Most buildings do not lose control performance because of one major failure. They drift there one small change at a time.
A tenant complains that one floor is too warm, so an operator lowers a setpoint. A technician disables a reset during maintenance. A vendor changes a schedule while troubleshooting. A temporary override keeps the building stable through an unusual operating week.
Each decision may be reasonable. The risk appears afterward, when the setting stays, the original reason is forgotten, and the next adjustment is added on top of it.
Configuration drift rarely looks like a control failure
Eventually, the BMS is still running, alarms are not necessarily active, and equipment continues to operate. But nobody can clearly explain why the building is running that way.
This is control configuration drift: the actual operating state gradually separates from the approved sequence, control envelope, and operator intent without one obvious failure event.
- Overrides that never expire.
- Schedules that no longer match occupancy.
- Reset limits tightened after an old complaint.
- Equipment locked into conservative operating modes.
- Conflicting setpoints across supervisory and local controllers.
- Seasonal changes that were never reversed.
Preserve operational intent, not only current values
The answer is not to prevent operators from changing the building. Facility teams need the authority to respond to comfort complaints, maintenance, equipment availability, special events, and abnormal weather.
The answer is to preserve operational intent. A point value shows what the BMS is doing now. It does not show whether that value is a permanent strategy, a temporary exception, a troubleshooting step, or an old workaround that nobody has revisited.
Without that context, a trend log can preserve the number while losing the decision behind it.
Every meaningful control change needs a lifecycle
A durable operating record should make each material change reviewable by the people responsible for the building. That does not require a meeting for every small action, but it does require enough context to distinguish approved strategy from temporary exception.
- An owner responsible for the change.
- A reason tied to an operating condition or event.
- An expected duration or explicit review date.
- A visible effect in the BMS trend and command record.
- A clear path to review, reversal, or formal adoption.
Supervisory control should make drift visible
The BMS remains the system of record for local loops, safeties, alarms, schedules, approved limits, and operator override. A supervisory layer should not take that authority away.
It can instead compare actual settings and operating modes with the approved control envelope, identify when a temporary exception has outlived its stated purpose, and show which downstream energy, comfort, or equipment outcomes changed with it.
That comparison also strengthens measurement and verification. Savings claims are harder to defend when schedules, overrides, modes, and setpoints change without an auditable record. A visible command and exception history helps separate optimization results from unrelated operating changes.
Make recovery deliberate instead of archaeological
Configuration drift is not solved by blindly restoring every point to its commissioning value. Some operating changes become necessary permanent improvements; others should expire; still others reveal that the approved sequence needs revision.
The useful goal is a deliberate review: understand what changed, why it changed, whether the reason still applies, what the building did afterward, and whether the setting belongs inside the current operating strategy.
HVAC optimization starts with understanding the system that is actually operating, not the sequence everyone thinks is operating.
The most expensive setting in a building may be the temporary one that became permanent.