623 °C) and puts the supply fan inside the measurement, so the ΔTSF term applies: 3.1623 + 1 = 4.1623 °C.

Follow that arithmetic, because for a drop the fan works against the signal. Fan heat and coil cooling move the air in opposite directions, so mat − sat measures the true coil drop minus one dTSF and a measured 4.1623 °C is a real drop of about 5.16 °C. The shipped default is therefore doubly conservative — the direction the addendum says its defaults are chosen for — and sites that want the sharper test retune (see Deviations).

The comparison is strict, so a drop sitting exactly on 4.1623 °C reads healthy where G36 would report the fault. persist requires 30 continuous minutes and any interruption restarts the timer, which separates a leaking valve from a coil giving up the chilled water still standing in it after a state change.

Possible Diagnoses

Transcribed from G36 §5.16.14 FC#14:

1. CCET sensor error
2. CCLT sensor error
3. Cooling coil valve stuck open or leaking
4. DX cooling stuck on

Under this library’s binding, diagnoses 1 and 2 read as MAT and SAT sensor error, and they are the cheap ones to eliminate first. Diagnosis 3 dominates in the field and is why the card carries the stuck-actuator playbook: a two-way valve whose seat has eroded, or an actuator that has lost its close position, passes water at a command of 0% and no command-based rule will ever see it. Diagnosis 4 is the DX equivalent — a stuck contactor or a compressor a local safety has latched on.

Energy Impact

CRITICAL_WASTE, HIGH confidence, DIRECT_MEASUREMENT, savings 0.5–5% of site energy mapped to PNNL EEM-03 (leaking coil valves) — the §5.8.1 index row, the only energy statement the reference makes here. DIRECT_MEASUREMENT is honest in a way it is not for the abbreviated comparison rules: the two temperatures the rule already reads are the measurement.

waste_kw = supply_airflow_m3s × 1.2 × 1.005 × ((mat − sat) + dTSF)

The fan’s rise is added back because the measured drop under-reports the coil’s work by that much; design airflow is the one substitution. HIGH confidence because a sustained drop across a coil commanded shut has no benign explanation other than a sensor, and the sensor case shows up as a drop that does not move with load. Heating-dominant despite being a cooling fault, following the operating states: OS#1 is a heating state, and the hours a leaking chilled-water valve does the most damage are the hours a heating coil is fighting it.

Emissions Impact

PROXY_EMISSIONS, scope 1+2, both library-assigned since the §5.8.1 index publishes no emissions column. The unwanted cooling is purchased electricity at the chiller or DX compressor (Scope 2), and in OS#1 the heating that cancels it follows whatever the plant burns — Scope 1 for gas, Scope 2 for electric resistance or a heat pump. On an all-electric site the exchange collapses to Scope 2, and when the cause is a sensor there is nothing to attribute. Avoided-emissions basis: marginal operating emissions rate (MOER) for the electric half, static combustion factor for the fuel half.

Deviations

• The reference card is abbreviated; G36 is the normative text. The HVAC FDD Reference carries AHU-0014 only as a §5.8.1 index row — no equation, internal variables, vectors, severity, diagnoses, or preconditions. Detection logic and the diagnosis list are transcribed from ASHRAE Guideline 36 §5.16.14 FC#14 as it appears in Addendum u to Guideline 36-2018 (First Public Review, 2021).
• CCET and CCLT are bound to MAT and SAT. G36 leaves the instrumentation open (§5.16.14.5) and Table 5.16.14.5 supplies the proxied epsilons. The consequence is that the rule sees the whole air path from the mixing box to the supply sensor: the fan is inside the measurement (handled by dTSF) and so is any duct heat gain between coil and sensor (not handled — it biases the drop downward and makes the rule quieter still). A site with dedicated coil sensors rebinds the two boundary inputs at deployment and retunes coil_drop_threshold with its own sensor errors; because the fan is then outside the pair, that retune also drops the dTSF term.
• The fan-heat term is included, and for this fault it works against the signal. A measured 4.1623 °C at the threshold is a true coil drop of 5.16 °C, where the sensor bands alone would justify reporting at 3.16 °C — the shipped default demands a leak 63% larger than the noise floor does, and the cost is real misses of modest leaks. Two worked retunes for sites that want the sharper test: dedicated sensors bracketing the coil with the fan outside the pair drop the term entirely (3.1623 with a 3 °C entering band, ≈1.41 with a matched ±1 °C pair); keeping the mat/sat binding but accepting G36’s noise floor on the true drop gives sqrt(10) − 1 = 2.1623.
• G36’s ≥ becomes a strict >. CDL Reals offers only strict comparisons, so a drop of exactly 4.1623 °C reads healthy where G36 reports the fault. Measure zero on a real temperature signal, and it errs toward silence. A host binding coarsely quantized temperatures should retune the threshold down rather than rely on the signal overshooting.
• The threshold is a rounded constant, not a root-sum-square computed in the graph. sqrt(3² + 1²) + 1 = 4.16227766…, shipped as 4.1623 — high by 2.2 × 10⁻⁵ °C, four orders of magnitude below the resolution of the sensors feeding it, and one number to retune instead of three.
• Instantaneous samples instead of 5-minute rolling averages. G36 computes every §5.16.14 signal as a 5-minute rolling average with 1-minute sampling; this library consumes instantaneous points and lets the 30-minute AlarmDelay stand in. Not equivalent — persistence resets on every compliant tick, so an oscillating drop (a short-cycling DX stage) can hide indefinitely, while the steady leak of a failed valve seat reads the same either way. (Honesty note from AHU-0002.)
• Operating states, ModeDelay, and the not-operating suspension are host-side preconditions. G36 scopes FC#14 to OS#1–#2 and suspends evaluation after a mode change in a served zone group and whenever the AHU is off; none of it is in the graph, per the library’s stance. G36 attaches no “omit if no MAT sensor” qualifier to FC#14 — it contemplates dedicated coil sensors — but this library’s binding needs MAT, so the qualifier applies to the shipped rule and lives in preconditions.
• Severity 2 is the library’s. The §5.8.1 index carries no severity column. Severity 2 puts this fault with AHU-0016 and AHU-0020 rather than the 001-range comparison rules at 3, which is where CRITICAL_WASTE and HIGH confidence point. G36’s Level 3 alarm grading is a priority scheme, not this library’s 1–4 scale.
• The energy profile is the index row’s; the runtime formula, climate sensitivity, and emissions block are the library’s, reasoned from the operating states the fault is evaluated in.
• persist.delayOnInit = true (Modelica/CDL default is false), the library’s standing choice: a violation already present at load waits out the full 30 minutes instead of alarming on the first tick after a controller restart.

Notes

In OS#1 this rule overlaps AHU-0005, which tests the same two sensors in the same direction against a narrower 3.0 °C threshold and therefore alarms first on any leak large enough to trip both; the value of this rule there is its diagnosis list, which names the cooling coil and the DX circuit directly. It stands alone in OS#2. The threshold asymmetry between the two is about how sensor bands compose — linearly for AHU-0005, in quadrature here — and the fan-heat term then moves opposite ways, leaving this rule the quieter despite the tighter bands. Start at the sensors, since a MAT reading high or a SAT reading low produces this trace with nothing wrong in the mechanical room; an active AHU-0028 should already be suppressing the rule. Then isolate the coil and watch the drop disappear, and let the stuck-actuator playbook separate a failed actuator from an eroded seat.

Test Vectors

9 scenarios, clock step 300 s over 5400 s.

{
  "schema": "cxf-library/vectors/v1",
  "clock": {
    "step_s": 300,
    "horizon_s": 5400
  },
  "scenarios": [
    {
      "name": "heating_state_with_the_cooling_coil_off",
      "description": "OS#1: a 18 \u00b0C mixture leaves the unit at 19 \u00b0C. The only thing the air crossed between the two sensors was the supply fan, so it gained dTSF = 1 \u00b0C and the cooling coil took nothing back. `drop` = mat \u2212 sat = \u22121 \u00b0C, the healthy signature of an inactive cooling coil on a draw-through unit",
      "inputs": {
        "mat": 18.0,
        "sat": 19.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "drop_exactly_at_threshold",
      "description": "Threshold edge: mat \u2212 sat = 4.1623 \u00b0C exactly, the composed sqrt(eCCET\u00b2 + eCCLT\u00b2) + dTSF allowance. `dropBig` is a strict `>`, so a drop sitting precisely on the allowance reads healthy \u2014 G36's `\u2265` would report it (see Deviations)",
      "inputs": {
        "mat": 20.0,
        "sat": 15.8377
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "drop_just_over_threshold",
      "description": "Threshold edge, other side: mat \u2212 sat = 4.2623 \u00b0C clears the strict comparison on the first tick and the alarm asserts one alarm_delay (1800 s) later",
      "inputs": {
        "mat": 20.0,
        "sat": 15.7377
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 5400,
          "equals": true
        }
      ]
    },
    {
      "name": "chilled_water_valve_leaking_during_heating",
      "description": "OS#1 with the cooling valve commanded 0%: a 20 \u00b0C mixture arrives at the supply sensor at 12 \u00b0C. Adding the fan's own 1 \u00b0C rise back, the coil is pulling roughly 9 \u00b0C out of air the heating coil is simultaneously paying to warm. AHU-0016 cannot see this \u2014 the cooling command reads zero and the water is flowing anyway",
      "inputs": {
        "mat": 20.0,
        "sat": 12.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 5400,
          "equals": true
        }
      ]
    },
    {
      "name": "sat_sensor_reading_low",
      "description": "Same 6 \u00b0C signature with the chilled-water plant off for the season and the valve verified shut: nothing is removing heat, and the supply sensor is what is wrong. The rule reports the contradiction and cannot say which of the two sensors is lying \u2014 G36 lists both sensor errors ahead of the valve in its diagnosis order",
      "inputs": {
        "mat": 21.0,
        "sat": 15.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 5400,
          "equals": true
        }
      ]
    },
    {
      "name": "modest_drop_below_shipped_default",
      "description": "A real but small leak: measured mat \u2212 sat = 3.5 \u00b0C, which after adding the fan's 1 \u00b0C rise back is a true coil drop of about 4.5 \u00b0C. The shipped 4.1623 \u00b0C threshold is measured against mat \u2212 sat, so it demands a true drop of ~5.16 \u00b0C and stays silent here. A site that retunes to sqrt(10) \u2212 1 = 2.1623 (keeping the mat/sat binding but dropping the fan-heat term from the allowance) catches this leak; the shipped default is deliberately the quieter one",
      "inputs": {
        "mat": 20.0,
        "sat": 16.5
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "transient_clears_before_alarm_delay",
      "description": "Transient: an 8 \u00b0C drop persists for 1200 s while chilled water still standing in a just-closed coil boils off, then SAT returns to mat + fan heat. Anything shorter than alarm_delay never reaches the operator",
      "inputs": {
        "mat": 20.0,
        "sat": [
          {
            "t": 0,
            "value": 12.0
          },
          {
            "t": 1200,
            "value": 19.0
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "fault_clears_on_recovery",
      "description": "A sustained 8 \u00b0C drop alarms at 1800 s; the leaking valve is isolated at t = 3000 and SAT climbs back to mat + fan heat. `TrueDelay` has no off-delay, so the alarm drops on that tick",
      "inputs": {
        "mat": 20.0,
        "sat": [
          {
            "t": 0,
            "value": 12.0
          },
          {
            "t": 3000,
            "value": 19.0
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 2700,
          "equals": true
        },
        {
          "output": "yFault",
          "from_s": 3300,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "oscillating_drop_never_alarms",
      "description": "A DX stage short-cycling on a 10-minute period swings the drop between 8 \u00b0C and \u22121 \u00b0C. Its mean is well outside the allowance and G36's 5-minute rolling average would report the fault, but persistence restarts on every compliant tick, so this rule stays silent \u2014 the limit of substituting TrueDelay for averaging (see Deviations)",
      "inputs": {
        "mat": 20.0,
        "sat": [
          {
            "t": 0,
            "value": 12.0
          },
          {
            "t": 600,
            "value": 21.0
          },
          {
            "t": 1200,
            "value": 12.0
          },
          {
            "t": 1800,
            "value": 21.0
          },
          {
            "t": 2400,
            "value": 12.0
          },
          {
            "t": 3000,
            "value": 21.0
          },
          {
            "t": 3600,
            "value": 12.0
          },
          {
            "t": 4200,
            "value": 21.0
          },
          {
            "t": 4800,
            "value": 12.0
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    }
  ]
}

AHU-0015 — Inactive heating coil temperature rise

Preconditions (host-enforced): Supply fan running, and the unit in one of the three states where G36 requires the heating coil to be off (Table 5.16.14.2): OS#2 free cooling (HC = 0, CC = 0, minimum < OA damper < 100%), OS#3 mechanical plus economizer cooling (HC = 0, CC > 0, OA damper = 100%), or OS#4 mechanical cooling on minimum OA (HC = 0, CC > 0, OA damper at minimum). In OS#1 the coil is commanded to heat and a rise across it is the intended result, not a fault. Suspend evaluation for ModeDelay (30 min) after any mode or operating-state change in a zone group the AHU serves, and whenever the AHU is not operating (G36 §5.16.14.11) — a coil coasting down still shows its rise, and a preheat coil in freeze protection shows one on purpose. This binding reads the coil through MAT and SAT, so a unit with no MAT sensor cannot run the rule as shipped: install dedicated coil sensors and rebind, or omit. Silence the rule while AHU-0028 is active: a MAT outside the OAT/RAT envelope is not a coil entering temperature. When any gate is unmet the verdict is NO_EVAL, not healthy.

Points: sat, mat

Outputs:

• yFault — True while sat has stayed more than coil_rise_threshold above mat for at least alarm_delay

Parameters:

Description

In OS#2, OS#3, and OS#4 the heating coil is closed by definition — G36 identifies all three states partly by HC = 0. Air crossing the unit should pick up the supply fan’s degree of shaft work and nothing more. When SAT reads several degrees above MAT anyway, hot water is moving through a valve that reports itself shut, or an electric or gas stage is energized that nothing called for.

In OS#3 and OS#4 the cooling coil is running at the same time, so every kilowatt the leaking coil adds is a kilowatt the chiller is paid to remove — the AHU-0016 failure arriving through a different door. In OS#2 the leak spends the economizer’s savings by warming the outdoor air that was supposed to do the cooling, often pushing the unit into mechanical cooling it did not need. This rule and AHU-0014 are AHU-0016’s silent siblings: that rule reads the two valve commands and needs both past 5% open, so a valve reporting 0% and flowing anyway is invisible to it.

Detection Logic

rise   = sat − mat
yFault = rise > coil_rise_threshold,
         sustained continuously for alarm_delay

Block graph (rule.cxf.jsonld):

G36 writes the test as HCLT_AVG − HCET_AVG ≥ sqrt(eHCET² + eHCLT²) + ΔTSF*, footnoting the fan-heat factor as included or not depending on where the coil sensors sit. This library binds HCET := mat and HCLT := sat — the instrumentation most air handlers actually have — which brings the proxied epsilons (3 °C mixed-air, 1 °C supply-air, root-sum-square 3.1623 °C) and puts the supply fan inside the measurement, so the ΔTSF term applies: 3.1623 + 1 = 4.1623 °C.

Here the term is doing physical work rather than bookkeeping. A healthy draw-through unit with both coils shut already reads sat − mat = +1.0 °C. Drop the term and the test charges that degree to the coil: the threshold falls to 3.1623 °C, a true coil rise of 2.17 °C reports as a leak, and on a unit whose fan adds more than 3.16 °C the alarm never clears. With the term the shipped test fires precisely when the coil’s own contribution exceeds the 3.1623 °C sensor floor.

The comparison is strict, so a rise sitting exactly on 4.1623 °C reads healthy where G36 would report the fault. persist requires 30 continuous minutes and any interruption restarts the timer, which separates a leaking valve from a coil giving up the hot water still standing in it after a state change.

Possible Diagnoses

Transcribed from G36 §5.16.14 FC#15:

1. HCET sensor error
2. HCLT sensor error
3. Heating coil valve stuck open or leaking

The single-zone version of the same row (§5.18.14, the SZVAV table in Addendum u) adds “gas or electric heat stuck on”, which applies to any unit with a non-hydronic heat source even though the VAV row omits it.

Under this library’s binding, diagnoses 1 and 2 read as MAT and SAT sensor error, and they are the cheap ones to eliminate first. Diagnosis 3 dominates in the field and is why the card carries the stuck-actuator playbook: a two-way valve whose seat has eroded, or an actuator that has lost its close position, passes water at a command of 0% and no command-based rule will ever see it.

