Operational reliability

Are there additional monitoring systems for critical rooms?

Yes. Critical rooms can be equipped with their own monitoring and alarm systems.

Standard integrable monitoring systems

Server room climate control, cold storage, and -80 °C monitoring are standard integrable technologies, featuring dedicated alarms and, if desired, redundant measurement.

Reported before damage occurs

The goal is always the same: a problem is reported before any damage occurs — to servers, samples, or stock.

Can a retrofit be carried out while the building remains in use?

Yes. Many retrofit projects are carried out in buildings that must remain operational. The approach is therefore tailored to the building’s operations and critical technical functions.

Phased implementation

The work is divided in advance into manageable phases, for example per floor, zone, technical installation, or building wing.

Limited interruption

Switchovers are planned for times when disruption is minimized. Where necessary, the existing and new systems continue to function side-by-side temporarily.

Coordination with involved parties

Fixsus coordinates the phasing with the client, operator, installers, and other technical partners. This ensures it is clear in advance when certain installations will be temporarily unavailable and what measures are required to maintain business operations.

Project-specific feasibility

The precise approach depends on the existing installation, the criticality of the technologies involved, and the use of the building. Critical applications generally require more rigorous preparation and potentially additional temporary facilities.

Can I see what happened with an alarm after the fact?

Yes. TIBA3 tracks alarms, notifications, and interventions, so that the full history can be consulted afterwards.

Alarm history

For each notification, the following can be verified:

• when the alarm occurred;
• when it was acknowledged;
• how long it remained active;
• when the normal state was restored;
• which installation or room was involved.

Intervention log

Performed interventions can be recorded in a logbook. This ensures visibility of who intervened, which action was performed, and what the identified cause or solution was.

Analysis of recurring problems

By combining alarm history with trend data, it is possible to investigate what happened before, during, and after a malfunction. This helps to identify recurring errors, deviating settings, or wear and tear more quickly.

Traceable follow-up

The history supports structured collaboration between the building manager, technical department, Fixsus, and external maintenance parties. Everyone has access to the same information regarding the notification and its follow-up.

Reporting

The recorded data can be used for maintenance reports, evaluations of response times, and the monitoring of technical operational reliability.

Can TIBA3 function locally without an internet connection?

Yes. The essential control and operation of the building systems continue to function locally if the internet connection is lost.

What continues to work locally

The central logic runs on the unit within the building itself. As a result, heating, cooling, ventilation, lighting, sun blinds, and other linked systems remain active.

Local visualization and operation also remain available within the building, as does local alarming.

What is temporarily unavailable

Functions that by definition require an external connection may be temporarily unavailable. This includes, among others:

• remote access and support;
• email and SMS notifications;
• weather forecast data;
• external reporting or integrations;
• certain server-dependent historical functions.

Autonomous building control

The basic control of the building is therefore not dependent on an external cloud connection. As soon as the connection is restored, the external services become available again.

Does TIBA3 comply with NIS2?

TIBA3 includes various technical security measures that align with the principles of NIS2.

Technical security measures

These include, among others:

• access management;
• multi-factor authentication;
• encrypted communication;
• certificate verification;
• secure remote access;
• backups;
• controlled change management;
• security testing and periodic evaluations.

NIS2 goes beyond technology

Full NIS2 compliance does not only relate to a single software platform or security layer. The directive also sets requirements for the entire organization, including:

• risk management;
• incident response;
• business continuity;
• supplier and supply chain security;
• management responsibilities;
• training and awareness;
• documentation and evidence.

The role of Fixsus

Fixsus proactively invests in security and further aligns TIBA3 and its own operations with the principles and requirements of NIS2.

Project- and organization-specific assessment

Whether an organization or project fully complies with NIS2 must always be assessed based on the complete technical and organizational context.

TIBA3 can be an important technical component in this regard, but it does not in itself guarantee full NIS2 compliance for the client organization.

How am I notified in the event of a malfunction or alarm?

TIBA3 makes malfunctions and deviations immediately visible in the visualization and can automatically forward notifications to the appropriate personnel.

Alarms in the visualization

Active alarms appear centrally in the interface. The information displayed may include:

• which installation or room is involved;
• when the alarm occurred;
• how urgent the notification is;
• whether the alarm is still active or has already been acknowledged;
• what additional technical information is available.

Notifications via email and SMS

Alarms can be sent automatically via email. Within the designated Total Care packages, critical notifications can also be forwarded via SMS.

