BMS & EPMS / REFERENCE ARCHITECTURE
Understand the systems that keep critical facilities running. Follow the equipment, practice a point configuration, and test what happens when power, cooling or communication fails.
A Buntop reference facility. All readings and scenarios are simulated. This is not an AWS facility design or a live monitoring system.
01 / EXPLORE
BMS manages environmental control. EPMS makes electrical conditions and events visible. Their responsibilities, access rights and failure dependencies must be explicit, even when they share a supervisory platform.
BUILDING MANAGEMENT SYSTEM
DDC or PLC sequences regulate pumps, fans, valves and cooling equipment using local sensors, PID loops and proven equipment permissives.
ELECTRICAL POWER MONITORING SYSTEM
Meters, relay records and equipment interfaces reveal availability, capacity, power quality and the sequence of a disturbance.
These are functional groups, not fixed Purdue levels. Security zones follow the risk assessment and approved flows.
01 / FIELD EQUIPMENT
Temperature, pressure and flow sensors inform cooling control. Power meters and breaker contacts inform electrical monitoring.
A conceptual low-voltage transfer arrangement. Transformer ratings, protection, earthing, bypasses and transfer design require the approved electrical study. This illustration does not claim 2N redundancy.
Transfer time and UPS autonomy depend on equipment, load and acceptance tests. Generators, ATS and protection do not rely on cloud telemetry.
Illustrative options, not claims of vendor partnerships or installed client equipment. Confirm the selected model, firmware, licenses and supported interfaces.
| System | Example products | Engineering role | Interface / check |
|---|---|---|---|
| Local building control | Siemens PXC; Schneider Electric AS-P | Local sequences, PID control and equipment permissives | BACnet/IP, field I/O as supported; test loss of supervision |
| Building supervision | Siemens Desigo CC; Johnson Controls Metasys; Niagara N4 | Graphics, alarms, trends and managed operator access | Supported BACnet / integration drivers; distinguish supervisory engines from local controllers |
| Cooling instrumentation | Vaisala transmitters; Belimo Energy Valve | Environmental measurement and hydronic valve control | Analog / BACnet / Modbus according to variant; verify units and scaling |
| HVAC drives & cooling | ABB ACH580; York chillers; Vertiv CRAH; CoolIT CDUs | Motor control, heat rejection and liquid-cooling interfaces | Vendor interface and sequence; verify flow proof, limits and fault response |
| Power-quality meters | Schneider Electric PowerLogic ION9000 / PM8000 | Power measurements, events and supported waveform capture | Modbus / supported meter driver; check variant, recording settings and clock accuracy |
| Protective relays | SEL-751; ABB Relion | Local protection with events exposed for monitoring | IEC 61850, DNP3 or Modbus where supported; telemetry does not replace protection |
| UPS & generation | Vertiv Liebert; Eaton 9395; Caterpillar / Cummins generators | Power continuity, battery condition and source availability | Vendor gateways / contacts; test rated autonomy and actual start/transfer sequence |
| Power supervision | EcoStruxure Power Operation / PME; Eaton Foreseer; Ignition | Operator views, trends, event correlation and records | Supported device drivers; waveform files and source timestamps retained separately |
| Edge collection & modeling | OnLogic Karbon; PTC Kepware; HighByte | Approved host, device drivers and contextualized telemetry | Supported OPC UA / BACnet / Modbus connectors; runtime compatibility and read permissions reviewed |
| Security & MQTT transfer | Siemens SCALANCE SC-600; Eclipse Mosquitto; AWS IoT Core | Distinct firewalls, zone-local messaging and authenticated ingestion | Explicit routes, client identities, TLS and topic policies; multiple NICs are not a firewall |
No matching equipment. Try another term or category.
Example: a chilled-water supply temperature becomes a trusted, timestamped asset value. Telemetry moves north; cloud commands are not enabled in this reference design.
FACILITY OT ZONE
A supported collector initiates read access to the DDC through an approved BACnet/IP interface. HighByte can model the value through a verified compatible connector.
Control: named source, read permissions where supported, approved polling load, source units and quality.
FIREWALL A / OT → DMZ
The publisher initiates a permitted MQTT/TLS session to a DMZ broker such as Mosquitto. Separate client identities restrict publication and subscription topics.
