/ Engineering · Operations
The day-two discipline,
made operational.
AMC cadence, incident response, preventive replacement, firmware governance — the operational artefacts that turn a handed-over system into a system the operations team actually owns.
- Operations workflows
- 2
- Operations principles
- 4
- Total planner stages
- 22
- Day-two artefacts
- AMC pack · Trend baseline · Firmware register
/ Closed-loop reference
The commissioning loop, applied post-handover
Every operational change re-enters the same six-stage loop that closes commissioning. No in-place edits without verification and as-built documentation — that discipline is what keeps an AMC-supported system answerable years after handover.
/ maintenance
Maintenance workflow — AMC tier cadence
The annual maintenance cadence we run against an AMC contract — scheduled inspections, preventive replacements, firmware reviews and incident response.
Maintenance is the day-two discipline of the practice. An AMC contract is not a phone number; it is a documented cadence of scheduled inspections, preventive replacements and firmware reviews, with a clear incident-response tier behind it. The discipline is the cadence — when did we last test the battery autonomy on the BESS, when did we last sweep the Cat6A channels, when did we last walk the addressable loop. The workflow below is the tier-1 cadence; tiered upgrades shorten the inspection interval and add contracted critical-hours support.
operations
Scheduled site inspection
Walk the building against the AMC checklist — visual, electrical and integration spot checks.
- · Inspection record
- · Updated punch list
Duration · 1 day (quarterly cadence)
operations
Preventive replacement window
Replace components that are at the end of their wear-life — UPS batteries, smoke detectors past EOL, sealed-bearing fans, gateway flash memory.
- · Replacement record
- · Updated component lifecycle register
Duration · 2–5 days (annual)
operations
Firmware review window
Review device firmware against the manufacturer release notes — patch security advisories, defer feature-only releases.
- · Patch decision log
- · Updated device firmware register
Duration · 1 day (semi-annual)
operations
Incident response
Respond to incidents within the AMC tier's documented response targets. Each incident produces a closure note that updates the trend report.
- · Incident closure note
- · Updated trend report
Duration · Per AMC response-target tier
/ lifecycle
Lifecycle planner — the 10-year operational window
The decade-long planning view that takes a system from handover through expansion and into retrofit / refresh.
A building system lives for a decade or more. The lifecycle planner is the view that takes the system from handover (year zero) through expansion (years one to four) and into retrofit / refresh (years five to ten). The planner does not predict the future; it documents the decision points where the next reinvestment is expected, so the client can budget against them. The discipline is the decision point — when is the battery string due, when is the BMS supervisory layer due for a major upgrade, when does the addressable fire panel reach end-of-line. Surfacing these in year zero is what distinguishes a 7-stage handover from a 7-stage handover plus a lifecycle plan.
lifecycle
Year zero — stabilisation
First-year stabilisation — snag list closure, trend baseline, first AMC cycle.
- · Stabilisation report (year one)
- · Trend baseline
Duration · 12 months
lifecycle
Years one–four — expansion & incremental upgrade
The incremental expansion window — added zones, added cameras, added scenes. Each expansion produces a mini-commissioning.
- · Expansion design pack
- · Mini-commissioning record
Duration · Across years 1–4
lifecycle
Year five — mid-life review
A formal review of the system against the original requirements pack and the current operational reality.
- · Mid-life review report
- · Refresh recommendation
Duration · 1–3 months
lifecycle
Years six–ten — refresh or retrofit
Roll the system through a refresh (firmware, point devices, ballasts) or a retrofit (panel, supervisory layer, BESS).
- · Refresh / retrofit design pack
- · Migration plan (where applicable)
Duration · Across years 6–10
/ Operations principles
The principles that govern the operational discipline
operations
Graceful degradation over heroic recovery
A system that fails gracefully — fails one zone, not the whole building — is more valuable than a system that promises five-nines.
Read in methodology →maintenance
Preventive maintenance over reactive response
An AMC measured by ticket-close-time is failing; an AMC measured by preventive-event-cadence is working.
Read in methodology →governance
Operational continuity through documented runbooks
Runbooks turn senior knowledge into operational repeatability. Without them, the FM team improvises every incident.