Priorities per alarm type

Not every notification has the same urgency. Alarms can be categorized by priority, ensuring a critical technical malfunction is clearly distinguished from a warning or informative message.

Targeted distribution

Recipients can be determined per alarm type. For example, technical malfunctions can be sent to the maintenance department, while other notifications are directed to a facility manager or external service partner.

Fewer unnecessary notifications

Alarming is configured on a project-specific basis. Thresholds, delays, and priorities help prevent users from being overwhelmed by brief or irrelevant notifications.

How are security updates and vulnerabilities managed?

Fixsus uses a controlled process to manage security updates, technical changes, and identified vulnerabilities.

Separated environments

Development, testing, and production environments are separated where applicable. Consequently, new functionality and security patches are verified before being applied to an operational installation.

Updates for TIBA3

For TIBA3 installations from January 1, 2025, automatic updates and security-focused updates are available within the Total Care+ service package.

Security testing

TIBA Secure is periodically subjected to penetration testing. During these tests, security specialists investigate whether vulnerabilities are present in the security layer and the associated infrastructure.

Follow-up on points for improvement

Identified points for improvement are assessed and, where necessary, incorporated into technical adjustments, updates, or additional security measures.

Aligned with business operations

The method and timing of updates are aligned with the criticality and availability requirements of the building. This prevents an update from affecting the operation of an active installation in an uncontrolled manner.

How are TIBA3 backups and recovery managed?

Backups of critical TIBA3 settings and configuration data are performed periodically, ensuring the installation can be quickly restored following a technical issue or hardware failure.

Monthly backup

Within Fixsus service plans, a monthly backup is made of the installation’s settings and autotuning data.

Recovery after a failure

When a central component or other hardware needs to be replaced, the available backup data can be used to restart the installation in the correct configuration.

Additional project data

In addition to settings and autotuning data, programming, visualization, schematics, and other technical project documentation are also managed. The specific components included in the automatic backup depend on the project architecture and the service agreements in place.

Tested recovery procedures

A backup is only valuable when the data can be effectively restored. Therefore, recovery procedures must be verified and, where necessary, tested.

Business continuity

For critical applications, the backup strategy can be supplemented with redundant infrastructure, a spare pool, and project-specific agreements regarding recovery times.

How does Fixsus minimize disruption and downtime during a renovation project?

Fixsus plans retrofit projects so that the building can remain in use as much as possible and technical installations only need to be taken out of service for a limited time.

Preparation prior to execution

Before work begins, the existing installation, cabling, signals, control loops, and dependencies are mapped out. This allows a large part of the new programming and technical preparation to be completed in advance.

Working by zone or installation

Execution can be split by floor, wing, room, or technical installation. This ensures that the majority of the building remains operational while a limited zone is being converted.

Short switchover periods

New control cabinets, I/O modules, and programming are pre-assembled and tested wherever possible. Consequently, the actual switchover on-site can take place within a controlled and pre-agreed time window.

Retention of usable components

Existing cabling, field devices, and installations are reused where technically justified. This limits demolition work, new cable routes, and the impact on users.

Coordination with building management

Work is planned around occupancy, critical processes, and operating hours. In healthcare facilities, offices, or public buildings, for example, work can be carried out outside peak times, per department, or during scheduled closures.

Temporary solutions where necessary

When an installation cannot be out of service for long periods, temporary controls, manual operating modes, or a phased transition between old and new can be provided.

Testing before final commissioning

Each phase is verified before the next one begins. This ensures that malfunctions are identified quickly and the impact of any problems remains limited to a specific section.

How does Fixsus support its customers after completion?

After completion, Fixsus ensures that the customer, technical managers, and daily users are able to operate the installation.

Training and handover

Users receive explanations regarding visualization, settings, alarms, schedules, and daily operation. Depending on their role, the training can be further deepened practically or technically.

Technical follow-up

Fixsus can further monitor the installation through a service agreement. Depending on the chosen formula, this includes remote support, preventive checks, interventions, backup management, software adjustments, reporting, and further optimization.

Adjustments during operation

The installation can also be adapted when the building changes. This includes modified operating hours, a new room layout, additional technologies, or other comfort and energy objectives.

Long-term partnership

Support does not end at technical completion. The goal is to keep the installation reliable, understandable, and high-performing throughout its entire lifespan.

How fast is TIBA3?

TIBA3 is designed to process large numbers of signals and control processes quickly, ensuring that building systems respond almost instantaneously.

