DDC Workbench Air handler
A single-zone air handler as a live DDC graphic, driven by a function-block program. The Unit tab is the supervisory screen a tech reads and adjusts — the parameter rail's setpoints commit to the running program; the Wiresheet tab is the control program running it. The workbench commands each output through a real BACnet priority array, on three levels: slot 8 (Manual Operator) for your hand, slot 16 for the sequence, and the Relinquish_Default fallback when both are NULL. The zone is a live thermal model, and the air path is solved psychrometrically station by station — mixing box, heating coil, cooling coil, fan — so the coil ΔT on the graphic is the one the airflow and the load actually produce.
Reading this screen
What this screen is. The supervisory graphic for a single-zone air handler — the screen a technician opens to see what the unit is doing right now. Air runs left to right: outdoor air at the intake, return air down from the zone, the two streams blending in the mixing box, then the filter, the heating coil, the cooling coil and the supply fan. The chevrons are the air itself, and they change colour where a coil has worked on it.
How to read it. Every device the program can read or write carries its own colour — dampers amber, the fan green, the heating coil warm, the cooling coil blue — so you can find a device before you read a word. Colour is never the only channel, though: each device is also drawn as the thing it is, which is why the cooling coil carries the small wedge-shaped refrigerant distributor and feeder tubes that no hydronic coil has, and the heating coil carries a two-way valve on the pipes below it. A component drawn in plain grey has no point on it. Values sit in bordered wells tied to their device by a leader line: a green value is something the program is commanding, a plain value is something a sensor is measuring, and a blue value is calculated from the others.
Drill-downs. The heating coil, the cooling coil and the fan are drawn as links into the simulator behind each device. The same three in text — the tap targets, for a screen where the glyphs render too small to hit: the Hydronic Loop Builder behind the heating coil, the Refrigerant Loop Simulator behind the DX coil, the Mock VFD Interface behind the fan.
The one number to watch. Read the ΔT well in the discharge callout: it is discharge minus mixed air — the fan sits downstream of both coils on a draw-through unit, so that span covers the fan as well — and it goes negative whenever the unit is removing heat and positive whenever it is adding heat. When a unit stops doing its job, that is the number that collapses toward zero. Everything else on the screen is there to tell you why it collapsed: whether the air is moving, whether a coil is loaded, and whether the number a sensor is reporting is the number the machine is actually seeing. The economizer sequence itself is worked through on the economizers lesson.
Three dampers, one command. The outside, return and relief blades all move together, because the point roster carries one damper output and the linkage does the rest — return closes as outside opens, and relief opens with it so the building does not pressurise. That is how a packaged economizer is actually built, and it is why all three commands are annotated rather than just the outside one: the drawn blade angles are what tell you the linkage is doing what the single command asked.
Setpoints and the deadband. The separation between the two setpoints and the deadband are easy to read as one number, and they are not. The SP DIFF well in the rail is the separation — cooling setpoint minus heating setpoint. Nothing sets it: move either setpoint — the rail's fields are live, so try it — and it follows, which is why it is inked blue like the ΔT well rather than the green its two neighbours carry. The deadband is the smaller, separate thing, and it belongs to whichever setpoint is currently active rather than to the pair. On the cooling side it sits above the setpoint: as shipped, with a 72.0 °F cooling setpoint and a 2.0 °F deadband, the stage makes at 74.0 °F and breaks back at 72.0 °F. Here the setpoint is the cut-out, so the zone rides the band above the number on the screen and a degree of drift cannot short-cycle the compressor. That is also why a space of 73.0 °F can sit under a lit stage — between the two edges the call is held by a latch, not by a comparison against the setpoint.
Two setpoints, and what happens when they overlap. This unit carries a heating setpoint and a cooling setpoint as separate program constants, not one setpoint with an offset — specifically so you can drag them into each other, from the rail or the wiresheet, and watch a unit fight itself. A hot-water valve open under a running compressor is a real field fault: the ΔT goes nowhere, the energy goes everywhere, and nothing on the machine is broken. The graphic calls it out, because reading it off two wells that each look reasonable on their own is exactly the skill worth having.