Control: source, destination and service allowlist; certificate trust, renewal, logging and bounded queues.
FIREWALL B / DMZ → AWS
A configured relay, optionally hosted on AWS IoT Greengrass V2, initiates MQTT/TLS to the named AWS IoT Core endpoint.
Control: individual client certificate and scoped IoT policy. Greengrass is a runtime; BACnet collection needs an explicit supported component.
ASSET VALUES
Map a defined property alias, value type, timestamp and quality. Validate per-entry ingestion errors.
HISTORICAL RECORDS
Optional Lambda transformation in Firehose. Use documented buffering, retention, encryption and lifecycle rules.
EVENTS & INVESTIGATION
Route operational events separately. Retain original waveform files, such as COMTRADE, in controlled storage with links to source event records.
Firewall and DMZ transfer is the baseline here. A data diode is a different one-way architecture, not an air gap; TCP/TLS services require an engineered paired proxy or protocol termination design. Neither protocol encryption nor a dual-NIC host creates a security boundary on its own.
Separate source timestamp, collection time and cloud arrival time. A 1 ms display resolution does not prove 1 ms accuracy. Select compatible PTP / IRIG-B / NTP systems for the required error budget, and test clock loss, holdover and event ordering.
Approved protection and interlocks may use hardwired circuits or certified safety communication. Verify the entire response chain. Define loss-of-signal and restart behaviour for each asset; neither full-speed cooling nor automatic restart is a universal safe state.
02 / CONFIGURE
Practice an illustrative 4–20 mA temperature mapping. Change scaling, alarm delay or data age and see how value, quality and the output payload change. This exercise writes no device configuration.
CALCULATED PREVIEW
Example mapping loaded.
Alias must be assigned to an actual asset property; the asset model defines the unit. The timestamp is a fixed teaching sample, not the current time. An IoT rule must explicitly map the received message to its SiteWise action.
Linear scaling only. The example evaluates a sustained high condition against an entered duration; it is not a live alarm engine. Site alarm design also needs deadbands, latching, acknowledgement, suppression rules and validated sensor-failure handling.
03 / SIMULATE
Step through a teaching sequence or replay it at a readable pace. Times are scenario offsets, not measurements or equipment guarantees.
Ready. Select Next step to begin.
Use the controls to reveal each dependency. In non-power scenarios, the electrical path remains at its baseline.
View the electrical path ↑Deterministic offsets from t=0. No fabricated live timestamps.
COOLING & ENERGY EXERCISE
Economizer example
Teaching thresholds: below 15 °C uses 100 kW of cooling; 15–20 °C blends linearly to 400 kW; at or above 20 °C uses 400 kW. IT load stays at 1,000 kW and other load at 100 kW.
Actual economizer decisions depend on the approved sequence, climate, water temperatures, humidity, dew point and equipment limits. This arithmetic is not a thermal model, a sizing tool or a promised facility PUE.
04 / COMMISSION
Use a practice worksheet to plan FAT, SAT and integrated systems testing. A selected result here is a browser-local learning record; it does not certify that a field test was performed.
| Test & expected result | Result | Evidence / measured limits |
|---|
Progress is saved in this browser when storage is available. Downloads include point settings, scenario progress and your worksheet notes. No information is submitted to Buntop.
Point and asset registers, sequences of operation, alarm matrix, network and approved-flow diagrams, time synchronization plan, backups, patch procedures and recovery runbooks.
Define recovery time objective (RTO), recovery point objective (RPO), test conditions, actual restoration time and observed data gaps. Have qualified personnel carry out electrical interventions under site safety procedures.
Inventory assets and dependencies, assess risk using applicable IEC 62443 guidance, manage vulnerabilities and vendor-approved patch windows, and test rollback and recovery.
Maintain access policies, approved remote support, configuration backups, monitoring and OT incident response procedures. Test a permitted telemetry flow and verify an unauthorized connection is blocked.
KEEP EXPLORING
This is a vendor-neutral reference with illustrative products, not a statement about any hyperscaler's internal deployments. Product capabilities depend on version and configuration. No claim of personal project experience, certification or client deployment is implied by these examples.