Energy Impact

CRITICAL_WASTE, HIGH confidence, DIRECT_MEASUREMENT, savings 0.5–5% of site energy mapped to PNNL EEM-03 (leaking coil valves) — the §5.8.1 index row, the only energy statement the reference makes here. DIRECT_MEASUREMENT is honest in a way it is not for the abbreviated comparison rules: the two temperatures the rule already reads are the measurement.

waste_kw = supply_airflow_m3s × 1.2 × 1.005 × ((sat − mat) − dTSF)

Subtracting the fan rise is not a rounding detail — at the threshold it is 1.0 of a 4.16 °C measured rise, so crediting it to the coil would overstate the waste by about a third, and more on any smaller leak. Design airflow is the one substitution. HIGH confidence because a sustained rise across a coil commanded shut has no benign explanation other than a sensor, and the sensor case shows up as a rise that does not move with load. Cooling-dominant, following the operating states: all three are cooling-side, and in OS#3–#4 the leak is paid for twice, once at the boiler and once at the chiller.

Emissions Impact

PROXY_EMISSIONS, scope 1+2, both library-assigned since the §5.8.1 index publishes no emissions column. The leaked heat is Scope 1 or Scope 2 depending on the plant (gas boiler versus electric resistance or a heat pump), and the cooling that removes it again in OS#3–#4 is purchased electricity, Scope 2. On an all-electric site the exchange collapses to Scope 2, and when the cause is a sensor there is nothing to attribute. Avoided-emissions basis: marginal operating emissions rate (MOER) for the electric half, static combustion factor for the fuel half.

Deviations

• The reference card is abbreviated; G36 is the normative text. The HVAC FDD Reference carries AHU-0015 only as a §5.8.1 index row — no equation, internal variables, vectors, severity, diagnoses, or preconditions. Detection logic and the diagnosis list are transcribed from ASHRAE Guideline 36 §5.16.14 FC#15 as it appears in Addendum u to Guideline 36-2018 (First Public Review, 2021); the fourth diagnosis comes from the addendum’s single-zone table (§5.18.14) and is marked as such.
• HCET and HCLT are bound to MAT and SAT. G36 leaves the instrumentation open (§5.16.14.5) and Table 5.16.14.5 supplies the proxied epsilons. The consequence is that the rule sees the whole air path from the mixing box to the supply sensor: the fan is inside the measurement (handled by dTSF) and so is any duct heat gain between coil and sensor (not handled — on this fault it biases the rise upward and makes the rule slightly louder, the opposite of its effect on AHU-0014). A site with dedicated coil sensors rebinds the two boundary inputs at deployment and retunes coil_rise_threshold with its own sensor errors; because the fan is then outside the pair, that retune also drops the dTSF term.
• The fan-heat term is included, and here it is what keeps healthy units quiet. Fan heat and coil heat both raise SAT, so the measured rise is the true coil rise plus one dTSF and the threshold must discount the fan’s own contribution before charging anything to the coil. Unlike its cooling-side twin this rule is not additionally desensitized by the binding, so there is no sharper retune of the same kind to offer; sites with a measured fan rise other than 1 °C substitute it in the sum directly.
• G36’s ≥ becomes a strict >. CDL Reals offers only strict comparisons, so a rise of exactly 4.1623 °C reads healthy where G36 reports the fault. Measure zero on a real temperature signal, and it errs toward silence. A host binding coarsely quantized temperatures should retune the threshold down rather than rely on the signal overshooting.
• The threshold is a rounded constant, not a root-sum-square computed in the graph. sqrt(3² + 1²) + 1 = 4.16227766…, shipped as 4.1623 — high by 2.2 × 10⁻⁵ °C, four orders of magnitude below the resolution of the sensors feeding it, and one number to retune instead of three.
• Instantaneous samples instead of 5-minute rolling averages. G36 computes every §5.16.14 signal as a 5-minute rolling average with 1-minute sampling; this library consumes instantaneous points and lets the 30-minute AlarmDelay stand in. Not equivalent — persistence resets on every compliant tick, so an oscillating rise (a short-cycling electric stage) can hide indefinitely, while the steady leak of a failed valve seat reads the same either way. (Honesty note from AHU-0002.)
• Operating states, ModeDelay, and the not-operating suspension are host-side preconditions. G36 scopes FC#15 to OS#2–#4 and suspends evaluation after a mode change in a served zone group and whenever the AHU is off; none of it is in the graph, per the library’s stance. Freeze protection deserves its own mention there: a preheat coil driven open to protect itself produces this exact signature while doing its job. G36 attaches no “omit if no MAT sensor” qualifier to FC#15, but this library’s binding needs MAT, so the qualifier applies to the shipped rule and lives in preconditions.
• Severity 2 is the library’s. The §5.8.1 index carries no severity column. Severity 2 puts this fault with AHU-0016 and AHU-0020 rather than the 001-range comparison rules at 3, which is where CRITICAL_WASTE and HIGH confidence point. G36’s Level 3 alarm grading is a priority scheme, not this library’s 1–4 scale.
• The energy profile is the index row’s; the runtime formula, climate sensitivity, and emissions block are the library’s, reasoned from the operating states the fault is evaluated in.
• persist.delayOnInit = true (Modelica/CDL default is false), the library’s standing choice: a violation already present at load waits out the full 30 minutes instead of alarming on the first tick after a controller restart.

Notes

This rule and AHU-0012 test the same sign, on the same two sensors, in overlapping states, and both exist on purpose. AHU-0012 thresholds at eSAT + eMAT + ΔTSF = 5.0 °C — bands added linearly, worst case — while this one adds them in quadrature to 4.1623 °C, the sharper composition when the errors are independent, so this rule alarms first by 0.84 °C of rise. FC#12’s diagnosis list is broad and includes cooling-side capacity failures; FC#15 names the heating coil and its sensors and nothing else, so a host that wants one alarm should keep this one. Start at the sensors, since a MAT reading low or a SAT reading high produces this trace with nothing wrong in the mechanical room; an active AHU-0028 should already be suppressing the rule. Then isolate the coil and watch the rise collapse to fan heat — or, on electric or gas heat, check the stage’s contactor or safety interlock.

Test Vectors

8 scenarios, clock step 300 s over 5400 s.

{
  "schema": "cxf-library/vectors/v1",
  "clock": {
    "step_s": 300,
    "horizon_s": 5400
  },
  "scenarios": [
    {
      "name": "healthy_unit_shows_fan_heat_only",
      "description": "The pin this rule exists to keep clear: a draw-through unit with the heating coil shut still warms its air by dTSF = 1 \u00b0C crossing the supply fan, so sat \u2212 mat = +1.0 \u00b0C in every healthy OS#2-#4 hour. The 4.1623 \u00b0C threshold carries the fan-heat term precisely so this reads healthy forever; without it every healthy AHU in the fleet would alarm",
      "inputs": {
        "mat": 18.0,
        "sat": 19.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "rise_exactly_at_threshold",
      "description": "Threshold edge: sat \u2212 mat = 4.1623 \u00b0C exactly, the composed sqrt(eHCET\u00b2 + eHCLT\u00b2) + dTSF allowance. `riseBig` is a strict `>`, so a rise sitting precisely on the allowance reads healthy \u2014 G36's `\u2265` would report it (see Deviations)",
      "inputs": {
        "mat": 15.8377,
        "sat": 20.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "rise_just_over_threshold",
      "description": "Threshold edge, other side: sat \u2212 mat = 4.2623 \u00b0C clears the strict comparison on the first tick and the alarm asserts one alarm_delay (1800 s) later",
      "inputs": {
        "mat": 15.7377,
        "sat": 20.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 5400,
          "equals": true
        }
      ]
    },
    {
      "name": "heating_valve_leaking_during_free_cooling",
      "description": "OS#2 on a mild morning: the economizer mixes to 16 \u00b0C and the air reaches the supply sensor at 23 \u00b0C with the heating valve commanded 0%. Take the fan's 1 \u00b0C back out and the coil is adding about 6 \u00b0C to air the economizer was brought in to cool \u2014 hot water flowing through a valve that reports itself shut, which is exactly the leak AHU-0016 is structurally blind to",
      "inputs": {
        "mat": 16.0,
        "sat": 23.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 5400,
          "equals": true
        }
      ]
    },
    {
      "name": "mat_sensor_reading_low",
      "description": "Same 6 \u00b0C signature in a season when the hot-water plant is locked out and the valve has been verified shut: no coil can be adding heat, and the mixed-air sensor is what is wrong. The rule reports the contradiction; G36 lists both sensor errors ahead of the valve in its diagnosis order for this reason",
      "inputs": {
        "mat": 14.0,
        "sat": 20.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 5400,
          "equals": true
        }
      ]
    },
    {
      "name": "transient_clears_before_alarm_delay",
      "description": "Transient: a 7 \u00b0C rise persists for 1200 s while hot water standing in a just-closed coil gives up its residual heat, then SAT settles back to mat + fan heat. Anything shorter than alarm_delay never reaches the operator",
      "inputs": {
        "mat": 16.0,
        "sat": [
          {
            "t": 0,
            "value": 23.0
          },
          {
            "t": 1200,
            "value": 17.0
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "fault_clears_on_recovery",
      "description": "A sustained 7 \u00b0C rise alarms at 1800 s; the leaking valve is isolated at t = 3000 and SAT falls back to mat + fan heat. `TrueDelay` has no off-delay, so the alarm drops on that tick",
      "inputs": {
        "mat": 16.0,
        "sat": [
          {
            "t": 0,
            "value": 23.0
          },
          {
            "t": 3000,
            "value": 17.0
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1500,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2100,
          "to_s": 2700,
          "equals": true
        },
        {
          "output": "yFault",
          "from_s": 3300,
          "to_s": 5400,
          "equals": false
        }
      ]
    },
    {
      "name": "oscillating_rise_never_alarms",
      "description": "An electric heating stage short-cycling on a 10-minute period swings the rise between 7 \u00b0C and 1 \u00b0C. Its mean is well outside the allowance and G36's 5-minute rolling average would report the fault, but persistence restarts on every compliant tick, so this rule stays silent \u2014 the limit of substituting TrueDelay for averaging (see Deviations)",
      "inputs": {
        "mat": 16.0,
        "sat": [
          {
            "t": 0,
            "value": 23.0
          },
          {
            "t": 600,
            "value": 17.0
          },
          {
            "t": 1200,
            "value": 23.0
          },
          {
            "t": 1800,
            "value": 17.0
          },
          {
            "t": 2400,
            "value": 23.0
          },
          {
            "t": 3000,
            "value": 17.0
          },
          {
            "t": 3600,
            "value": 23.0
          },
          {
            "t": 4200,
            "value": 17.0
          },
          {
            "t": 4800,
            "value": 23.0
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 5400,
          "equals": false
        }
      ]
    }
  ]
}

AHU-0016 — Simultaneous heating and cooling

Preconditions (host-enforced): Equipment is in occupied mode or supply fan is running. Host gates evaluation; when unmet, the verdict is NO_EVAL, not healthy.

Points: htg_vlv_cmd, clg_vlv_cmd

Outputs:

• yFault — True while both valves have been open beyond their thresholds for at least alarm_delay

Parameters:

Description

The heating coil valve and cooling coil valve are both commanded open beyond their respective thresholds at the same time. The air stream is being heated and then cooled (or vice versa) — energy is simultaneously added and removed with no occupant benefit, so the entire overlap is waste. One of the most common and highest-impact faults in commercial buildings; the trigger rule for cluster CLU-01.

Detection Logic

yFault = (htg_vlv_cmd > htg_vlv_threshold)
     AND (clg_vlv_cmd > clg_vlv_threshold)
     sustained continuously for alarm_delay

Block graph (rule.cxf.jsonld):

TrueDelay implements the alarm persistence: yFault asserts only after the combined condition has held continuously for alarm_delay seconds, and any interruption restarts the timer. The comparison is strict (>), so a valve sitting exactly at its threshold does not count as open. persist sets delayOnInit = true so a condition already present at engine start still waits out the full delay (engine-verified: the Modelica default of false passes an initially-true input through immediately, which would fire the alarm on the first tick after a controller restart).

Possible Diagnoses

1. Control sequence error — heating and cooling loops fighting (missing interlock or overlapping deadbands)
2. Stuck heating valve (mechanically open)
3. Stuck cooling valve (mechanically open)
4. Incorrect valve wiring (normally-open vs normally-closed)
5. Poorly tuned PID loops with overlapping deadbands

Energy Impact

CRITICAL_WASTE, HIGH confidence, DIRECT_MEASUREMENT. Waste is directly computable from live points and design capacities: waste_kw = htg_vlv_cmd/100 × ahu_htg_capacity_kw + clg_vlv_cmd/100 × ahu_clg_capacity_kw. Savings range 10–30% of AHU thermal energy (PNNL-27338, EEM-38). Present in the majority of buildings; wastes energy in all seasons.

Emissions Impact

Scope 1 + 2 (gas heating waste + electric cooling waste), DIRECT_EMISSIONS, HIGH confidence. Typical range 2,000–15,000 kg CO₂e/yr. Avoided-emissions basis: marginal operating emissions rate (MOER).

Deviations

• The reference card’s precondition (“equipment in occupied mode or fan running”) is declared in frontmatter for host enforcement rather than encoded in the block graph. The CXF computes the pure fault condition; gating its evaluation (and the NO_EVAL verdict when data is bad or the unit is off) is the host’s responsibility, matching the open-control engine’s status-blind design.
• Threshold comparisons use zero hysteresis (h = 0 on both GreaterThreshold blocks), like the reference. If command signals chatter around the threshold in practice, set h per site rather than raising t.
• persist.delayOnInit = true (Modelica/CDL default is false). The reference is silent on startup behavior; we require the persistence window even when the condition pre-exists at load, to avoid instant alarms after controller restarts.

Notes

Fix the trigger first: resolving this rule typically clears the CLU-01 member faults (mode mismatch, lockout issues) within 24–48 hours. Remote fix succeeds ~70% of the time (interlock/deadband/override corrections) at $0 cost.

Test Vectors

7 scenarios, clock step 60 s over 1800 s.

{
  "schema": "cxf-library/vectors/v1",
  "clock": {
    "step_s": 60,
    "horizon_s": 1800
  },
  "scenarios": [
    {
      "name": "normal_heating",
      "description": "Reference vector: heating only, no fault",
      "inputs": {
        "htg_vlv_cmd": 45.0,
        "clg_vlv_cmd": 0.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1800,
          "equals": false
        }
      ]
    },
    {
      "name": "normal_cooling",
      "description": "Reference vector: cooling only, no fault",
      "inputs": {
        "htg_vlv_cmd": 0.0,
        "clg_vlv_cmd": 60.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1800,
          "equals": false
        }
      ]
    },
    {
      "name": "both_open",
      "description": "Reference vector: both valves open; fault asserts after alarm_delay (900 s)",
      "inputs": {
        "htg_vlv_cmd": 20.0,
        "clg_vlv_cmd": 30.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 840,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 960,
          "to_s": 1800,
          "equals": true
        }
      ]
    },
    {
      "name": "both_below_threshold",
      "description": "Reference vector: both valves cracked but under threshold",
      "inputs": {
        "htg_vlv_cmd": 3.0,
        "clg_vlv_cmd": 4.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1800,
          "equals": false
        }
      ]
    },
    {
      "name": "deadband",
      "description": "Reference vector: both valves closed",
      "inputs": {
        "htg_vlv_cmd": 0.0,
        "clg_vlv_cmd": 0.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1800,
          "equals": false
        }
      ]
    },
    {
      "name": "threshold_edge",
      "description": "Exactly at threshold is not open (strict > comparison)",
      "inputs": {
        "htg_vlv_cmd": 5.0,
        "clg_vlv_cmd": 5.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1800,
          "equals": false
        }
      ]
    },
    {
      "name": "transient_overlap",
      "description": "Overlap shorter than alarm_delay never alarms; TrueDelay resets on release",
      "inputs": {
        "htg_vlv_cmd": 20.0,
        "clg_vlv_cmd": [
          {
            "t": 0,
            "value": 30.0
          },
          {
            "t": 600,
            "value": 0.0
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1800,
          "equals": false
        }
      ]
    }
  ]
}

AHU-0017 — Economizer not operational when favorable

Preconditions (host-enforced): Supply fan running. The outdoor/return comparison must be evaluable: |oat - rat| >= TMIN (PNNL-27338 uses 5 °F for its outdoor-air-fraction work), since two sensors reading within their combined error of each other cannot establish which air is cooler. Hosts also gate on OAT sensor quality — a sensor reading high produces this fault’s signature with the economizer control working correctly (diagnosis 4). When either gate is unmet the verdict is NO_EVAL, not healthy.