Two setpoints in a customer's hands. Put both setpoints on a front end and sooner or later a customer may set the heating setpoint above the cooling setpoint — on purpose, reasoning that cooling means cold, so the cooling number belongs on the bottom. The model is backwards: a cooling setpoint is the temperature above which cooling starts, not a temperature the cooling makes. But allow everyone access to both numbers and you'd be surprised how often they get crossed. That is not an argument for hiding the second setpoint either, because the access that trapped this customer is exactly what the next one is paying for. There is no house answer here, only a design judgement with obligations attached. Get the cooling-versus-heating model right yourself, and then build the graphic toward where the user actually stands: consider who will use the system and what their skill level is. A rural school whose whole front end answers to one custodian is a different job from a large factory campus with a team behind the screen, and not just because the controls are different. And consider adding protections in your logic, or even in the point itself if you have the ability. The programs on this machine leave them out on purpose — to a practiced eye that absence can read as a mistake, but it is the point: the failure has to stay reachable to be worth experiencing. This simulator shows you both postures at once: the rail is the guarded front end, each field clamping to its own range and announcing the catch; the wiresheet is the unguarded side — the same constants with no rails at all, where you can set a deadband the rail would refuse and nothing says a word. Both setpoints stay one keystroke from the plant on either surface, because this is where a mistake is free and can even be fun to see.
Live points
The five points with a sensing device on the drawing are buttons — press one to flag its live-value chip in the statusbar and light the annotation it feeds. On a narrow window the list fills out with the rest of the drawing's values — the reading copy for where the drawing's own text runs too small.
Saturated — the mixture is fogging, so the MAT reading is warmer than the plain outdoor-air blend.
Controls
Forcing a sensor is what a stuck or mis-scaled input does in the field: the program keeps sequencing on the number it is handed while the machine does something else entirely. The forced device gets a dashed ring on the drawing, because a forced input that leaves no mark is how a wrong number survives a shift change. Release it and the program sees the machine again.
The NULL boxes above are the other half of that lesson. Un-check one and your hand lands in slot 8 (Manual Operator), which outranks the sequence writing at slot 16 — the point stops following the program until you write NULL back. Walking away without releasing that slot is how most priority-array trouble starts in the field: months later the point reads "broken" while the sequence writes correctly underneath the stale hand value. And note the two mechanisms are different things — the sensor override forces an input, so the program sequences on a wrong number; a slot-8 write commands an output, so the program keeps computing and simply loses the arbitration. Work the full sixteen slots in the BACnet Priority Array tool, or start from the priority array in BACnet Basics.
Directional only. The coil effects are rough sensible and latent splits for a nominal five-ton, two-thousand-CFM air handler, the damper is linear in its commanded position (real damper flow is not), and the fault presets zero a coil's work outright to make the tell obvious. A real no-cooling call has more than one cause; the graphic shows you where to look, not what to fix. Nothing here replaces the manufacturer's data or the unit's own safeties.
On this screen the wiresheet is a read-through — the live sheet wires with a pointer at desktop width, and the Unit tab stays fully interactive.
The program driving the unit. The sensed points and the setpoints they run against are on the left, the logic is in the middle, and the outputs are on the right: the damper, the hot-water valve, the two compressor stages and the fan. A few constants and the airflow proof switch sit further in, beside the blocks that read them, because a wire that runs the width of a sheet is a wire nobody can follow. It runs on the unit every tick, and the sequence's setpoints and limits are wells in the parameter rail beside the drawing.
Read the economizer permit first, because it is two conditions and not one. A fixed high limit asks whether the outdoor air is cool enough to be worth using at all; a differential comparison asks whether it is cooler than the air already coming back from the building. Either one alone gets a unit into trouble — a fixed limit on its own will open the dampers on a mild humid morning when the return is cooler still, and a differential on its own will open them at ninety degrees just because the building is hotter. Both have to agree before the damper leaves its minimum position.
The minimum position is the other half of that block. When the economizer is not permitted the damper does not go shut — it goes to the ventilation minimum, because the building still needs outdoor air. That is what the select block below the permit is doing, and deleting it is a fault worth trying: the damper drops to zero, the unit stops ventilating, and absolutely nothing on the graphic goes red.