Read in methodology →governance
Single-point accountability across system seams
Multi-vendor systems integrate at the seams; someone has to own the seams.
Read in methodology →Key engineering takeaways
- AMC cadence is sector-bound, not catalogue-driven. A clinical-care deployment carries quarterly preventive checks against IS-2189 maintenance discipline; a retail-mall BMS carries half-yearly checks against the energy-analytics anomaly profile.
- Firmware governance is a published register, not a side-table. Every controller, NVR, panel and DSP carries a documented firmware version, a documented rollback path, and an offline-stored configuration baseline against each release.
- Incident response is rehearsed at every AMC visit, not invoked on the day. Recovery procedures live with the operations manual the building's day-two engineer can execute, not a sub-contractor playbook the building does not own.
- Preventive replacement intervals are scored against operating context, not catalogue averages. A UPS bank in a 35°C-ambient electrical room carries a different replacement profile than the same bank in a 22°C data-centre.
- Named-pack spares inventory is the AMC's competitive moat. A deployment's spares are held against its specific BOQ, not drawn from a generic vendor pool — the wait time for a replacement on a Saturday is the test of an AMC's seriousness.
Common mistakes
What we see go wrong
- Treating the AMC as a billing exercise rather than a discipline.
- Why it fails — An AMC contract that does not specify preventive cadence, named-pack inventory, configuration-baseline export and incident-response rehearsal is paperwork, not maintenance. The building pays the same price and inherits the next failure unaided.
- What we do instead — Every AMC clause names a deliverable. Every deliverable carries a sign-off discipline. The AMC visit log is the contract's primary evidence — written, dated, and held against the building's clinical-engineering or facility documentation.
- Firmware updates pushed without offline configuration export.
- Why it fails — A firmware release silently shifts AEC notch behaviour, cause-and-effect timing, alarm definitions and DSP scene libraries. Without an offline baseline export before the update, the room's documented operating profile is lost to the release notes.
- What we do instead — Every firmware update carries a pre-release offline export to the configuration archive and a post-release validation pass against the saved baseline. No update goes live without both steps logged.
- Incident-response procedures held only in the sub-contractor's head.
- Why it fails — An incident that depends on the original sub-contractor is one phone call away from a multi-day outage. The building's facility engineer should be able to execute the first three recovery steps on their own — anything beyond that is an escalation, not the first response.
- What we do instead — Recovery procedures live in the operations manual the building owns; the first three steps for the top five failure scenarios are rehearsed with the facility engineer at every AMC visit.
- Spares pool shared across deployments without named-pack discipline.
- Why it fails — On a Saturday with three deployments needing the same panel, the first to call wins; the others wait against a procurement cycle that does not honour clinical or operational urgency. Generic pool spares fail at the moment they are needed.
- What we do instead — Named-pack inventory keyed to each deployment's BOQ, held against the AMC calendar, with support windows held against the contract — not against the spares pool's availability.
Deployment realities
What the drawings never show
AMC visit logs are the contract's primary evidence.
A signed, dated AMC visit log against each deployment's documented preventive schedule is the only audit-grade evidence the maintenance discipline survived the contract period — not the AMC paperwork at signature, not the calendar of intended visits.
Recovery rehearsal at every AMC visit, not before failure.
The top five failure scenarios for each deployment are rehearsed end-to-end with the building's day-two engineer at every AMC visit — not described, not documented, rehearsed. Otherwise the procedure exists on paper and not in muscle memory.
Configuration archives stored offline on a separate medium.
Every controller, panel, NVR and DSP configuration baseline is exported to an offline archive on a separate physical medium after every configuration change — not stored on the controller itself, not stored on the building's network. The recovery procedure is rehearsed against the offline archive.
Operating context drives preventive interval, not catalogue average.
A UPS bank in a 35°C-ambient electrical room ages on a different curve than the same bank in a 22°C data centre. The preventive replacement interval is scored against the operating context measured at handover and re-measured at each AMC visit, not against the manufacturer's catalogue average.
· Where to go next
The operations authority graph.
Engineering discipline
· Operations · The system the operations team owns