Points: oat, rat, clg_vlv_cmd, oa_dmpr_cmd

Outputs:

• yFault — True while outdoor conditions have favored economizing, mechanical cooling has run, and the OA damper has stayed below econ_damper_threshold, all continuously for at least alarm_delay

Parameters:

Description

Outdoor air is cool enough to do the cooling for free, but the outdoor-air damper sits at or near its minimum position while the cooling coil runs. Every kilowatt the compressor or chiller spends in that state buys cooling the economizer was standing by to provide at fan power alone. Common and cheap to fix: Cowan’s 2004 field survey found 54% of RTU economizers carrying at least one fault, most often a disconnected damper linkage. Trigger rule for CLU-03 (Economizer Failure) — fix it first, since a damper pinned at minimum also fails the mixed-air and OA-fraction tests in AHU-0009 and AHU-0011.

Detection Logic

econ_favorable = (rat - oat)          > temp_deadband   when econ_type_is_ddb
               = (econ_hl_temp - oat) > temp_deadband   otherwise

yFault = econ_favorable
     AND clg_vlv_cmd > cooling_enabled_threshold
     AND oa_dmpr_cmd < econ_damper_threshold
     sustained continuously for alarm_delay

Block graph (rule.cxf.jsonld):

Both changeover branches compute on every tick and favSel (Logical.Switch, y = u2 ? u1 : u3) picks one: isDDB true (the default) selects the differential branch (rat - oat), false the fixed high-limit branch (econ_hl_temp - oat). Thresholding the difference rather than the raw temperatures is what lets one temp_deadband serve both branches. All three comparisons are strict, so a damper parked at exactly 25%, a cooling valve at exactly 10%, or a gap of exactly 1.0 °C does not trip the rule. persist requires 30 minutes of continuous violation — long enough to ride out damper strokes and changeover transitions — and any interruption restarts the timer; delayOnInit = true makes a violation already present at engine start wait out the full window.

Possible Diagnoses

1. Economizer control sequence disabled or misconfigured in the BAS
2. OA damper stuck at minimum position (linkage disconnected, blades bound)
3. Damper actuator failure — no power, no air, or a burnt-out motor
4. OAT sensor error, reading higher than actual, which locks out changeover
5. Economizer lockout active when it should not be (seasonal or manual)

Energy Impact

CRITICAL_WASTE, HIGH confidence, DIRECT_MEASUREMENT. The waste is the mechanical cooling that free cooling would have displaced, readable straight off the valve command: waste_kw = clg_vlv_cmd/100 × ahu_clg_capacity_kw. Correcting economizer operation saves 5–20% of cooling energy (PNNL-27338 §3; PNNL EEM-06, OA damper faults and controls). Cooling-dominant, and worth most in mild shoulder-season weather — exactly when the damper should be modulating.

Emissions Impact

Scope 2, DIRECT_EMISSIONS, HIGH confidence; typical 1,500–8,000 kg CO₂e/yr. The displaced energy is electric compressor or chiller work, so the entire impact lands in purchased electricity. Free-cooling hours cluster in mild daytime and overnight weather, when the marginal generator differs sharply from the annual average — use the marginal operating emissions rate (MOER), not an average grid factor.

Deviations

• The reference’s econ_type enum (DDB | HL_DB, default DDB) is carried here as the boolean econ_type_is_ddb driving a Logical.Switch. Two values do not earn an enum, and a boolean is retunable through set_param on a deployed rule; enthalpy changeover needs its own rule, not a third value.
• The evaluability gate |oat - rat| >= TMIN and the OS-4 (mechanical cooling) operating-state restriction are declared as preconditions for host enforcement rather than encoded in the block graph — gating and data quality stay out of the rule, which computes the fault condition given valid data.
• All three comparisons are strict (>, >, <); the reference does not specify boundary behavior, so the library’s strict convention applies.
• temp_deadband is one card parameter bound to two CXF paths (ddbFav.t, hlFav.t), matching the reference’s single deadband. Hosts must set both paths together, or flipping econ_type_is_ddb silently changes the deadband.
• persist.delayOnInit = true (Modelica/CDL default is false), the library’s standing choice: a violation already present at load waits out the full 30 minutes instead of alarming on the first tick after a controller restart.

Notes

With default parameters the shipped vectors exercise only the DDB branch — vectors/v1 stages inputs, not parameters, so hlConst, hlGap, and hlFav are structurally verified but never reach yFault through u3. A host that sets econ_type_is_ddb = false should commission that path itself.

econ_hl_temp defaults to 21 °C, near ASHRAE 90.1’s 70 °F high limit for climate zones 4A–5A. Zones 1A–3A allow 75 °F (23.9 °C) and zones 5B–8 use 65 °F (18.3 °C) — retune per the playbook rather than accepting the default in a climate it does not fit.

Test Vectors

9 scenarios, clock step 60 s over 3600 s.

{
  "schema": "cxf-library/vectors/v1",
  "clock": {
    "step_s": 60,
    "horizon_s": 3600
  },
  "scenarios": [
    {
      "name": "favorable_damper_open",
      "description": "Reference vector: OAT 10 \u00b0C against RAT 22 \u00b0C with cooling at 40% \u2014 economizer is favorable and the damper is at 80%, so free cooling is being used",
      "inputs": {
        "oat": 10.0,
        "rat": 22.0,
        "clg_vlv_cmd": 40.0,
        "oa_dmpr_cmd": 80.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 3600,
          "equals": false
        }
      ]
    },
    {
      "name": "favorable_damper_at_min",
      "description": "Reference vector: same favorable conditions and cooling call, but the damper sits at 15% \u2014 mechanical cooling with the economizer shut; alarms after alarm_delay (1800 s)",
      "inputs": {
        "oat": 10.0,
        "rat": 22.0,
        "clg_vlv_cmd": 40.0,
        "oa_dmpr_cmd": 15.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1740,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 1860,
          "to_s": 3600,
          "equals": true
        }
      ]
    },
    {
      "name": "not_favorable",
      "description": "Reference vector: OAT 30 \u00b0C is hotter than the 22 \u00b0C return air \u2014 economizing would add load, so a closed damper is correct",
      "inputs": {
        "oat": 30.0,
        "rat": 22.0,
        "clg_vlv_cmd": 40.0,
        "oa_dmpr_cmd": 15.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 3600,
          "equals": false
        }
      ]
    },
    {
      "name": "no_cooling_call",
      "description": "Reference vector: favorable outdoor air but the cooling valve is closed \u2014 no mechanical cooling to displace, so the minimum-position damper is correct",
      "inputs": {
        "oat": 10.0,
        "rat": 22.0,
        "clg_vlv_cmd": 0.0,
        "oa_dmpr_cmd": 15.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 3600,
          "equals": false
        }
      ]
    },
    {
      "name": "damper_exactly_at_threshold",
      "description": "Edge case: damper parked exactly at econ_damper_threshold (25%) under favorable conditions with cooling \u2014 the strict `<` keeps it out of the alarm",
      "inputs": {
        "oat": 10.0,
        "rat": 22.0,
        "clg_vlv_cmd": 40.0,
        "oa_dmpr_cmd": 25.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 3600,
          "equals": false
        }
      ]
    },
    {
      "name": "cooling_exactly_at_threshold",
      "description": "Edge case: cooling valve exactly at cooling_enabled_threshold (10%) with the damper at minimum \u2014 the strict `>` means the coil does not count as cooling",
      "inputs": {
        "oat": 10.0,
        "rat": 22.0,
        "clg_vlv_cmd": 10.0,
        "oa_dmpr_cmd": 15.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 3600,
          "equals": false
        }
      ]
    },
    {
      "name": "deadband_edge_then_favorable",
      "description": "Edge case: rat \u2212 oat sits exactly on temp_deadband (1.0 \u00b0C) \u2014 no alarm; at t=1200 the return air rises to 22.5 \u00b0C, opening the gap to 1.5 \u00b0C, and the alarm follows 1800 s later",
      "inputs": {
        "oat": 21.0,
        "rat": [
          {
            "t": 0,
            "value": 22.0
          },
          {
            "t": 1200,
            "value": 22.5
          }
        ],
        "clg_vlv_cmd": 40.0,
        "oa_dmpr_cmd": 15.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 2940,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 3060,
          "to_s": 3600,
          "equals": true
        }
      ]
    },
    {
      "name": "damper_opens_before_delay",
      "description": "Transient: the economizer is shut against favorable air with cooling running, but the damper drives to 70% at t=1200 \u2014 the condition clears before alarm_delay completes, so no alarm",
      "inputs": {
        "oat": 10.0,
        "rat": 22.0,
        "clg_vlv_cmd": 40.0,
        "oa_dmpr_cmd": [
          {
            "t": 0,
            "value": 15.0
          },
          {
            "t": 1200,
            "value": 70.0
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 3600,
          "equals": false
        }
      ]
    },
    {
      "name": "damper_cycle_resets_persistence",
      "description": "Transient: the damper opens at t=900 and falls back to minimum at t=1200 under an unbroken favorable-plus-cooling condition \u2014 persistence restarts from the reclose, so the alarm lands at 3000 s, not 1800 s",
      "inputs": {
        "oat": 10.0,
        "rat": 22.0,
        "clg_vlv_cmd": 40.0,
        "oa_dmpr_cmd": [
          {
            "t": 0,
            "value": 15.0
          },
          {
            "t": 900,
            "value": 70.0
          },
          {
            "t": 1200,
            "value": 15.0
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 2940,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 3060,
          "to_s": 3600,
          "equals": true
        }
      ]
    }
  ]
}

AHU-0018 — Unoccupied override — equipment running during off-hours

Preconditions (host-enforced): Occupancy schedule data available and current; the host evaluates the schedule (time zone, calendar, holidays) into the boolean occ_schedule point. When schedule provenance is unknown or stale, the verdict is NO_EVAL, not healthy.

Points: sf_status, occ_schedule, override_active

Outputs:

• yFault — True while the supply fan has been running unoccupied, past the grace period, with no active override, for at least alarm_delay

Parameters:

Description

The supply fan is operating outside the defined occupancy schedule when no active override or demand condition justifies it. While this fault is active, essentially the entire AHU energy draw — fan power plus any heating or cooling of outdoor air — is waste. Roughly 15% of buildings exhibit it, usually from schedule misconfiguration or a stuck override, and it is the trigger rule for both the After-Hours Operation (CLU-04) and Schedule Dysfunction (CLU-08) clusters. It is also among the fastest faults to pay back: the fix is almost always a $0 schedule or override correction.

Detection Logic

yFault = sf_status
     AND (NOT occ_schedule  sustained for grace_period)
     AND NOT override_active
     sustained continuously for alarm_delay

Block graph (rule.cxf.jsonld):

unoccGrace implements the reference’s grace period: the unoccupied state must persist for grace_period before it counts, so normal operation continuing briefly past schedule end never alarms. persist then requires the full justification-free condition (fan on · unoccupied past grace · no override) to hold for alarm_delay. Any re-occupancy, fan stop, or override activation resets the corresponding timer. Worst-case time to alarm after schedule end is grace_period + alarm_delay (default 45 min).

Possible Diagnoses

1. Schedule misconfiguration or incorrect time zone (DST mismatches are a common culprit)
2. Stuck override in the BAS (BACnet priority array holding the fan on)
3. Fan relay or contactor stuck closed
4. Occupancy sensor triggering unnecessarily
5. Night setback / morning warmup running too long

Energy Impact

CRITICAL_WASTE, HIGH confidence, DIRECT_MEASUREMENT. While active, the entire AHU draw is waste: waste_kw = ahu_fan_design_kw × (sf_speed/100)³ + active heating/cooling (cubed fan law on speed; thermal penalty typically 1.5–3× the fan energy). Savings range 3–16% of site energy (PNNL-25985 EEM-04 shortened schedules / EEM-16 night setbacks). Climate-neutral: waste scales with operating hours, not weather. Prevalence ~15%.

Emissions Impact

Scope 1 + 2, DIRECT_EMISSIONS, HIGH confidence; typical 3,000–20,000 kg CO₂e/yr (full AHU energy during unoccupied hours). After-hours waste lands in evening/overnight hours when the marginal grid generator is often coal or gas peaking — in solar-heavy regions the nighttime MOER can be 2–3× the midday value, so this fault’s emissions rank can exceed its energy-cost rank. Avoided-emissions basis: MOER.

Deviations

• The reference’s logic calls in_occupied_schedule(current_time, occ_schedule) — a schedule-evaluation function over a schedule object. Our rule consumes the host-evaluated boolean occ_schedule point instead; schedule interpretation (time zone, calendar, holiday exceptions) is a host concern, consistent with this library’s precondition philosophy and with 223P/Brick having no schedule vocabulary to describe one (see points/ahu.points.json notes).
• The reference lists grace_period as “minutes after schedule end to allow.” We implement it as a TrueDelay on the unoccupied signal, which grants the same grace after schedule end and equally after any occupied→unoccupied transition — equivalent for schedule-driven hosts, and safer for hosts that drive occ_schedule from occupancy sensing.
• delayOnInit = true on both timers: a controller restart mid-condition still waits out the full grace + persistence window (same startup-alarm rationale as AHU-0016).

Notes

Remote fix succeeds ~95% of the time at $0 (schedule correction, override release, setback enablement). When this rule fires, check SYS-0003 (lighting) and SYS-0004 (exhaust fans) — they frequently share the same master-schedule root cause, which is why this rule triggers two clusters.

Test Vectors

6 scenarios, clock step 60 s over 3600 s.

{
  "schema": "cxf-library/vectors/v1",
  "clock": {
    "step_s": 60,
    "horizon_s": 3600
  },
  "scenarios": [
    {
      "name": "normal_occupied",
      "description": "Reference vector: fan on during scheduled occupancy",
      "inputs": {
        "sf_status": true,
        "occ_schedule": true,
        "override_active": false
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 3600,
          "equals": false
        }
      ]
    },
    {
      "name": "normal_unoccupied",
      "description": "Reference vector: fan off while unoccupied",
      "inputs": {
        "sf_status": false,
        "occ_schedule": false,
        "override_active": false
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 3600,
          "equals": false
        }
      ]
    },
    {
      "name": "running_after_hours",
      "description": "Reference vector: fan on, unoccupied, no override; alarms after grace_period (1800 s) + alarm_delay (900 s)",
      "inputs": {
        "sf_status": true,
        "occ_schedule": false,
        "override_active": false
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 2640,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2760,
          "to_s": 3600,
          "equals": true
        }
      ]
    },
    {
      "name": "override_justifies_run",
      "description": "Reference vector: fan on, unoccupied, but an active override justifies it",
      "inputs": {
        "sf_status": true,
        "occ_schedule": false,
        "override_active": true
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 3600,
          "equals": false
        }
      ]
    },
    {
      "name": "fan_stops_within_grace",
      "description": "Fan shuts down before the grace period elapses; never alarms",
      "inputs": {
        "sf_status": [
          {
            "t": 0,
            "value": true
          },
          {
            "t": 1500,
            "value": false
          }
        ],
        "occ_schedule": false,
        "override_active": false
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 3600,
          "equals": false
        }
      ]
    },
    {
      "name": "reoccupied_resets_persistence",
      "description": "Occupancy resumes after grace elapsed but before alarm_delay completes; timers reset, never alarms",
      "inputs": {
        "sf_status": true,
        "occ_schedule": [
          {
            "t": 0,
            "value": false
          },
          {
            "t": 2000,
            "value": true
          }
        ],
        "override_active": false
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 3600,
          "equals": false
        }
      ]
    }
  ]
}

AHU-0019 — Supply air temperature setpoint too low (over-cooling)

Preconditions (host-enforced): AHU in occupied mode and serving multiple zones; zone reheat data available and aggregated by the host into zone_reheat_fraction. When the zone data is missing, stale, or covers too few zones for the fraction to mean anything, the verdict is NO_EVAL, not healthy.

Points: sat_sp, zone_reheat_fraction

Outputs:

• yFault — True while the SAT setpoint has stayed below sat_sp_low_limit with more than reheat_fraction_threshold of zones reheating, for at least alarm_delay

Parameters:

Description

The supply air temperature setpoint sits below the minimum recommended value while a large share of the zones served are running reheat. Air colder than any zone asked for costs chiller energy to make and then boiler or electric reheat energy to undo, so every degree of over-cooling is paid for twice — and the zones stay comfortable throughout, which is why a setpoint parked at 10 °C survives for years. SAT reset is absent in 74% of buildings (PNNL 151-building study); this is the CLU-02 member fault that shows the missing reset actually costing money.

Detection Logic

yFault = sat_sp < sat_sp_low_limit
     AND zone_reheat_fraction > reheat_fraction_threshold
     sustained continuously for alarm_delay

Block graph (rule.cxf.jsonld):

Two threshold tests feed one conjunction and one timer. spLow watches the setpoint, not the measured SAT: this rule is about what the sequence asked for, while a unit that cannot hold its setpoint (AHU-0007, AHU-0013) or hunts around it (AHU-0022) is a separate finding. rhtHigh supplies the corroboration that turns “cold setpoint” into “waste” — without a reheat majority, a 10 °C setpoint may simply be serving a high-load hour. Both comparisons are strict, so a setpoint parked exactly on the 12 °C limit, or exactly half the zones reheating, does not trip the rule. persist requires 60 minutes of continuous violation — enough to ride out morning cool-down and the reheat spike after an occupied-mode transition — and delayOnInit = true holds that window across a controller restart.