Airflow proof gates both coils, and the ordering is the field's. A discharge sensor sitting in still air reads the room, not the coil — so a low limit behind no proof does not merely fail to trip, it goes blind, reporting a comfortable number while the coil behind it could be anything at all. Break the belt from the scenario row and watch it: the fan command stays on, the blades stop, the chevrons freeze, and the DAT chip climbs to the zone temperature. What is deliberately NOT gated is the fan itself — gate a fan on the proof its own airflow produces and nothing could ever start. Command, status and proof are three different claims, and Status & Proof works through the difference. On a real job you rarely get all three — status is usually the only claim on the screen, so the work becomes deciding whether to believe it. That is what the ΔT well beside the discharge reading is for: a fan reporting ON with no split across a loaded coil is a status that is lying, and the temperatures are what catch it.
The heating valve is a proportional loop, not a stage: the error between the heating setpoint and the space runs through a gain and a limit block, so the valve sits wherever it has to sit to hold the space rather than banging open and shut. Watch the authority, with every NULL box checked so the program is in control: driving the outdoor-air slider down opens the valve further to hold the space, and far enough down is where it reaches a hundred percent and the room starts falling anyway. The scenario buttons will not show you this — each one puts its hand on all six outputs, so the valve holds wherever the scenario put it until you write NULL back.
The low-limits sample splices two winter protections into the same sequence, in series and in different styles: a mixed-air low limit that modulates, and a discharge low-limit stat that trips. The PID watches the mixed-air well against the Min MAT constant — warm mixed air parks its output high, and as the mixing box drags down toward the constant the output winds down with it. The MIN block after the economizer select then takes whichever is less: the position the economizer wants, or the most the low limit will allow. Drive it: outdoor air cold, cooling setpoint pulled below the space — drag it down in the rail — so the economizer opens hard, and the damper command settles well short of open while the MAT chip rides the constant. Colder still and the clamp passes below the ventilation minimum, because the MIN sits downstream of the minimum-position select on purpose. When freeze protection and ventilation argue, this sequence has already picked freeze protection — a real sequence writes that trade down, because someone will eventually ask where the minimum went.
The stat is the backstop, and its constant is set the way the field sets the hardware it mirrors. A real low-limit stat is a manual-reset device strapped across the coil face, and the software comparator here carries the same setting the physical device would: below the coldest discharge the machine can legitimately make, above the temperature that bursts a coil. Set it higher and it becomes a nuisance — this unit's two compressor stages pull the discharge to the mid thirties against a clamped-cold mixed air, which is ordinary integrated economizing, not a fault. Field stats commonly sit anywhere from the mid thirties to forty; where in that band to put one is a judgement about the machine it protects, and the constant is on the sheet to be argued with.
A trip is the classic freezestat response, all at once: damper driven shut, hot-water valve driven open — water moving through the coil is the protection when nothing else is — and the fan stopped, with the compressor stages falling out on the airflow-proof interlock they already answer to. Then the trap this page keeps circling: the moment the fan stops, the discharge probe reads the room. Watch the DAT chip after a trip — it climbs to a perfectly comfortable number while the machine sits dead, which is exactly why the trip is held by a latch and not by the comparison alone. An unlatched stat would clear itself on its own blindness and bang the fan straight back on. The LLS Reset source is the reset button on the device: click it true and back once the cause is fixed and the machine restarts in order — fan first, proof made, then the loads. Hold it true instead and you have wired the button down: the latch is defeated, and the unit short-cycles on and off exactly as fast as each trip can clear itself.
The cleanest way to see all of it is one lie. Open the wiresheet before you start — its first open loads the sheet into the editor the way a download loads a controller, and a download hands a software latch back cleared. Then, on the Unit tab, force the DAT sensor low — the picker option already names what watches it — and the stat takes the machine down the same tick. Now release the force, and nothing restarts: the discharge reads the still-air room number, the set side of the latch is long clear, and the machine stays down waiting for the button. A software stat trusts its sensor with no questions asked, and that cuts both ways — the hardware device it mirrors would never trip on a bad transmitter, and would never miss a freeze the transmitter failed to report. Running both, set to the same number, is not redundancy for show; it is two different failure stories covering each other.
Desktop tool
Wiring blocks on a wiresheet is drag work that wants a pointer and a wide canvas — open this page on a laptop or desktop to edit the control program. The Unit tab reads fine on a phone, and the program keeps running the unit whether or not this sheet is on screen.