Fast central processing

The industrial PLC continuously processes data from sensors, controls, meters, installations, and linked systems. This allows changes to be detected quickly and converted into a control action.

Immediate response within the building

In practice, this means, for example, that lighting responds immediately to the press of a button and that changes in sensor measurements are quickly incorporated into the control of heating, cooling, and ventilation.

Speed and stability

It is not only the raw processing speed that is important. TIBA3 is programmed so that various control processes continue to function simultaneously and stably, without any noticeable delay in operation or visualization.

Depending on the application

The final response time is also influenced by the communication protocol used, the field components, the network architecture, and the nature of the linked technology.

How is access to TIBA3 secured?

Access to TIBA3 is restricted to authorized users and takes place via the secure TIBA Secure environment.

Individual user accounts

Each user works with a personal account. This allows access to be granted, modified, or revoked individually.

Roles and permissions

Users only receive access to the functions that match their role. For example, a receptionist can operate certain rooms, while a technical administrator can also modify settings and control parameters.

Two-factor authentication

In addition to a password, a second verification factor can be used. As a result, an intercepted or stolen password is not sufficient to gain access.

Certificate verification

Devices and connections are verified using digital certificates. Only trusted systems can connect to the secure environment.

Secure remote access

Access by Fixsus or another authorized technical party also takes place via the same controlled channel. Remote interventions can be recorded in the intervention log.

Traceability

Through individual accounts and permission profiles, it remains visible who has access and which actions are performed within the system.

How is the installation protected against power failure?

The central control system can be connected to a UPS.

Bridging and clean restarting

The UPS allows the PLC and communication to bridge a power interruption, after which everything restarts cleanly.

Monitoring of critical processes

Critical processes such as server rooms and cold storage facilities receive monitoring that also reports power incidents. This ensures that an interruption does not go unnoticed.

How quickly can a defect be repaired?

Many malfunctions are diagnosed and resolved remotely, without the need for a site visit.

Remote diagnosis

Through secure remote access and fine-grained measurement data, the cause is often identified before anyone arrives on-site.

Hardware quickly replaced

Regarding hardware defects: components do not contain project-specific logic and can therefore be replaced without a programmer. The spare pool ensures that replacement parts are available.

How quickly can Fixsus respond to a problem?

Thanks to secure remote access, a technician can immediately investigate and, in most cases, intervene remotely.

Remote first

Within Total Care Standard and Total Care +, urgent problems are diagnosed remotely and resolved immediately where possible, without the need for a site visit.

On-site when necessary

For problems requiring on-site intervention, urgent on-site visits are included in Total Care +.

How quickly is a malfunction detected?

Immediately: the installation monitors itself and reports deviations instantly.

Multi-channel alerting

Deviations appear in the interface and are reported via email; with a Total Care Standard or + contract, they are also sent via SMS.

Fixsus monitors along with you

With a service contract (Standard or Total Care +), Fixsus also monitors the notifications directly, ensuring that a malfunction does not go unresolved until someone happens to notice it.

How reliable is Fixsus as a partner?

The continuity of your partner also contributes to the operational reliability of your installation.

Healthy figures

Fixsus has a Graydon score of 93, a risk score of 99 (very low risk), and 16 years of steady growth.

Even in an extreme scenario

And even if you ever wish to change partners, your installation remains open and transferable: code, hardware, and tools are freely available. You are therefore never held hostage by your supplier.

How reliable is the hardware itself?

It concerns industrial automation components from Beckhoff, built for continuous operation in production environments.

Industrial standards

Production environments place heavier demands than a building. The components are designed for that level of reliability and have proven themselves in the industry for decades.

Spare parts remain available

The long-term availability — with a horizon of 25 years — further guarantees that spare parts remain available throughout the entire lifespan of the installation.

Is the hardware suitable for demanding or critical environments?

Yes — these are industrial automation components that also operate in production environments.

Industrial as a starting point

The components are built for continuous operation in industrial conditions — a more demanding regime than what a building typically requires.

Options for critical applications

For critical applications such as server rooms, cold storage, -80 °C monitoring, or healthcare environments, monitoring and redundancy options are available, ensuring that issues are reported before damage occurs.

Is TIBA3 a cloud system?

No — and that is a deliberate choice for operational reliability.

Intelligence runs locally

The intelligence runs locally on the PLC within the building. Consequently, the building’s core operations are never dependent on an internet connection or an external cloud.