Possible Diagnoses

1. SAT setpoint too aggressive — set low at commissioning and never reset since
2. SAT reset logic disabled or misconfigured (the CLU-02 root cause; confirm with AHU-0023)
3. A single rogue zone dragging the AHU setpoint down through the trim-and-respond request path — one starved or mis-sensored box can hold the whole system at its minimum setpoint

Energy Impact

EXCESS_CONSUMPTION, HIGH confidence, PROXY_ESTIMATION. The waste is a reheat integral: excess_reheat_kw = Σ over reheating zones of (rht_vlv_cmd_i/100 × vav_rht_capacity_kw_i), plus the chiller energy spent making air nobody wanted. Raising the setpoint into the reset band saves 5–15% of AHU cooling plus reheat energy (PNNL-25985 EEM-05 SAT reset and EEM-15 VAV minimum flow reduction, combined — the two interact, since a high minimum flow forces reheat no setpoint change can eliminate). Heating-dominant: the reheat half of the bill grows with hours spent below balance point.

Emissions Impact

Scope 2, PROXY_EMISSIONS, HIGH confidence; typical 800–5,000 kg CO₂e/yr (excess cooling plus reheat). Sites with gas or steam reheat move that half of the inventory into scope 1; the card reports scope 2 because electric reheat and electric chilling are the common case. Avoided-emissions basis: marginal operating emissions rate (MOER).

Deviations

• The reference’s single 50% zone-count fraction diverges from its own PNNL source: PNNL-27338 §2.2.2–2.2.3 tests two quantities — zones with reheat valves open (>10%) exceeding 25%, AND fleet-average reheat command above 50%. This card follows the reference. Sites wanting the PNNL-literal form retune reheat_fraction_threshold to 0.25; the magnitude conjunct is not expressible without a host-derived mean reheat command, which the point dictionary does not yet carry.
• The reference counts reheating zones across a per-zone valve command array. Library v1 avoids array boundary points, so the host does the counting and feeds the scalar zone_reheat_fraction (flagged derived in the dictionary, same pattern as zone_dmpr_pos_max in AHU-0024). The reheat-active counting threshold is host configuration, not a rule parameter.
• reheat_fraction_threshold is a fraction 0–1, not a percent: the reference states 50%, but the point compared against carries unit 1, so the parameter is 0.5. Hosts feeding a 0–100 percentage fire this rule on nearly every tick.
• Both comparisons are strict (<, >); the reference does not specify boundary behavior, so the library’s strict convention applies.
• The reference tags this fault for both AHU and RTU. This card is the AHU-family instance; an RTU-0004 would restate it against the RTU’s discharge setpoint and its zone group.
• Operating-state gating (OS 2, 3, 4 — occupied) and the multi-zone precondition are declared in frontmatter for host enforcement rather than encoded in the block graph, per the library’s design stance.
• persist.delayOnInit = true (Modelica/CDL default is false), the library’s standing choice: a violation already present at load waits out the full 60 minutes instead of alarming on the first tick after a controller restart.

Notes

AHU-0023 and this rule are the two halves of the same CLU-02 story. FC-057 is the statistical trigger — it proves the setpoint never moves. This rule is the harm case: the setpoint is parked low and the zones downstream are burning fuel to undo it. Fix order is FC-057’s fix — program the reset per G36 §5.16.2 (playbook missing-reset, step 2.2) — after which this rule should clear within one occupied day. Before raising the setpoint, check the zone minimum flows: a box with a 40% minimum will reheat at any SAT and will keep this rule firing after the reset is programmed.

Test Vectors

8 scenarios, clock step 60 s over 7200 s.

{
  "schema": "cxf-library/vectors/v1",
  "clock": {
    "step_s": 60,
    "horizon_s": 7200
  },
  "scenarios": [
    {
      "name": "setpoint_above_limit_light_reheat",
      "description": "Reference vector: SAT setpoint 14 \u00b0C with 20% of zones reheating \u2014 setpoint above the low limit, nothing to report",
      "inputs": {
        "sat_sp": 14.0,
        "zone_reheat_fraction": 0.2
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 7200,
          "equals": false
        }
      ]
    },
    {
      "name": "setpoint_low_but_reheat_light",
      "description": "Reference vector: SAT setpoint 10 \u00b0C with only 30% of zones reheating \u2014 a cold setpoint the zones are not fighting, so no fault",
      "inputs": {
        "sat_sp": 10.0,
        "zone_reheat_fraction": 0.3
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 7200,
          "equals": false
        }
      ]
    },
    {
      "name": "setpoint_low_with_widespread_reheat",
      "description": "Reference vector: SAT setpoint 10 \u00b0C with 65% of zones reheating \u2014 over-cooling paid for by reheat; alarms after alarm_delay (3600 s)",
      "inputs": {
        "sat_sp": 10.0,
        "zone_reheat_fraction": 0.65
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 3540,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 3660,
          "to_s": 7200,
          "equals": true
        }
      ]
    },
    {
      "name": "setpoint_exactly_at_low_limit",
      "description": "Edge case: SAT setpoint sits exactly on sat_sp_low_limit (12 \u00b0C) with 65% of zones reheating \u2014 the strict `<` keeps it out of the alarm",
      "inputs": {
        "sat_sp": 12.0,
        "zone_reheat_fraction": 0.65
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 7200,
          "equals": false
        }
      ]
    },
    {
      "name": "reheat_exactly_at_threshold",
      "description": "Edge case: exactly half the zones reheating (0.5) against a 10 \u00b0C setpoint \u2014 the strict `>` means the fraction must exceed the threshold",
      "inputs": {
        "sat_sp": 10.0,
        "zone_reheat_fraction": 0.5
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 7200,
          "equals": false
        }
      ]
    },
    {
      "name": "reheat_burst_clears_before_delay",
      "description": "Transient: a morning reheat burst at 0.65 falls back to 0.30 at t=1800 \u2014 the condition clears inside alarm_delay, so no alarm",
      "inputs": {
        "sat_sp": 10.0,
        "zone_reheat_fraction": [
          {
            "t": 0,
            "value": 0.65
          },
          {
            "t": 1800,
            "value": 0.3
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 7200,
          "equals": false
        }
      ]
    },
    {
      "name": "reset_raises_setpoint_before_delay",
      "description": "Transient: reheat stays at 0.65 but a working SAT reset walks the setpoint from 10 \u00b0C to 13.5 \u00b0C at t=1800 \u2014 the fault condition ends before it can alarm",
      "inputs": {
        "sat_sp": [
          {
            "t": 0,
            "value": 10.0
          },
          {
            "t": 1800,
            "value": 13.5
          }
        ],
        "zone_reheat_fraction": 0.65
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 7200,
          "equals": false
        }
      ]
    },
    {
      "name": "reheat_dip_restarts_persistence",
      "description": "Transient: reheat dips to 0.40 at t=900 and returns to 0.65 at t=1200 against a 10 \u00b0C setpoint \u2014 persistence restarts from the return, so the alarm lands at 4800 s, not 3600 s",
      "inputs": {
        "sat_sp": 10.0,
        "zone_reheat_fraction": [
          {
            "t": 0,
            "value": 0.65
          },
          {
            "t": 900,
            "value": 0.4
          },
          {
            "t": 1200,
            "value": 0.65
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 4740,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 4860,
          "to_s": 7200,
          "equals": true
        }
      ]
    }
  ]
}

AHU-0020 — Stuck or failed actuator

Preconditions (host-enforced): Both the command and the position feedback must be available and bound to the same physical device — a feedback point wired to a different actuator than the command produces a permanent false alarm. When the feedback point is absent, stale, or its device pairing is unverified, the verdict is NO_EVAL, not healthy.

Points: actuator_cmd, actuator_pos

Outputs:

• yFault — True while command and position feedback have differed by more than position_error_threshold continuously for stuck_duration plus alarm_delay

Parameters:

Description

An actuator’s command and its measured position disagree by more than the tracking allowance and stay disagreed for half an hour. Whatever the sequence told the device to do, it is not doing: the linkage has come off, the motor has failed, the stem is seized in scale or debris, or the control signal never reaches the actuator at all. This is the chapter’s one template rule — actuator_cmd and actuator_pos are a command/feedback pair the host binds per actuated device, so a typical AHU carries three instances (outdoor air damper, heating valve, cooling valve). Severity 2 because a stuck actuator defeats whatever sequence commands it: when this fires alongside AHU-0016, AHU-0017, or AHU-0025 on the same subsystem, those rules are reporting the symptom and this one is naming the cause.

Detection Logic

yFault = |actuator_cmd − actuator_pos| > position_error_threshold
         sustained continuously for stuck_duration,
         then held for a further alarm_delay

Block graph (rule.cxf.jsonld):

err takes the signed difference and absErr strips the sign, so the test is direction-blind: an actuator that will not open, one that will not close, and a reverse-wired feedback reporting 80% against a 20% command all trip the same threshold. errBig compares strictly, so a delta sitting exactly on 10% reads healthy — the threshold is a tracking allowance, and an actuator at the edge of it is within spec. The two timers chain rather than merge: stuck requires 30 minutes of continuous mistracking, longer than any real stroke (full 0–100% damper travel takes 90–150 s), and persist adds the reference’s 5-minute debounce on top, putting worst-case time to alarm at 2100 s. Either timer resets the moment feedback comes back inside the allowance, so recovery is immediate. delayOnInit = true holds the full window across a controller restart.

Possible Diagnoses

1. Actuator mechanical failure — motor, gear train, or spring return
2. Actuator linkage disconnected (the most common finding, and the cheapest fix)
3. Incorrect wiring — command and feedback bound to different devices
4. Valve or damper seized by corrosion or debris
5. Control signal not reaching the actuator (broken wire, blown fuse, failed pneumatic transducer)

Energy Impact

CRITICAL_WASTE, MEDIUM confidence, PROXY_ESTIMATION. The waste depends on which actuator is stuck and where it stopped: a heating valve stuck at 40% burns fuel year-round; stuck closed it costs nothing in energy and shows up as a comfort complaint. Estimating the loss means falling back on the affected subsystem’s formula — AHU-0014/AHU-0015 for a coil valve, AHU-0021/AHU-0026 for an OA damper — with the stuck position read from actuator_pos rather than the command, which is why this card is PROXY_ESTIMATION. Repairing a stuck actuator returns 5–20% of the affected subsystem’s energy (PNNL retuning measures EEM-03 for leaking coil valves, EEM-06 for OA damper faults). Climate sensitivity follows the device.

Emissions Impact

PROXY_EMISSIONS, MEDIUM confidence; typical 200–2,000 kg CO₂e/yr, the wide band reflecting the same device dependence as the energy estimate. Scope is recorded as 1|2 because it follows the affected subsystem rather than the fault: a stuck heating valve wastes on-site combustion (scope 1), a stuck cooling valve or a damper feeding the chiller outdoor air wastes purchased electricity (scope 2), and a stuck OA damper in a gas-heated building can do both across a year. Hosts should attribute against the subsystem the bound device serves, not against this rule. Avoided-emissions basis: MOER.

Deviations

• NO_EVAL is a host precondition, not an output. The reference’s data-absence case (command 50%, feedback missing) is not representable in a status-blind block graph — nothing here distinguishes “no feedback” from “feedback reads 0”, and an unbound point held at 0 against a 50% command alarms in 35 minutes. The host must confirm both points are present, fresh, and bound to the same device before interpreting yFault.
• actuator_cmd and actuator_pos are the dictionary’s first template entries, bound per device by the host rather than forked into per-device rule variants that would triple the card count. Their entries carry no Brick or 223P class because the class differs per instance (Damper_Position_Command on one, Valve_Position_Command on another); the cost is that the CXF document alone does not say which device it watches — the host binding does.
• stuck_duration and alarm_delay stay separate timers rather than one 2100 s TrueDelay, because the reference tunes them separately and they answer different questions: when an actuator counts as stuck, versus how much alarm-noise suppression the site wants on top.
• errBig uses GreaterThreshold (u > t), so a 10.0% delta is healthy and 10.1% is not; the reference writes > threshold.
• absErr implements the reference’s |actuator_cmd − actuator_pos| literally, so over-travel and reversed feedback wiring alarm on the same schedule as a jam — diagnosis 3 depends on it.
• The reference tags this fault for AHU, RTU, VAV, and FCU. This is the AHU-family instance; the other families reuse the block graph unchanged, since the template points carry no equipment-specific semantics.
• delayOnInit = true on both timers (Modelica/CDL default is false), the library’s standing choice: an actuator already mistracking at load waits out the full 35 minutes rather than alarming after a controller restart.

Notes

Deploy the three AHU instances together — the diagnosis often depends on which one fired. Sites without position feedback on an actuator simply do not instantiate the rule there; there is no degraded mode.

Remote fixes are limited to releasing overrides and checking for demand-limiting that clamps the command range (playbook stuck-actuator, step 2). Everything else is on-site: $0–$50 to reconnect a linkage, $200–$800 for an actuator, $500–$2,000 for a seized valve body. After the repair, stroke the device 0 → 100 → 0 and confirm feedback tracks within 5%.

Test Vectors

9 scenarios, clock step 60 s over 3600 s.

{
  "schema": "cxf-library/vectors/v1",
  "clock": {
    "step_s": 60,
    "horizon_s": 3600
  },
  "scenarios": [
    {
      "name": "tracking_normally",
      "description": "Reference vector: command 50%, feedback 48% \u2014 a 2% tracking error, inside the allowance",
      "inputs": {
        "actuator_cmd": 50.0,
        "actuator_pos": 48.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 3600,
          "equals": false
        }
      ]
    },
    {
      "name": "briefly_stuck_then_recovers",
      "description": "Reference vector: command 80% against feedback 20% for 10 min, then the actuator catches up \u2014 the 60% error never reaches stuck_duration",
      "inputs": {
        "actuator_cmd": 80.0,
        "actuator_pos": [
          {
            "t": 0,
            "value": 20.0
          },
          {
            "t": 600,
            "value": 80.0
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 3600,
          "equals": false
        }
      ]
    },
    {
      "name": "stuck_sustained",
      "description": "Reference vector: command 80% against feedback 20% held past 45 min \u2014 the alarm lands at stuck_duration + alarm_delay = 2100 s, well before the reference's 2700 s observation point",
      "inputs": {
        "actuator_cmd": 80.0,
        "actuator_pos": 20.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 2040,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2160,
          "to_s": 3600,
          "equals": true
        }
      ]
    },
    {
      "name": "error_exactly_at_threshold",
      "description": "Edge case: command 50%, feedback 40% \u2014 a delta of exactly position_error_threshold (10%); the strict `>` keeps it healthy",
      "inputs": {
        "actuator_cmd": 50.0,
        "actuator_pos": 40.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 3600,
          "equals": false
        }
      ]
    },
    {
      "name": "error_just_over_threshold",
      "description": "Edge case: command 50%, feedback 39.5% \u2014 a 10.5% delta clears the threshold and alarms at 2100 s",
      "inputs": {
        "actuator_cmd": 50.0,
        "actuator_pos": 39.5
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 2040,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2160,
          "to_s": 3600,
          "equals": true
        }
      ]
    },
    {
      "name": "reverse_error_is_symmetric",
      "description": "Feedback above command (20% commanded, 80% reported) \u2014 `absErr` makes the test direction-blind, so an over-travelled or reverse-wired actuator alarms on the same 2100 s schedule",
      "inputs": {
        "actuator_cmd": 20.0,
        "actuator_pos": 80.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 2040,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 2160,
          "to_s": 3600,
          "equals": true
        }
      ]
    },
    {
      "name": "normal_stroke_lag",
      "description": "Transient: the command steps 20% \u2192 80% at t=600 and the actuator takes 300 s to arrive \u2014 a 60% error for the length of the stroke, far short of stuck_duration",
      "inputs": {
        "actuator_cmd": [
          {
            "t": 0,
            "value": 20.0
          },
          {
            "t": 600,
            "value": 80.0
          }
        ],
        "actuator_pos": [
          {
            "t": 0,
            "value": 20.0
          },
          {
            "t": 900,
            "value": 80.0
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 3600,
          "equals": false
        }
      ]
    },
    {
      "name": "error_clears_during_debounce",
      "description": "Transient: the error survives stuck_duration (timer satisfied at 1800 s) but the actuator frees itself at 1920 s, inside the 300 s debounce \u2014 no alarm ever asserts",
      "inputs": {
        "actuator_cmd": 80.0,
        "actuator_pos": [
          {
            "t": 0,
            "value": 20.0
          },
          {
            "t": 1920,
            "value": 80.0
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 3600,
          "equals": false
        }
      ]
    },
    {
      "name": "error_returns_restarts_stuck_timer",
      "description": "Transient: the actuator tracks briefly at t=600 and jams again at t=900 \u2014 the stuck timer restarts from the second jam, pushing the alarm to 900 + 2100 = 3000 s",
      "inputs": {
        "actuator_cmd": 80.0,
        "actuator_pos": [
          {
            "t": 0,
            "value": 20.0
          },
          {
            "t": 600,
            "value": 80.0
          },
          {
            "t": 900,
            "value": 20.0
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 2940,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 3060,
          "to_s": 3600,
          "equals": true
        }
      ]
    }
  ]
}

AHU-0021 — Excess outdoor air during occupied hours

Preconditions (host-enforced): Supply fan running. The host must not evaluate during economizer operation — bringing in more than the design minimum is the point of economizing, and this rule cannot tell that apart from a stuck damper. MAT must pass its integrity gate (AHU-0028, see suppressed_by): the fraction is a ratio of temperature differences, so a biased mixed-air reading moves it directly. The temperature-difference gate is signalled in-rule by yTempDeltaOk; when it is false the verdict is NO_EVAL, not healthy. Additionally suspend evaluation (NO_EVAL) while demand-controlled ventilation or a ventilation-demand override holds outdoor-air flow above the minimum-OA state — at VAV turndown a constant ventilation flow becomes a large OA fraction and this rule fires on healthy operation (fleet-validated FP mechanism; see the validation block).

