What does a Tier IV BMS estate actually look like?

Tier IV is fault-tolerant — every active component is concurrently maintainable and the facility can withstand any single failure without dropping the IT load. The BMS estate that runs it has to meet the same standard: no single controller, network or operator-console failure can blind the facility.

What that means in practice

• 2N controller redundancy on every plant scope, with automatic supervisor failover.
• Dual-path BACnet/IP networks, physically segregated, on separate UPS-fed switching.
• Two operator workstations on independent paths, hot-failover for alarm queues.
• EPMS-to-BMS integration that survives the loss of either side.
• Documented and witnessed concurrent-maintenance drills as part of commissioning.

Where this most often goes wrong

The 2N is delivered in hardware and then defeated in software — both controllers running off the same scheduler instance, or both supervisors reading from one historian. The convergence audit catches this; the standalone BMS commissioning sign-off often does not.