The server as a supplement

The server environment provides supplementary services — notifications, backup, history, weather data — but is not required for core operations. If the connection is lost, the building continues to be managed as usual.

Is TIBA3 continuously monitored for security incidents?

TIBA3 monitors the technical operation of the installation and records alarms, deviations, and interventions. The precise cybersecurity monitoring depends on the project architecture and the chosen service level.

Technical monitoring

The installation continuously monitors the status of connected technologies, components, and communication links. Deviations are displayed in the visualization and can be forwarded as alarms.

Incident registration

Notifications and interventions are recorded, allowing for retrospective analysis of what occurred, when the incident arose, and what action was taken.

Additional security checks

In addition to technical monitoring, vulnerability scans, security tests, and periodic penetration tests can be performed on the security layer and the associated infrastructure.

Depending on the service level

Not every installation is permanently monitored by an external security team or Security Operations Center. Additional cybersecurity monitoring is tailored to the risks of the project, the IT environment, and the chosen service formula.

Response to deviations

When a deviation or suspicious behavior is detected, Fixsus can investigate the situation, intervene remotely, or advise on additional measures.

Is TIBA3 updated automatically and how are updates managed?

TIBA3 can be maintained and updated throughout the entire lifespan of the installation. The method by which this occurs depends on the age of the installation and the chosen service package.

Updates without mandatory platform replacement

An update does not automatically mean that the entire installation, PLC, or visualization must be replaced. Fixsus can perform targeted updates on individual software components, security elements, or functions.

Available within Total Care

For TIBA3 installations delivered from January 1, 2025, automatic updates and updates within the framework of the NIS2 directive are available under the Total Care+ package.

Controlled execution

Updates are not simply applied to an operational building without control. Fixsus first assesses:

• the relevance to the installation;
• compatibility with existing programming;
• the potential impact on linked technologies;
• the appropriate time for execution;
• the necessity of a backup or restore point.

Security updates

Security updates may relate to remote access, operating software, certificates, user management, and other components of the technical infrastructure.

Continuity remains a priority

When performing updates, the operational reliability of the building is central. Where necessary, updates are scheduled outside of critical usage times, and operation is verified after execution.

No automatic functional changes

Control strategies or settings are not modified in terms of content without consultation. Functional optimizations only take place after analysis and coordination with the client.

What does ‘all intelligence in one place’ mean?

With TIBA3, project-specific control intelligence is centrally housed on a single industrial PLC. The field devices and I/O islands execute their commands but do not contain any distributed project-specific logic themselves.

One central control environment

All control strategies for HVAC, lighting, sun protection, and energy management, among others, are managed from the same central environment. This makes it immediately clear where the building’s operation is determined.

Simpler diagnostics

Technicians do not have to search through different controllers, software packages, and configuration tools. Signals, settings, and controls can be checked and tested from one central structure.

Easily replaceable components

Because the project-specific intelligence is not located locally in each field device, many components can be replaced without the need to reprogram the entire control strategy.

Better collaboration between technologies

The central intelligence uses data from different installations simultaneously. For example, occupancy can control both lighting and ventilation, while room measurements determine heat and cooling production.

This architecture makes the installation clearer, easier to maintain, and simpler to expand.

What does NOT work without a server connection?

The core operation of the building runs entirely locally; only a limited number of additional services require a server connection.

What will be temporarily unavailable

• email and SMS notifications;
• the monthly backup of settings and autotuning data;
• access to historical data;
• free-cooling optimization based on the weather forecast.

Remote access also requires a connection

Without a network connection, remote access and remote support will also be unavailable. The control, operation, and alarming within the building itself will continue to function normally.

What does TIBA3 run on?

TIBA3 runs locally on an industrial Beckhoff PLC within the building itself.

Local central unit

The project-specific control logic is executed on the building’s central unit. As a result, basic operation is not dependent on an external cloud environment or a permanent internet connection.

Central functions

This central environment manages, among other things:

• control strategies;
• communication with building systems;
• local visualization;
• technical alarms;
• settings and operating parameters.

Autonomous operation

In the event of an internet connection failure, local control, operation, and vital building functions continue to function. Only services requiring an external connection, such as remote access, external notifications, or certain online data sources, may be temporarily unavailable.

Industrial technology

The Beckhoff PLC is developed for continuous automation applications and forms the technological foundation upon which Fixsus builds the TIBA3 programming, visualization, and integrations.