Points: mat, rat, oat

Outputs:

• yFault — True while the outdoor air fraction has stayed more than oaf_threshold above desired_oaf for at least alarm_delay, with the temperature difference large enough to evaluate
• yTempDeltaOk — Evaluability signal — true when |oat − rat| exceeds oaf_temp_threshold; false means NO_EVAL and the host must ignore yFault

Parameters:

Description

The unit is pulling in more outdoor air than its design minimum ventilation requires, and it is not economizing — every extra cubic metre has to be heated or cooled to supply temperature for no ventilation benefit. Unlike a failed economizer, this fault is invisible from the zone: the space stays comfortable, the coils simply work harder to keep it that way, through every occupied hour. The outdoor air fraction is inferred from the mixing-box energy balance rather than measured, which makes the diagnostic cheap — three temperatures, no airflow station — and conditional, since the inference only holds when outdoor and return air differ enough to locate the fraction; hence the explicit evaluability output. AHU-0030 is the same measurement narrowed to heating operation, where the excess is most expensive. Present in roughly 15% of buildings.

Detection Logic

oaf          = (mat − rat) / (oat − rat)
yTempDeltaOk = |oat − rat| > oaf_temp_threshold     (false ⇒ host reports NO_EVAL)
yFault       = (oaf − desired_oaf > oaf_threshold) AND yTempDeltaOk,
               sustained for alarm_delay

Block graph (rule.cxf.jsonld):

matRat and oatRat form the two differences, oaf divides them, and margin subtracts the design fraction so that marginHigh tests the excess against a single positive threshold. oatRat fans out a second time into absDelta and deltaOk, whose output is both the boundary output yTempDeltaOk and the second input of gate — so yFault is held down over exactly the interval the host is told to disregard it. That matters because the division is unguarded: CDL Divide follows IEEE-754, so oat = rat yields ±∞ or NaN rather than an error, and a near-zero denominator amplifies ordinary sensor noise into a fraction of any magnitude. NaN compares false everywhere, but ±∞ and a noise-inflated finite fraction can both raise marginHigh, and gate is what stops them. Both comparisons are strict: a fraction sitting exactly at desired_oaf + oaf_threshold is not a fault, and a temperature difference of exactly oaf_temp_threshold is not evaluable. The fraction is signed consistently across the year — summer both differences positive, winter both negative — so no seasonal branch is needed. persist requires 30 continuous minutes, riding out damper strokes and the mixing transient after a mode change; delayOnInit = true holds that window across a restart.

Possible Diagnoses

1. OA damper minimum position set too high
2. OA damper not closing to minimum — stuck, or the sequence never commands it back down after a purge or economizer period
3. Damper actuator issue: failed actuator, slipped linkage, or a position feedback that disagrees with the blade
4. Exhaust fan creating negative building pressure that pulls outdoor air in past the minimum position

Energy Impact

EXCESS_CONSUMPTION, HIGH confidence, DIRECT_MEASUREMENT. The waste is computable from live data: excess_oa_kw = (actual_oaf − desired_oaf) × airflow × cp × |oat − rat|, with the excess fraction already on the wire as oaf − designConst.k. Correcting minimum ventilation saves 2–10% of AHU thermal energy (PNNL-27338), the upper half of that range in heating-dominant climates. PNNL EEM-17 (demand control ventilation) is the related retrofit and this rule is its screening test: a unit already over its design fraction with the dampers at minimum will not benefit from CO₂ control until the mechanical problem is fixed.

Emissions Impact

Scope 1 + 2, DIRECT_EMISSIONS, HIGH confidence; typical 500–4,000 kg CO₂e/yr for the excess ventilation thermal load. The split follows the season: excess outdoor air in winter usually burns scope 1 fuel at the heating coil, in summer it draws scope 2 electricity at the chiller. Avoided-emissions basis: marginal operating emissions rate (MOER).

Deviations

• The reference’s AND NOT econ_favorable term is not in the block graph. Economizer operation is an operating state, not a measurement, and this library keeps operating-state gating host-side (precedent: AHU-0017’s OS-4 restriction), so the term lives in operating_states and preconditions instead. A host that evaluates this rule during economizing will get a fault, and it will be the host’s bug.
• The reference writes the test as oaf > (desired_oaf + oaf_threshold), which would force the two tunables into one summed threshold. Feeding desired_oaf as Reals.Sources.Constant.k and comparing the remaining margin against oaf_threshold is algebraically identical and keeps both retunable alone.
• Evaluability is an output, not just a precondition: the |oat − rat| test is computable from this rule’s own inputs, so SCHEMA.md requires exposing it as yTempDeltaOk (PNNL-27338 uses 5 °F for the same computation; the reference’s 6 °C default is adopted). A false yFault under a false yTempDeltaOk means “unknown”, not “healthy”.
• Both comparisons are strict (>); the reference does not specify boundary behavior, so the library’s strict convention applies.
• persist.delayOnInit = true (Modelica/CDL default is false), the library’s standing choice: an excess already present at load waits out the full 30 minutes instead of alarming on the first tick after a controller restart.

Notes

Check the minimum position setpoint before sending anyone to the roof — the most common cause is a minimum dialled up during a ventilation complaint or a commissioning shortcut, and it is a $0 desk fix. The economizer-failure playbook’s damper and linkage steps come after that.

The rule is deliberately blind to why the fraction is high. A damper stuck at 40% and a building held under negative pressure by an oversized exhaust fan produce the same number, and the second is invisible from the AHU’s own points: if commanding the damper closed does not move the fraction, measure building pressure before replacing the actuator.

Test Vectors

8 scenarios, clock step 60 s over 3600 s.

{
  "schema": "cxf-library/vectors/v1",
  "clock": {
    "step_s": 60,
    "horizon_s": 3600
  },
  "scenarios": [
    {
      "name": "normal_ventilation",
      "description": "Reference vector: OAF 0.18 against a 0.25 alarm point (oat 2 \u00b0C, rat 22 \u00b0C, mat 18.4 \u00b0C) \u2014 design minimum plus normal spread",
      "inputs": {
        "mat": 18.4,
        "rat": 22.0,
        "oat": 2.0
      },
      "expect": [
        {
          "output": "yTempDeltaOk",
          "from_s": 0,
          "to_s": 3600,
          "equals": true
        },
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 3600,
          "equals": false
        }
      ]
    },
    {
      "name": "excess_outdoor_air",
      "description": "Reference vector: OAF 0.40 (oat 2 \u00b0C, rat 22 \u00b0C, mat 14.0 \u00b0C) \u2014 0.25 above design; alarms after alarm_delay (1800 s)",
      "inputs": {
        "mat": 14.0,
        "rat": 22.0,
        "oat": 2.0
      },
      "expect": [
        {
          "output": "yTempDeltaOk",
          "from_s": 0,
          "to_s": 3600,
          "equals": true
        },
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1740,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 1860,
          "to_s": 3600,
          "equals": true
        }
      ]
    },
    {
      "name": "margin_exactly_at_threshold",
      "description": "Edge case: OAF 0.25 exactly (mat 17.0 \u00b0C), so the margin equals oaf_threshold \u2014 the strict `>` means no fault",
      "inputs": {
        "mat": 17.0,
        "rat": 22.0,
        "oat": 2.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 3600,
          "equals": false
        }
      ]
    },
    {
      "name": "margin_just_over_threshold",
      "description": "Edge case: OAF 0.26 (mat 16.8 \u00b0C) clears the strict comparison and alarms after alarm_delay",
      "inputs": {
        "mat": 16.8,
        "rat": 22.0,
        "oat": 2.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1740,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 1860,
          "to_s": 3600,
          "equals": true
        }
      ]
    },
    {
      "name": "small_delta_not_evaluable",
      "description": "NO_EVAL: |oat \u2212 rat| = 2 \u00b0C (oat 20 \u00b0C, rat 22 \u00b0C) with mat 14 \u00b0C, so the raw fraction reads 4.0 \u2014 an ungated rule would alarm; yTempDeltaOk stays false and holds yFault down",
      "inputs": {
        "mat": 14.0,
        "rat": 22.0,
        "oat": 20.0
      },
      "expect": [
        {
          "output": "yTempDeltaOk",
          "from_s": 0,
          "to_s": 3600,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 3600,
          "equals": false
        }
      ]
    },
    {
      "name": "delta_exactly_at_threshold",
      "description": "Edge case: |oat \u2212 rat| = 6.0 \u00b0C exactly (oat 16 \u00b0C, rat 22 \u00b0C) with OAF 0.50 \u2014 the strict `>` leaves the rule not evaluable",
      "inputs": {
        "mat": 19.0,
        "rat": 22.0,
        "oat": 16.0
      },
      "expect": [
        {
          "output": "yTempDeltaOk",
          "from_s": 0,
          "to_s": 3600,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 3600,
          "equals": false
        }
      ]
    },
    {
      "name": "transient_excess_clears_before_delay",
      "description": "Transient: OAF jumps to 0.40 at t=600 and falls back to 0.18 at t=1800 \u2014 1200 s of excess, short of alarm_delay, so no alarm",
      "inputs": {
        "mat": [
          {
            "t": 0,
            "value": 18.4
          },
          {
            "t": 600,
            "value": 14.0
          },
          {
            "t": 1800,
            "value": 18.4
          }
        ],
        "rat": 22.0,
        "oat": 2.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 3600,
          "equals": false
        }
      ]
    },
    {
      "name": "summer_excess_oat_above_rat",
      "description": "Sign case: outdoor air warmer than return (oat 35 \u00b0C, rat 24 \u00b0C, mat 28.4 \u00b0C) \u2014 the fraction still reads 0.40 and the rule alarms after alarm_delay",
      "inputs": {
        "mat": 28.4,
        "rat": 24.0,
        "oat": 35.0
      },
      "expect": [
        {
          "output": "yTempDeltaOk",
          "from_s": 0,
          "to_s": 3600,
          "equals": true
        },
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1740,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 1860,
          "to_s": 3600,
          "equals": true
        }
      ]
    }
  ]
}

AHU-0022 — Supply air temperature hunting / oscillation

Preconditions (host-enforced): Supply fan running — SAT scatter means nothing in a dead air stream. No verdict within long_window (2 h) of engine start: both moving averages divide by elapsed time while their windows fill, so the baseline is not yet established and the ratio test can be satisfied by a warmup artifact — the host reports NO_EVAL for that period. SAT sensor integrity is a precondition, not a conclusion: a sensor that flatlines and then jumps produces this same scatter signature (diagnosis 4), so sensor checks clear first. When any gate is unmet the verdict is NO_EVAL, not healthy.

Points: sat

Outputs:

• yFault — True while short-window SAT deviation has stayed above oscillation_threshold and above k × the long-window deviation for at least alarm_delay

Parameters:

Description

Supply air temperature swings around its setpoint instead of settling on it. The signature is scatter, not offset: SAT may average exactly on setpoint while crossing it every few minutes. An oscillating loop keeps its valve or damper in continuous motion, wearing the actuator and burning coil energy on overshoot it then has to undo. The usual cause is proportional gain set too high, or integral time too short, for the coil’s actual authority — often after a valve or actuator was replaced with a differently sized part. The rule compares the unit against itself, since some AHUs simply run noisier than others: a fault requires recent scatter that is both absolutely large and several times the unit’s own baseline. Present in roughly 5% of buildings; severity 3, nothing here is unsafe.

Detection Logic

muShort  = MovingAverage(sat, window)                 muLong  = MovingAverage(sat, long_window)
madShort = MovingAverage(|sat − muShort|, window)     madLong = MovingAverage(|sat − muLong|, long_window)

yFault   = (madShort > oscillation_threshold)     absolute scatter test
       AND (madShort > k × madLong)               onset test: scatter far above this unit's baseline
           sustained continuously for alarm_delay

Block graph (rule.cxf.jsonld):

Two identical chains run at two timescales. Each takes the moving average of SAT over its window (muShort, muLong), subtracts it from the live reading, takes the absolute value (errShort/devShort, errLong/devLong), and averages that deviation over the same window again (madShort, madLong) — a rolling mean absolute deviation, since the engine has no rolling standard deviation (see Deviations for the conversion). absHigh applies the absolute threshold to the short window; scaledLong and relHigh apply the ratio test. Both comparisons are strict. persist requires 30 minutes of continuous violation, which rides out one-off step disturbances — an economizer changeover or a setpoint reset spikes madShort for about one short window and then flushes out — and delayOnInit = true holds that window across a restart.

The ratio test normalizes against the unit’s own recent history, so this rule flags onset, not steady state: hunting that outlasts long_window raises madLong until madShort > k × madLong no longer holds, and the alarm clears roughly long_window/2 after onset with the loop still hunting. That is a property of the reference’s logic, not of the MAD substitution. Hosts should hold the work order open after the first assert rather than tracking yFault.

Possible Diagnoses

1. PID loop poorly tuned (oscillating) — gain too high or integral time too short for the coil’s authority
2. Valve or damper actuator hunting — worn linkage, sticking stem, or a positioner fighting its own feedback
3. Conflicting control loops — two sequences acting on the same air stream (e.g. a coil loop and a face-and-bypass or mixing loop with overlapping ranges)
4. Intermittent sensor signal — a loose SAT wire or failing transmitter reads as oscillation with no control defect present

Energy Impact

COMFORT_ENERGY, LOW confidence, QUALITATIVE_ONLY. There is no direct waste term to compute: an oscillating loop delivers roughly the right average temperature, and the loss is in the cycling itself — strokes that overshoot and correct, coil energy on excursions that cancel out, and the fan and pump work behind them. The reference puts this at 1–3% of AHU energy while the hunting lasts; confidence is LOW because no controlled study isolates oscillation losses from the tuning changes that fix them. Runtime estimation follows Energy Impact Reference §4.4 (hunting hours × AHU coil and fan power) — this rule contributes the hours, not the kilowatts. Climate-neutral.

Emissions Impact

Scope 2, QUALITATIVE_EMISSIONS, LOW confidence. Minimal in absolute terms — control-loop inefficiency, not a stuck-open coil. No avoided-emissions basis is published for this fault; a host that wants a number should apply its standard electricity factor to the fan and pump energy attributed above and treat the result as an order-of-magnitude estimate.

Deviations

• Rolling standard deviation → rolling mean absolute deviation. The reference uses rolling_std, and the engine’s elementary block set has no variance or standard-deviation block, so MAD is computed from four MovingAverage instances plus a subtract and an absolute value per timescale. MAD and std are proportional for any fixed waveform, so the ratio test carries over unchanged — the scale factor cancels on both sides of madShort > k × madLong.
• The absolute threshold does not cancel, so it is restated in MAD units: for Gaussian noise std = 1.2533 × MAD, for a pure sine std = 1.1107 × MAD, so the reference’s 1.5 °C std is a MAD of 1.20–1.35. The default takes the lower bound, 1.2; a site wanting the conservative end sets 1.35.
• Reals.MovingAverage is a continuous-time integral mean, not a sample mean — the engine accumulates u·dt forward-Euler and divides by the window — so hand-computed sample statistics do not match it exactly.
• Each MovingAverage keeps a fixed 64-checkpoint ring, so the tick interval must be ≥ long_window/64 = 112.5 s at the default windows. A host ticking faster silently shortens the baseline window: the fault still detects, but against a truncated baseline.
• The reference’s “sufficient data in both windows” precondition is implemented host-side. During the first long_window after engine start madLong divides by elapsed time and underestimates the baseline, so the frontmatter precondition requires the host to report NO_EVAL for the first 2 h.
• The short window is coarse at realistic tick rates — 900 s at a 300 s BAS tick is three samples — which the threshold and the 30-minute timer absorb. A faster trend interval smooths it at no cost, subject to the 112.5 s floor.
• window and long_window each bind two CXF parameter paths (the mean stage and the deviation-averaging stage), like valve_open_threshold in AHU-0025. Hosts must set both paths of a window together; splitting them changes what the statistic means.
• Both comparisons are strict (>). The boundary is pinned by bracketing rather than an exact-equality tick, because madShort is a computed statistic and cannot be parked exactly on 1.2 the way a staged input can.
• The reference states its test vectors as statistical summaries rather than tick traces; each is re-expressed here as a SAT trajectory producing the stated scatter. The noisy-but-consistent case runs at a larger amplitude than the reference’s, so the absolute test passes and the ratio test is the only thing blocking the fault — at the reference’s numbers both tests fail.
• Severity 3 (warning) and method statistical follow the reference’s chapter 9 card. This chapter’s README lists severity 4 / rule; the chapter 9 card governs and the index row needs correcting, as it did for AHU-0025.
• The reference tags this fault for AHU and RTU; this card is the AHU-family instance, and an RTU-family sibling would restate it against the RTU’s discharge-air sensor.
• persist.delayOnInit = true (Modelica/CDL default is false), the library’s standing choice: a violation already present at load waits out the full 30 minutes instead of alarming on the first tick after a controller restart.

Notes

A unit that has hunted for months reads as healthy here until something disturbs it — catching those needs a cross-unit or absolute-scatter comparison, which is a Phase 3 rule, not this one.

Diagnosis 4 deserves its precondition: a SAT transmitter with an intermittent connection produces textbook oscillation statistics behind a perfectly tuned loop. Read the raw trend before touching tuning parameters — control hunting is smooth and roughly periodic, a failing sensor is neither. No playbook is referenced because nothing in playbooks/ yet covers control-loop tuning.

Test Vectors

7 scenarios, clock step 150 s over 21600 s.

{
  "schema": "cxf-library/vectors/v1",
  "clock": {
    "step_s": 150,
    "horizon_s": 21600
  },
  "scenarios": [
    {
      "name": "stable_operation",
      "description": "Reference vector 1 (stable: short-window scatter 0.3, long-window 0.4). SAT holds 13 \u00b0C with a \u00b10.3 \u00b0C 15-min ripple for the whole 6 h horizon \u2014 normal PID trim, not hunting. madShort and madLong both settle at 0.3, so the absolute test (> 1.2) never fires and the ratio test never sees a raised short window. No fault at any tick.",
      "inputs": {
        "sat": [
          {
            "t": 0,
            "value": 13.3
          },
          {
            "t": 450,
            "value": 12.7
          },
          {
            "t": 900,
            "value": 13.3
          },
          {
            "t": 1350,
            "value": 12.7
          },
          {
            "t": 1800,
            "value": 13.3
          },
          {
            "t": 2250,
            "value": 12.7
          },
          {
            "t": 2700,
            "value": 13.3
          },
          {
            "t": 3150,
            "value": 12.7
          },
          {
            "t": 3600,
            "value": 13.3
          },
          {
            "t": 4050,
            "value": 12.7
          },
          {
            "t": 4500,
            "value": 13.3
          },
          {
            "t": 4950,
            "value": 12.7
          },
          {
            "t": 5400,
            "value": 13.3
          },
          {
            "t": 5850,
            "value": 12.7
          },
          {
            "t": 6300,
            "value": 13.3
          },
          {
            "t": 6750,
            "value": 12.7
          },
          {
            "t": 7200,
            "value": 13.3
          },
          {
            "t": 7650,
            "value": 12.7
          },
          {
            "t": 8100,
            "value": 13.3
          },
          {
            "t": 8550,
            "value": 12.7
          },
          {
            "t": 9000,
            "value": 13.3
          },
          {
            "t": 9450,
            "value": 12.7
          },
          {
            "t": 9900,
            "value": 13.3
          },
          {
            "t": 10350,
            "value": 12.7
          },
          {
            "t": 10800,
            "value": 13.3
          },
          {
            "t": 11250,
            "value": 12.7
          },
          {
            "t": 11700,
            "value": 13.3
          },
          {
            "t": 12150,
            "value": 12.7
          },
          {
            "t": 12600,
            "value": 13.3
          },
          {
            "t": 13050,
            "value": 12.7
          },
          {
            "t": 13500,
            "value": 13.3
          },
          {
            "t": 13950,
            "value": 12.7
          },
          {
            "t": 14400,
            "value": 13.3
          },
          {
            "t": 14850,
            "value": 12.7
          },
          {
            "t": 15300,
            "value": 13.3
          },
          {
            "t": 15750,
            "value": 12.7
          },
          {
            "t": 16200,
            "value": 13.3
          },
          {
            "t": 16650,
            "value": 12.7
          },
          {
            "t": 17100,
            "value": 13.3
          },
          {
            "t": 17550,
            "value": 12.7
          },
          {
            "t": 18000,
            "value": 13.3
          },
          {
            "t": 18450,
            "value": 12.7
          },
          {
            "t": 18900,
            "value": 13.3
          },
          {
            "t": 19350,
            "value": 12.7
          },
          {
            "t": 19800,
            "value": 13.3
          },
          {
            "t": 20250,
            "value": 12.7
          },
          {
            "t": 20700,
            "value": 13.3
          },
          {
            "t": 21150,
            "value": 12.7
          },
          {
            "t": 21600,
            "value": 13.3
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 21600,
          "equals": false
        }
      ]
    },
    {
      "name": "hunting_onset",
      "description": "Reference vector 2 (oscillating: short-window scatter 2.5 against a long-window 0.4). SAT is flat at 13 \u00b0C for 2.5 h \u2014 long enough for madLong to converge on ~0 across a full 2 h baseline \u2014 then a \u00b13 \u00b0C 15-min square wave starts at t=9000 s. madShort clears 1.2 at t=9450 s and both conditions hold; persist asserts 1800 s later at t=11250 s. The alarm then self-clears at t=12600 s: by then half the 2 h baseline window is itself oscillating, madLong has risen past madShort/2, and the ratio test releases. Asserted windows keep two 150 s steps of margin from both edges.",
      "inputs": {
        "sat": [
          {
            "t": 0,
            "value": 13.0
          },
          {
            "t": 9000,
            "value": 16.0
          },
          {
            "t": 9450,
            "value": 10.0
          },
          {
            "t": 9900,
            "value": 16.0
          },
          {
            "t": 10350,
            "value": 10.0
          },
          {
            "t": 10800,
            "value": 16.0
          },
          {
            "t": 11250,
            "value": 10.0
          },
          {
            "t": 11700,
            "value": 16.0
          },
          {
            "t": 12150,
            "value": 10.0
          },
          {
            "t": 12600,
            "value": 16.0
          },
          {
            "t": 13050,
            "value": 10.0
          },
          {
            "t": 13500,
            "value": 16.0
          },
          {
            "t": 13950,
            "value": 10.0
          },
          {
            "t": 14400,
            "value": 16.0
          },
          {
            "t": 14850,
            "value": 10.0
          },
          {
            "t": 15300,
            "value": 16.0
          },
          {
            "t": 15750,
            "value": 10.0
          },
          {
            "t": 16200,
            "value": 16.0
          },
          {
            "t": 16650,
            "value": 10.0
          },
          {
            "t": 17100,
            "value": 16.0
          },
          {
            "t": 17550,
            "value": 10.0
          },
          {
            "t": 18000,
            "value": 16.0
          },
          {
            "t": 18450,
            "value": 10.0
          },
          {
            "t": 18900,
            "value": 16.0
          },
          {
            "t": 19350,
            "value": 10.0
          },
          {
            "t": 19800,
            "value": 16.0
          },
          {
            "t": 20250,
            "value": 10.0
          },
          {
            "t": 20700,
            "value": 16.0
          },
          {
            "t": 21150,
            "value": 10.0
          },
          {
            "t": 21600,
            "value": 16.0
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 10950,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 11550,
          "to_s": 12150,
          "equals": true
        },
        {
          "output": "yFault",
          "from_s": 12900,
          "to_s": 21600,
          "equals": false
        }
      ]
    },
    {
      "name": "noisy_but_consistent",
      "description": "Reference vector 3 (noisy but consistent: short 1.0 vs long 0.9 \u2014 scatter present in both windows). A \u00b13 \u00b0C ripple runs from t=0, so madShort and madLong converge on the same 3.0 and never separate by the factor k=2. The absolute test passes from t=450 s onward; the ratio test blocks the fault for the whole horizon. Established scatter is this detector's baseline, not its alarm.",
      "inputs": {
        "sat": [
          {
            "t": 0,
            "value": 16.0
          },
          {
            "t": 450,
            "value": 10.0
          },
          {
            "t": 900,
            "value": 16.0
          },
          {
            "t": 1350,
            "value": 10.0
          },
          {
            "t": 1800,
            "value": 16.0
          },
          {
            "t": 2250,
            "value": 10.0
          },
          {
            "t": 2700,
            "value": 16.0
          },
          {
            "t": 3150,
            "value": 10.0
          },
          {
            "t": 3600,
            "value": 16.0
          },
          {
            "t": 4050,
            "value": 10.0
          },
          {
            "t": 4500,
            "value": 16.0
          },
          {
            "t": 4950,
            "value": 10.0
          },
          {
            "t": 5400,
            "value": 16.0
          },
          {
            "t": 5850,
            "value": 10.0
          },
          {
            "t": 6300,
            "value": 16.0
          },
          {
            "t": 6750,
            "value": 10.0
          },
          {
            "t": 7200,
            "value": 16.0
          },
          {
            "t": 7650,
            "value": 10.0
          },
          {
            "t": 8100,
            "value": 16.0
          },
          {
            "t": 8550,
            "value": 10.0
          },
          {
            "t": 9000,
            "value": 16.0
          },
          {
            "t": 9450,
            "value": 10.0
          },
          {
            "t": 9900,
            "value": 16.0
          },
          {
            "t": 10350,
            "value": 10.0
          },
          {
            "t": 10800,
            "value": 16.0
          },
          {
            "t": 11250,
            "value": 10.0
          },
          {
            "t": 11700,
            "value": 16.0
          },
          {
            "t": 12150,
            "value": 10.0
          },
          {
            "t": 12600,
            "value": 16.0
          },
          {
            "t": 13050,
            "value": 10.0
          },
          {
            "t": 13500,
            "value": 16.0
          },
          {
            "t": 13950,
            "value": 10.0
          },
          {
            "t": 14400,
            "value": 16.0
          },
          {
            "t": 14850,
            "value": 10.0
          },
          {
            "t": 15300,
            "value": 16.0
          },
          {
            "t": 15750,
            "value": 10.0
          },
          {
            "t": 16200,
            "value": 16.0
          },
          {
            "t": 16650,
            "value": 10.0
          },
          {
            "t": 17100,
            "value": 16.0
          },
          {
            "t": 17550,
            "value": 10.0
          },
          {
            "t": 18000,
            "value": 16.0
          },
          {
            "t": 18450,
            "value": 10.0
          },
          {
            "t": 18900,
            "value": 16.0
          },
          {
            "t": 19350,
            "value": 10.0
          },
          {
            "t": 19800,
            "value": 16.0
          },
          {
            "t": 20250,
            "value": 10.0
          },
          {
            "t": 20700,
            "value": 16.0
          },
          {
            "t": 21150,
            "value": 10.0
          },
          {
            "t": 21600,
            "value": 16.0
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 21600,
          "equals": false
        }
      ]
    },
    {
      "name": "small_oscillation",
      "description": "Threshold edge from below: same flat-then-oscillate trajectory as hunting_onset but at \u00b11.0 \u00b0C. The ratio test holds from t=9000 s (the baseline is near zero) yet madShort peaks at 1.083 and settles at 1.0, both under the 1.2 threshold, so the absolute test never fires. Pins that both conditions are required \u2014 a clean ratio alone cannot raise this fault.",
      "inputs": {
        "sat": [
          {
            "t": 0,
            "value": 13.0
          },
          {
            "t": 9000,
            "value": 14.0
          },
          {
            "t": 9450,
            "value": 12.0
          },
          {
            "t": 9900,
            "value": 14.0
          },
          {
            "t": 10350,
            "value": 12.0
          },
          {
            "t": 10800,
            "value": 14.0
          },
          {
            "t": 11250,
            "value": 12.0
          },
          {
            "t": 11700,
            "value": 14.0
          },
          {
            "t": 12150,
            "value": 12.0
          },
          {
            "t": 12600,
            "value": 14.0
          },
          {
            "t": 13050,
            "value": 12.0
          },
          {
            "t": 13500,
            "value": 14.0
          },
          {
            "t": 13950,
            "value": 12.0
          },
          {
            "t": 14400,
            "value": 14.0
          },
          {
            "t": 14850,
            "value": 12.0
          },
          {
            "t": 15300,
            "value": 14.0
          },
          {
            "t": 15750,
            "value": 12.0
          },
          {
            "t": 16200,
            "value": 14.0
          },
          {
            "t": 16650,
            "value": 12.0
          },
          {
            "t": 17100,
            "value": 14.0
          },
          {
            "t": 17550,
            "value": 12.0
          },
          {
            "t": 18000,
            "value": 14.0
          },
          {
            "t": 18450,
            "value": 12.0
          },
          {
            "t": 18900,
            "value": 14.0
          },
          {
            "t": 19350,
            "value": 12.0
          },
          {
            "t": 19800,
            "value": 14.0
          },
          {
            "t": 20250,
            "value": 12.0
          },
          {
            "t": 20700,
            "value": 14.0
          },
          {
            "t": 21150,
            "value": 12.0
          },
          {
            "t": 21600,
            "value": 14.0
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 21600,
          "equals": false
        }
      ]
    },
    {
      "name": "marginal_oscillation",
      "description": "Threshold edge from above: the same trajectory at \u00b11.35 \u00b0C, just over the 1.2 threshold. madShort crosses at t=9750 s (300 s later than the \u00b13 case, because the short window has to fill), persist asserts at t=11550 s, and the ratio test releases at t=12600 s as in hunting_onset. The pair small_oscillation / marginal_oscillation brackets oscillation_threshold from both sides.",
      "inputs": {
        "sat": [
          {
            "t": 0,
            "value": 13.0
          },
          {
            "t": 9000,
            "value": 14.35
          },
          {
            "t": 9450,
            "value": 11.65
          },
          {
            "t": 9900,
            "value": 14.35
          },
          {
            "t": 10350,
            "value": 11.65
          },
          {
            "t": 10800,
            "value": 14.35
          },
          {
            "t": 11250,
            "value": 11.65
          },
          {
            "t": 11700,
            "value": 14.35
          },
          {
            "t": 12150,
            "value": 11.65
          },
          {
            "t": 12600,
            "value": 14.35
          },
          {
            "t": 13050,
            "value": 11.65
          },
          {
            "t": 13500,
            "value": 14.35
          },
          {
            "t": 13950,
            "value": 11.65
          },
          {
            "t": 14400,
            "value": 14.35
          },
          {
            "t": 14850,
            "value": 11.65
          },
          {
            "t": 15300,
            "value": 14.35
          },
          {
            "t": 15750,
            "value": 11.65
          },
          {
            "t": 16200,
            "value": 14.35
          },
          {
            "t": 16650,
            "value": 11.65
          },
          {
            "t": 17100,
            "value": 14.35
          },
          {
            "t": 17550,
            "value": 11.65
          },
          {
            "t": 18000,
            "value": 14.35
          },
          {
            "t": 18450,
            "value": 11.65
          },
          {
            "t": 18900,
            "value": 14.35
          },
          {
            "t": 19350,
            "value": 11.65
          },
          {
            "t": 19800,
            "value": 14.35
          },
          {
            "t": 20250,
            "value": 11.65
          },
          {
            "t": 20700,
            "value": 14.35
          },
          {
            "t": 21150,
            "value": 11.65
          },
          {
            "t": 21600,
            "value": 14.35
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 11250,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 11850,
          "to_s": 12150,
          "equals": true
        },
        {
          "output": "yFault",
          "from_s": 12900,
          "to_s": 21600,
          "equals": false
        }
      ]
    },
    {
      "name": "onset_stops_before_delay",
      "description": "Transient: a single 15-min hunting burst (\u00b13 \u00b0C, t=9000\u20139900 s) on a flat baseline \u2014 one disturbance rejection, not sustained instability. Both conditions hold from t=9450 s but madShort decays back under 1.2 at t=10650 s, 1050 s of accumulated persistence into the 1800 s timer. The timer resets and no alarm is raised.",
      "inputs": {
        "sat": [
          {
            "t": 0,
            "value": 13.0
          },
          {
            "t": 9000,
            "value": 16.0
          },
          {
            "t": 9450,
            "value": 10.0
          },
          {
            "t": 9900,
            "value": 13.0
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 21600,
          "equals": false
        }
      ]
    },
    {
      "name": "mode_change_step",
      "description": "Transient: a one-time 5 \u00b0C SAT step at t=9000 s (economizer changeover or a setpoint reset), then steady operation at the new value. The step spikes madShort to 2.08 and both conditions hold from t=9150 s, but the short window flushes the step out and madShort falls back under 1.2 at t=10050 s \u2014 750 s of persistence, well short of the 1800 s alarm delay. Pins that alarm_delay rides out a genuine step disturbance.",
      "inputs": {
        "sat": [
          {
            "t": 0,
            "value": 13.0
          },
          {
            "t": 9000,
            "value": 8.0
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 21600,
          "equals": false
        }
      ]
    }
  ]
}

AHU-0023 — Supply air temperature reset not functioning

Preconditions (host-enforced): AHU running for the bulk of the evaluation window. Sufficient outdoor-air variation is signaled in-rule via the yOatVaried output: when it is false, the host must report NO_EVAL, not healthy.

Points: sat_sp, oat

Outputs:

• yFault — True while the SAT setpoint has stayed flat over the evaluation window despite sufficient OAT variation, for at least alarm_delay
• yOatVaried — Evaluability signal — true when OAT has varied enough within the evaluation window for the rule to be meaningful; false means NO_EVAL

Parameters:

Description

The supply air temperature setpoint remains fixed over an extended evaluation window despite varying outdoor-air and load conditions. A functioning SAT reset (G36 §5.16.2 trim-and-respond) modulates the setpoint warmer as loads decrease, cutting mechanical cooling and downstream VAV reheat. PNNL’s 151-building field study found SAT reset absent in 74% of buildings — this rule and its twin AHU-0024 are the “74% problem,” the trigger pair for cluster CLU-02, and the fix is a $0 desk-only sequence change worth ~2.5% of site energy on its own.

Detection Logic

baseline(x)  = x sampled and held every evaluation_window (7 days)
sp_flat      = |sat_sp − baseline(sat_sp)| < sp_flat_tolerance,
               continuously for evaluation_window
oat_flat     = |oat − baseline(oat)| < oat_variation_tolerance,
               continuously for evaluation_window

yOatVaried   = NOT oat_flat        (false ⇒ host reports NO_EVAL)
yFault       = sp_flat AND yOatVaried, sustained for alarm_delay

Block graph (rule.cxf.jsonld):

Two symmetric chains compare each signal against a weekly sample-and-hold baseline (Discrete.Sampler, which emits the live input on its first tick — no startup artifact). spFlatHeld asserts only after the setpoint has stayed within tolerance of its baseline continuously for a full window; any reset activity ≥ 1 °C resets it. oatFlatHeld does the same for OAT, and its negation is yOatVaried: “not varied” is defined as a full window of continuous flatness. In the synchronous dataflow both dwell timers fire on the same tick in the all-flat case, so the fault conjunction is false by construction — no boundary race — and persist (24 h) filters any residual transient. Worst-case time to alarm from cold start: evaluation_window + alarm_delay (8 days).

Possible Diagnoses

1. SAT reset sequence never programmed in the BAS
2. SAT reset sequence disabled by an operator
3. SAT setpoint overridden to a fixed value
4. Trim-and-respond parameters misconfigured
5. Zone request signals not reaching the AHU controller

Energy Impact

EXCESS_CONSUMPTION, HIGH confidence, PROXY_ESTIMATION (EEM-05). A fixed-low SAT over-cools the air stream and drives downstream VAV reheat; savings from enabling reset are 1–4.4% of site energy (2.5% national weighted median), heating-dominant by climate. Prevalence: 74% of buildings.

Emissions Impact

Scope 2, PROXY_EMISSIONS, HIGH confidence; typical 800–5,000 kg CO₂e/yr (excess cooling and reheat). Avoided-emissions basis: MOER.

Deviations

• Windowed range → deviation from a weekly sampled baseline. The reference computes max − min over the window and CDL has no windowed min/max, so each signal is compared against a Discrete.Sampler hold refreshed once per window, with tolerances at half the reference ranges. Equivalent detection for signals that move and return, slightly conservative for monotonic drift within one window. Reals.MovingAverage was rejected: the engine implements it with a 64-checkpoint ring, so a 7-day window silently degrades at BAS tick rates, while the sampler is exact at any tick rate.
• NO_EVAL is surfaced as the second output yOatVaried, since boolean block logic cannot express a tri-state; false means NO_EVAL, never healthy. Its inverted-flat semantics make it optimistically true during the first window after startup, when yFault cannot fire anyway because spFlatHeld needs the same full window.
• AlarmDelay = 24 h is a TrueDelay on the fault conjunction; the evaluation window itself is enforced by the flatness dwell timers.
• delayOnInit = true on all TrueDelays (startup conservatism per AHU-0016).

Notes

Fastest payback in the catalog together with AHU-0024: remote fix ~90%, $0, programmed per G36 §5.16.2 (start 18 °C; trim +0.2 °F when satisfied; respond −0.5 °F per cooling request; range 13–18 °C). See the missing-reset playbook.

Test Vectors

4 scenarios, clock step 300 s over 777600 s.

{
  "schema": "cxf-library/vectors/v1",
  "clock": {
    "step_s": 300,
    "horizon_s": 777600
  },
  "scenarios": [
    {
      "name": "reset_working",
      "description": "Reference vector: SAT_SP modulates ~4degC with OAT swings; no fault",
      "inputs": {
        "sat_sp": [
          {
            "t": 0,
            "value": 13.0
          },
          {
            "t": 43200,
            "value": 17.0
          },
          {
            "t": 86400,
            "value": 13.0
          },
          {
            "t": 129600,
            "value": 17.0
          },
          {
            "t": 172800,
            "value": 13.0
          },
          {
            "t": 216000,
            "value": 17.0
          },
          {
            "t": 259200,
            "value": 13.0
          },
          {
            "t": 302400,
            "value": 17.0
          },
          {
            "t": 345600,
            "value": 13.0
          },
          {
            "t": 388800,
            "value": 17.0
          },
          {
            "t": 432000,
            "value": 13.0
          },
          {
            "t": 475200,
            "value": 17.0
          },
          {
            "t": 518400,
            "value": 13.0
          },
          {
            "t": 561600,
            "value": 17.0
          },
          {
            "t": 604800,
            "value": 13.0
          },
          {
            "t": 648000,
            "value": 17.0
          },
          {
            "t": 691200,
            "value": 13.0
          },
          {
            "t": 734400,
            "value": 17.0
          },
          {
            "t": 777600,
            "value": 13.0
          }
        ],
        "oat": [
          {
            "t": 0,
            "value": 5.0
          },
          {
            "t": 43200,
            "value": 20.0
          },
          {
            "t": 86400,
            "value": 5.0
          },
          {
            "t": 129600,
            "value": 20.0
          },
          {
            "t": 172800,
            "value": 5.0
          },
          {
            "t": 216000,
            "value": 20.0
          },
          {
            "t": 259200,
            "value": 5.0
          },
          {
            "t": 302400,
            "value": 20.0
          },
          {
            "t": 345600,
            "value": 5.0
          },
          {
            "t": 388800,
            "value": 20.0
          },
          {
            "t": 432000,
            "value": 5.0
          },
          {
            "t": 475200,
            "value": 20.0
          },
          {
            "t": 518400,
            "value": 5.0
          },
          {
            "t": 561600,
            "value": 20.0
          },
          {
            "t": 604800,
            "value": 5.0
          },
          {
            "t": 648000,
            "value": 20.0
          },
          {
            "t": 691200,
            "value": 5.0
          },
          {
            "t": 734400,
            "value": 20.0
          },
          {
            "t": 777600,
            "value": 5.0
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 777600,
          "equals": false
        },
        {
          "output": "yOatVaried",
          "from_s": 0,
          "to_s": 777600,
          "equals": true
        }
      ]
    },
    {
      "name": "fixed_setpoint",
      "description": "Reference vector: SAT_SP pinned at 13degC despite 15degC OAT swings; fault after evaluation_window (7d) + alarm_delay (24h)",
      "inputs": {
        "sat_sp": 13.0,
        "oat": [
          {
            "t": 0,
            "value": 5.0
          },
          {
            "t": 43200,
            "value": 20.0
          },
          {
            "t": 86400,
            "value": 5.0
          },
          {
            "t": 129600,
            "value": 20.0
          },
          {
            "t": 172800,
            "value": 5.0
          },
          {
            "t": 216000,
            "value": 20.0
          },
          {
            "t": 259200,
            "value": 5.0
          },
          {
            "t": 302400,
            "value": 20.0
          },
          {
            "t": 345600,
            "value": 5.0
          },
          {
            "t": 388800,
            "value": 20.0
          },
          {
            "t": 432000,
            "value": 5.0
          },
          {
            "t": 475200,
            "value": 20.0
          },
          {
            "t": 518400,
            "value": 5.0
          },
          {
            "t": 561600,
            "value": 20.0
          },
          {
            "t": 604800,
            "value": 5.0
          },
          {
            "t": 648000,
            "value": 20.0
          },
          {
            "t": 691200,
            "value": 5.0
          },
          {
            "t": 734400,
            "value": 20.0
          },
          {
            "t": 777600,
            "value": 5.0
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 688800,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 694800,
          "to_s": 777600,
          "equals": true
        },
        {
          "output": "yOatVaried",
          "from_s": 0,
          "to_s": 777600,
          "equals": true
        }
      ]
    },
    {
      "name": "insufficient_oat_variation",
      "description": "Reference vector (NO_EVAL): flat SAT_SP but OAT never varies; yOatVaried drops false once OAT has been flat for a full window, so the host reports NO_EVAL; yFault must never fire",
      "inputs": {
        "sat_sp": 13.0,
        "oat": 10.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 777600,
          "equals": false
        },
        {
          "output": "yOatVaried",
          "from_s": 0,
          "to_s": 602400,
          "equals": true
        },
        {
          "output": "yOatVaried",
          "from_s": 608400,
          "to_s": 777600,
          "equals": false
        }
      ]
    },
    {
      "name": "reset_resumes",
      "description": "Setpoint flat for 4 days, then reset activity resumes before the window completes; flatness timer resets, never alarms",
      "inputs": {
        "sat_sp": [
          {
            "t": 0,
            "value": 13.0
          },
          {
            "t": 345600,
            "value": 17.0
          },
          {
            "t": 388800,
            "value": 13.0
          },
          {
            "t": 432000,
            "value": 17.0
          },
          {
            "t": 475200,
            "value": 13.0
          },
          {
            "t": 518400,
            "value": 17.0
          },
          {
            "t": 561600,
            "value": 13.0
          },
          {
            "t": 604800,
            "value": 17.0
          },
          {
            "t": 648000,
            "value": 13.0
          },
          {
            "t": 691200,
            "value": 17.0
          },
          {
            "t": 734400,
            "value": 13.0
          },
          {
            "t": 777600,
            "value": 17.0
          }
        ],
        "oat": [
          {
            "t": 0,
            "value": 5.0
          },
          {
            "t": 43200,
            "value": 20.0
          },
          {
            "t": 86400,
            "value": 5.0
          },
          {
            "t": 129600,
            "value": 20.0
          },
          {
            "t": 172800,
            "value": 5.0
          },
          {
            "t": 216000,
            "value": 20.0
          },
          {
            "t": 259200,
            "value": 5.0
          },
          {
            "t": 302400,
            "value": 20.0
          },
          {
            "t": 345600,
            "value": 5.0
          },
          {
            "t": 388800,
            "value": 20.0
          },
          {
            "t": 432000,
            "value": 5.0
          },
          {
            "t": 475200,
            "value": 20.0
          },
          {
            "t": 518400,
            "value": 5.0
          },
          {
            "t": 561600,
            "value": 20.0
          },
          {
            "t": 604800,
            "value": 5.0
          },
          {
            "t": 648000,
            "value": 20.0
          },
          {
            "t": 691200,
            "value": 5.0
          },
          {
            "t": 734400,
            "value": 20.0
          },
          {
            "t": 777600,
            "value": 5.0
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 777600,
          "equals": false
        }
      ]
    }
  ]
}

AHU-0024 — Duct static pressure reset not functioning

Preconditions (host-enforced): AHU serves multiple zones; zone damper feedback available and aggregated by the host into zone_dmpr_pos_max. When zone damper data is missing or stale, the verdict is NO_EVAL, not healthy.

Points: dsp_sp, zone_dmpr_pos_max

Outputs:

• yFault — True while the DSP setpoint has stayed flat over the evaluation window despite all zone dampers staying well below fully open, for at least alarm_delay

Parameters:

Description

The duct static pressure setpoint remains fixed despite varying zone demand. A functioning DSP reset (G36 §5.16.1 trim-and-respond) lowers the setpoint when zone dampers are not widely open; because fan power scales with the cube of pressure, even small reductions produce outsized savings. The other half of the “74% problem” with AHU-0023 — absent in 74% of buildings (PNNL 151-building study) — and a member of cluster CLU-02 with the same $0 desk-only fix.

Detection Logic

baseline(dsp_sp) = dsp_sp sampled and held every evaluation_window (3 days)
sp_flat          = |dsp_sp − baseline(dsp_sp)| < sp_flat_tolerance,
                   continuously for evaluation_window
low_demand       = zone_dmpr_pos_max < high_damper_threshold,
                   continuously for evaluation_window

yFault = sp_flat AND low_demand, sustained for alarm_delay

Block graph (rule.cxf.jsonld):

The setpoint chain mirrors AHU-0023’s sampled-baseline flatness detector. The demand condition needs no baseline at all: the reference’s max(zone_dmpr_pos_all) < 70% over the window is exactly equivalent to “the highest zone damper stays below 70% continuously,” which is one LessThreshold plus a dwell TrueDelay on the host-aggregated maximum. Worst-case time to alarm from cold start: evaluation_window + alarm_delay (4 days).

Possible Diagnoses

1. DSP reset never programmed in the BAS
2. DSP reset disabled by an operator
3. Trim-and-respond parameters misconfigured
4. Zone damper feedback not connected to the AHU controller

Energy Impact

EXCESS_CONSUMPTION, HIGH confidence, PROXY_ESTIMATION (EEM-12). Fan energy scales with the cube of duct pressure: a 20% setpoint reduction yields ~49% fan energy savings. Savings 1–3% of site energy; climate-neutral. Prevalence: 74% of buildings.

Emissions Impact

Scope 2, PROXY_EMISSIONS, HIGH confidence; typical 400–3,000 kg CO₂e/yr (excess fan energy, cubic law). Avoided-emissions basis: MOER.

Deviations

• zone_dmpr_pos_all (array) → host-derived zone_dmpr_pos_max (scalar). The reference consumes every zone damper position; library v1 avoids array boundary points, so the host aggregates the maximum across the zones served and feeds one scalar (flagged derived in the point dictionary). The zone-side underlying points get their semantic tags when the VAV dictionary lands.
• Windowed range → sampled-baseline flatness on the setpoint chain, as AHU-0023 (sp_flat_tolerance = min_expected_sp_range/2; same MovingAverage ring-capacity rationale). The damper condition is an exact transformation, not an approximation: max over window < t ⇔ continuously below t.
• delayOnInit = true on all TrueDelays (startup conservatism per AHU-0016).

Notes

Evaluate together with AHU-0023: both fire → CLU-02 confirmed, one trim-and-respond programming visit fixes both. The reference’s PNNL-27338 AIRCx corollary — DSP > 0.2 in. w.g. during unoccupied hours — is covered separately by the after-hours rules (AHU-0018 family).

Test Vectors

5 scenarios, clock step 300 s over 432000 s.

{
  "schema": "cxf-library/vectors/v1",
  "clock": {
    "step_s": 300,
    "horizon_s": 432000
  },
  "scenarios": [
    {
      "name": "reset_working",
      "description": "Reference vector: DSP_SP modulates 100 Pa with demand; no fault",
      "inputs": {
        "dsp_sp": [
          {
            "t": 0,
            "value": 350.0
          },
          {
            "t": 21600,
            "value": 450.0
          },
          {
            "t": 43200,
            "value": 350.0
          },
          {
            "t": 64800,
            "value": 450.0
          },
          {
            "t": 86400,
            "value": 350.0
          },
          {
            "t": 108000,
            "value": 450.0
          },
          {
            "t": 129600,
            "value": 350.0
          },
          {
            "t": 151200,
            "value": 450.0
          },
          {
            "t": 172800,
            "value": 350.0
          },
          {
            "t": 194400,
            "value": 450.0
          },
          {
            "t": 216000,
            "value": 350.0
          },
          {
            "t": 237600,
            "value": 450.0
          },
          {
            "t": 259200,
            "value": 350.0
          },
          {
            "t": 280800,
            "value": 450.0
          },
          {
            "t": 302400,
            "value": 350.0
          },
          {
            "t": 324000,
            "value": 450.0
          },
          {
            "t": 345600,
            "value": 350.0
          },
          {
            "t": 367200,
            "value": 450.0
          },
          {
            "t": 388800,
            "value": 350.0
          },
          {
            "t": 410400,
            "value": 450.0
          },
          {
            "t": 432000,
            "value": 350.0
          }
        ],
        "zone_dmpr_pos_max": 85.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 432000,
          "equals": false
        }
      ]
    },
    {
      "name": "fixed_sp_low_demand",
      "description": "Reference vector: DSP_SP pinned while dampers well below 70%; fault after evaluation_window (3d) + alarm_delay (24h)",
      "inputs": {
        "dsp_sp": 400.0,
        "zone_dmpr_pos_max": 45.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 343200,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 348000,
          "to_s": 432000,
          "equals": true
        }
      ]
    },
    {
      "name": "fixed_sp_high_demand",
      "description": "Reference vector: DSP_SP pinned but dampers near max \u2014 setpoint cannot drop, no fault",
      "inputs": {
        "dsp_sp": 400.0,
        "zone_dmpr_pos_max": 95.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 432000,
          "equals": false
        }
      ]
    },
    {
      "name": "demand_rises_resets",
      "description": "Low demand for 2.3 days, then dampers open past threshold before the window completes; dwell resets, never alarms",
      "inputs": {
        "dsp_sp": 400.0,
        "zone_dmpr_pos_max": [
          {
            "t": 0,
            "value": 45.0
          },
          {
            "t": 200000,
            "value": 95.0
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 432000,
          "equals": false
        }
      ]
    },
    {
      "name": "damper_at_threshold",
      "description": "Max damper exactly at high_damper_threshold is not low demand (strict < comparison)",
      "inputs": {
        "dsp_sp": 400.0,
        "zone_dmpr_pos_max": 70.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 432000,
          "equals": false
        }
      ]
    }
  ]
}

AHU-0025 — Heating or cooling coil lockout not active by OAT

Preconditions (host-enforced): Supply fan running — a coil lockout only matters while the unit moves air. The OAT reading must be trustworthy: a biased outdoor sensor produces this exact signature with no lockout defect present (diagnosis 4), so hosts should gate on OAT data quality. When either gate is unmet the verdict is NO_EVAL, not healthy.

Points: htg_vlv_cmd, clg_vlv_cmd, oat

Outputs:

• yFault — True while a coil has been open past valve_open_threshold on the wrong side of its OAT lockout for at least alarm_delay

Parameters:

Description

A coil is running on the wrong side of its outdoor-air lockout: the heating valve is open while outdoor air is warm, or the cooling valve is open while outdoor air is cold. Either way the lockout that should have disabled that coil is missing, overridden, or defeated by a valve that will not close. Out-of-season coil operation is pure waste — the load it serves is either nonexistent or better met by outdoor air — and it usually runs for months before anyone notices, because nothing about it is uncomfortable. Present in roughly 15% of buildings; a member fault of CLU-01 (Simultaneous Heating & Cooling), whose trigger is AHU-0016.

Detection Logic

yFault = (htg_vlv_cmd > valve_open_threshold AND oat > heating_lockout_temp)
      OR (clg_vlv_cmd > valve_open_threshold AND oat < cooling_lockout_temp)
      sustained continuously for alarm_delay

Block graph (rule.cxf.jsonld):

The two branches are independent tests that share one persistence timer: oat fans out to oatWarm and oatCold, each valve gets its own open test at the same threshold, and anyMiss raises either finding. All three comparisons are strict, so a valve parked at exactly 5% or an OAT sitting exactly on 18 °C or 10 °C does not trip the rule. Between the two lockout temperatures — the 10–18 °C band where economizer operation belongs — neither branch can fire regardless of valve position; judging coil operation inside that band is AHU-0016’s job, not this rule’s. persist requires 30 minutes of continuous violation, which rides out mode changes, morning warmup tails, and short manual valve strokes.

Possible Diagnoses

1. Lockout sequence never programmed in the BAS
2. Lockout overridden or disabled (often during a comfort complaint, then left)
3. Valve stuck open — mechanical failure, failed actuator, or a normally-open valve with no signal
4. Incorrect OAT sensor reading (sun-exposed or wall-heated sensor reads warm; a sensor in an exhaust path reads warm year-round)

Energy Impact

CRITICAL_WASTE, MEDIUM confidence, DIRECT_MEASUREMENT. Waste is computable from the live valve command and the coil’s design capacity: heating branch waste_kw = htg_vlv_cmd/100 × ahu_htg_capacity_kw, cooling branch waste_kw = clg_vlv_cmd/100 × ahu_clg_capacity_kw. Correcting the lockout saves 5–15% of the affected subsystem’s energy while the fault is active (PNNL-25985 EEM-38). Confidence is MEDIUM rather than HIGH because the lockout temperatures are site-specific: a building with a genuine year-round reheat load or a heat-recovery scheme may legitimately hold a coil open outside the default band. Sensitive to both climates — the heating branch bites in shoulder seasons and summer, the cooling branch in winter.

Emissions Impact

Scope 1 + 2, DIRECT_EMISSIONS, MEDIUM confidence; typical 500–4,000 kg CO₂e/yr. The two branches land in different inventories: out-of-season heating is usually scope 1 gas at the boiler, out-of-season cooling is scope 2 electricity at the chiller. Avoided-emissions basis: marginal operating emissions rate (MOER).

Deviations

• Severity 3 (warning), per the reference’s chapter 9 card — its only severity statement for this fault, since the §5.8.1 index carries no severity column. This chapter’s README previously mistranscribed it as 2, corrected alongside this card.
• The reference tags this fault for both AHU and RTU. This card is the AHU-family instance; an RTU-family sibling would restate it against staged compressor and gas-valve commands rather than modulating valve positions.
• All three comparisons are strict (>, >, <); the reference does not specify boundary behavior, so an OAT parked exactly on a lockout setpoint stays out of the alarm.
• valve_open_threshold is one card parameter bound to two CXF paths (htgOpen.t, clgOpen.t), matching the reference’s single threshold. Hosts must set both together; a site needing per-coil thresholds should retune the paths individually and note the divergence.
• Preconditions (fan running, OAT trustworthy) are declared in frontmatter for host enforcement rather than encoded in the block graph, as in AHU-0016.
• persist.delayOnInit = true (Modelica/CDL default is false), the library’s standing choice: a violation already present at load still waits out the full 30 minutes instead of alarming on the first tick after a controller restart.

Notes

Both branches feed one persist timer, so a violation that switches branches without a gap keeps the timer running — which takes an 8 °C OAT swing inside a single tick. If both branches fire on the same day, suspect the sensor before the sequence.

Fix order within CLU-01: clear the trigger (AHU-0016) first, since a valve held open by a fighting control loop also reads as a missing lockout. When the lockout is genuinely absent, add one with hysteresis — typically disable heating above 16 °C and re-enable below 14 °C (playbook simultaneous-hc, step 2.4).

Test Vectors

9 scenarios, clock step 60 s over 3600 s.

{
  "schema": "cxf-library/vectors/v1",
  "clock": {
    "step_s": 60,
    "horizon_s": 3600
  },
  "scenarios": [
    {
      "name": "normal_heating_in_winter",
      "description": "Reference vector: heating valve at 40% with OAT 2 \u00b0C \u2014 below the heating lockout, so heating is legitimate",
      "inputs": {
        "htg_vlv_cmd": 40.0,
        "clg_vlv_cmd": 0.0,
        "oat": 2.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 3600,
          "equals": false
        }
      ]
    },
    {
      "name": "heating_when_warm",
      "description": "Reference vector: heating valve at 30% with OAT 25 \u00b0C \u2014 heating lockout is not active; alarms after alarm_delay (1800 s)",
      "inputs": {
        "htg_vlv_cmd": 30.0,
        "clg_vlv_cmd": 0.0,
        "oat": 25.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1740,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 1860,
          "to_s": 3600,
          "equals": true
        }
      ]
    },
    {
      "name": "cooling_when_cold",
      "description": "Reference vector: cooling valve at 40% with OAT 2 \u00b0C \u2014 cooling lockout is not active; alarms after alarm_delay",
      "inputs": {
        "htg_vlv_cmd": 0.0,
        "clg_vlv_cmd": 40.0,
        "oat": 2.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 1740,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 1860,
          "to_s": 3600,
          "equals": true
        }
      ]
    },
    {
      "name": "normal_cooling_in_summer",
      "description": "Cooling valve at 60% with OAT 28 \u00b0C \u2014 above the cooling lockout, so cooling is legitimate",
      "inputs": {
        "htg_vlv_cmd": 0.0,
        "clg_vlv_cmd": 60.0,
        "oat": 28.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 3600,
          "equals": false
        }
      ]
    },
    {
      "name": "valve_exactly_at_threshold",
      "description": "Edge case: heating valve sits exactly at valve_open_threshold (5%) in 25 \u00b0C weather \u2014 the strict `>` means the coil does not count as open",
      "inputs": {
        "htg_vlv_cmd": 5.0,
        "clg_vlv_cmd": 5.0,
        "oat": 25.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 3600,
          "equals": false
        }
      ]
    },
    {
      "name": "oat_at_heating_lockout_then_above",
      "description": "Edge case: OAT sits exactly at heating_lockout_temp (18 \u00b0C) with the heating valve open \u2014 no alarm; at t=1200 OAT rises to 18.1 \u00b0C and the alarm follows 1800 s later",
      "inputs": {
        "htg_vlv_cmd": 30.0,
        "clg_vlv_cmd": 0.0,
        "oat": [
          {
            "t": 0,
            "value": 18.0
          },
          {
            "t": 1200,
            "value": 18.1
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 2940,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 3060,
          "to_s": 3600,
          "equals": true
        }
      ]
    },
    {
      "name": "oat_at_cooling_lockout",
      "description": "Edge case: OAT sits exactly at cooling_lockout_temp (10 \u00b0C) with the cooling valve open \u2014 the strict `<` means no alarm",
      "inputs": {
        "htg_vlv_cmd": 0.0,
        "clg_vlv_cmd": 45.0,
        "oat": 10.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 3600,
          "equals": false
        }
      ]
    },
    {
      "name": "warm_spell_clears_before_delay",
      "description": "Transient: heating runs in 25 \u00b0C air, but OAT drops back to 5 \u00b0C at t=1200 \u2014 the condition clears before alarm_delay completes, so no alarm",
      "inputs": {
        "htg_vlv_cmd": 30.0,
        "clg_vlv_cmd": 0.0,
        "oat": [
          {
            "t": 0,
            "value": 25.0
          },
          {
            "t": 1200,
            "value": 5.0
          }
        ]
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 3600,
          "equals": false
        }
      ]
    },
    {
      "name": "valve_cycle_resets_persistence",
      "description": "Transient: cooling valve closes at t=900 and reopens at t=1200 in 2 \u00b0C air \u2014 persistence restarts from the reopen, so the alarm lands at 3000 s, not 1800 s",
      "inputs": {
        "htg_vlv_cmd": 0.0,
        "clg_vlv_cmd": [
          {
            "t": 0,
            "value": 40.0
          },
          {
            "t": 900,
            "value": 0.0
          },
          {
            "t": 1200,
            "value": 40.0
          }
        ],
        "oat": 2.0
      },
      "expect": [
        {
          "output": "yFault",
          "from_s": 0,
          "to_s": 2940,
          "equals": false
        },
        {
          "output": "yFault",
          "from_s": 3060,
          "to_s": 3600,
          "equals": true
        }
      ]
    }
  ]
}

AHU-0026 — Outdoor air damper not closed during unoccupied periods

Preconditions (host-enforced): Occupancy schedule data available and current; the host evaluates the schedule (time zone, calendar, holidays) into the boolean occ_schedule point. When schedule provenance is unknown or stale, the verdict is NO_EVAL, not healthy.

Points: sf_status, occ_schedule, oa_dmpr_cmd

Outputs:

• yFault — True while the supply fan has run unoccupied with the OA damper commanded above oa_closed_threshold for at least alarm_delay

Parameters:

Description

The air handler runs outside the occupancy schedule with the outdoor air damper still commanded open. Unoccupied operation — night setback, morning warmup, a tenant override — needs no ventilation: there is nobody to ventilate for, so every cubic metre of outdoor air drawn in is heated or cooled to no purpose. A damper left at its occupied minimum (typically 15–30%) through a winter night puts the full outdoor-to-return enthalpy difference on the coils for the entire run. Prevalence is about 10%, and the fix is usually a single line in the unoccupied sequence. This is the ventilation half of the after-hours pair: AHU-0018 asks whether the fan should be running at all, this one asks whether it is dragging in outdoor air while it runs.

Detection Logic

yFault = sf_status
     AND NOT occ_schedule
     AND oa_dmpr_cmd > oa_closed_threshold
     sustained continuously for alarm_delay

Block graph (rule.cxf.jsonld):

unoccRun establishes that the fan is running while the schedule says unoccupied; dmprOpen tests the damper command against the closed threshold with a strict comparison, so a damper parked at exactly 5% (leakage band, or a minimum-position parameter never zeroed but within tolerance) does not alarm. persist requires the combination to hold for alarm_delay, which rides out the damper stroke at a scheduled occupied→unoccupied transition. Any fan stop, return to occupancy, or damper close resets the timer, and a damper that reopens restarts the full 15 min; delayOnInit = true holds the window across a controller restart.

Possible Diagnoses

1. Minimum OA position not set to 0% in the unoccupied sequence — the damper holds its occupied minimum around the clock
2. OA damper stuck open (seized linkage, failed actuator, disconnected crank arm)
3. Economizer logic overriding unoccupied damper control — the economizer sees a favorable outdoor condition and modulates the damper open without consulting occupancy

Energy Impact

CRITICAL_WASTE, HIGH confidence, DIRECT_MEASUREMENT. The waste is the conditioning load on unnecessary outdoor air: waste_kw = (oa_dmpr_cmd/100) × design_oa_flow × cp × |OAT − RAT|. With the damper open, 100% of ventilation energy during the unoccupied run is waste; measured against total off-hours energy the correction typically returns 3–10% (PNNL-25985 EEM-06, OA damper faults; PNNL RetuningOpps A11). Heating-dominant: the winter night is when |OAT − RAT| is largest.

Emissions Impact

Scope 1 + 2, DIRECT_EMISSIONS, HIGH confidence; typical 1,000–8,000 kg CO₂e/yr for the ventilation energy alone. The split follows the heating source — scope 1 for the gas burned to temper unnecessary outdoor air, scope 2 for the electric heat or cooling. Because the fault runs overnight, the electric share should be valued at the marginal rather than average grid rate. Avoided-emissions basis: MOER.

Deviations

• No grace period, matching the reference, where AHU-0018 grants 30 minutes. The difference is deliberate: legitimate unoccupied fan operation — setback, warmup, an authorized override — should still run with the OA damper closed, so there is no state this rule needs to forgive.
• The reference’s logic uses a schedule-evaluation predicate over an occupancy schedule object; as in AHU-0018 we consume the host-evaluated boolean occ_schedule point, leaving time zone, calendar, and holiday interpretation to the host (see points/ahu.points.json notes on occ_schedule).
• Severity 3 (warning), per the reference’s chapter 9 card — its only severity statement for this fault, since the §5.8.1 index carries no severity column. This chapter’s README previously mistranscribed it as 2, corrected alongside this card.
• The reference tags this fault for both AHU and RTU. This is the AHU-family instance; an RTU sibling would reuse the same block graph against the RTU point dictionary.
• delayOnInit = true on persist: a controller restart mid-condition still waits out the full persistence window (same startup-alarm rationale as AHU-0016 and AHU-0018).

Notes

The remote fix is a sequence edit — zero the minimum OA position in unoccupied mode and gate the economizer on occupancy — Step 2 of the after-hours-operation playbook. Firing alongside AHU-0018 (the CLU-04 trigger), fix the schedule first: restoring the unoccupied period often closes the damper as a side effect. Firing without FC-052, the schedule is right and the damper sequence or the actuator is wrong.

Test Vectors

9 scenarios, clock step 60 s over 3600 s.