What exactly does Total Care entail?

Total Care is the service package through which Fixsus continues to provide technical monitoring for an installation even after completion.

Three service packages

Fixsus offers three packages:

• Total Care + for maximum peace of mind;
• Total Care Standard for extensive monitoring and support;
• Total Care Basic for essential service functions.

What is included in every package

Each package includes, among other things, secure remote access, trending, email notifications for alarms, access to the spare pool, monthly backups, an intervention log, and operational support during maintenance.

Differences between the packages

The packages differ in the level of proactive monitoring, interventions, reporting, updates, warranties, and support.

In addition to Basic, Total Care Standard includes urgent remote interventions, monitoring of trends and notifications, SMS notifications, support for daily operations, proposals for adjustments, and reporting.

Total Care + adds features such as automatic and security-oriented updates, urgent on-site interventions, extended software and hardware warranties, summer and winter start-ups, and periodic checks of comfort objectives.

Tailored to the organization

The appropriate package depends on the project size, the criticality of the installation, and the extent to which the client has their own technical organization.

A service contract is not a technical obligation, but a choice for peace of mind, continuity, and proactive monitoring.

What happens if a component fails?

Components are interchangeable without a programmer or configuration tool: the intelligence is centralized, so a new module works immediately after replacement.

Replacement without a programmer

Since the islands and field devices do not contain project-specific logic, it is sufficient to replace the defective device with an identical one. After all, the configuration is centralized.

Fast access to spare parts via the spare pool

Customers with a service contract can rely on the Fixsus spare pool: a stock of replacement components that allows a defect to be resolved quickly, without waiting for manufacturer delivery times.

What happens if a field device such as a room controller fails?

Only the affected room is impacted; the rest of the building continues to operate.

Limited impact

A defective field device never affects the operation of the entire building: the central intelligence and other rooms continue to function normally.

Replace and ready

The device is replaced by an identical unit that works immediately — after all, the configuration is stored centrally. No programmer or configuration tool is required.

What happens if a linked external system fails?

The central intelligence continues to operate autonomously: the building’s core control system does not depend on external links.

Autonomous core control

Heating, ventilation, lighting, and other technical systems continue to be managed by the central unit within the building. Therefore, a failed connection never brings the building to a standstill.

Notification and automatic recovery

A failed connection is reported via the alarm system so that it can be followed up. As soon as the connection is restored, the relevant function resumes automatically.

What happens if the central PLC fails?

That depends on the chosen level of redundancy.

With redundant PLC

With cold redundancy, the standby PLC takes over operation. The building remains controlled without intervention.

Without redundant PLC

The field devices revert to their safe state (fail-safe). Thanks to the monthly backup and the spare pool, the central unit can be quickly replaced and restored.

What happens in the event of a cable break in the backbone?

With ring redundancy, communication simply continues via the other side of the ring.

No interruption of operations

The operation of the installation is not interrupted: all islands remain accessible via the other side of the ring.

Breakage is reported

The cable break is reported via the alarm system so that it can be repaired. In the meantime, the building’s systems are unaffected.

What happens to the data in the event of a failure or hardware replacement?

Thanks to the monthly backup of settings and autotuning data, the installation can be quickly restored after a hardware problem.

Rapid recovery after a failure

The backup contains the settings and autotuning data of the installation, ensuring the system functions as before after recovery.

History included in planned replacements

During a planned hardware replacement, the history is transferred along with it. This ensures that no accumulated measurement data is lost.

What is the difference between a classic BMS and TIBA3?

In many classic building management systems, intelligence is distributed across multiple regulators, controllers, and subsystems. Each component contains its own project-specific logic and is often managed using brand-specific software and tools.

Central project-specific logic

With TIBA3, project-specific intelligence is organized centrally as much as possible on a single industrial Beckhoff PLC. Consequently, the I/O islands and field devices in the building do not contain separate project-specific programming.

A single environment for management and diagnostics

Because the logic is centralized, there is one single location where the installation is programmed, managed, tested, and analyzed. This makes the operation clearer and simplifies diagnostics, maintenance, and future adjustments.

Easier to replace components

Field components and I/O modules are less dependent on local configurations or brand-specific software. As a result, defective parts can often be replaced more easily, while the control strategy remains preserved centrally.

Collaboration between technologies

Because all technologies work together within the same central logic, TIBA3 can make decisions based on information from multiple installations simultaneously. For example, occupancy, temperature, air quality, energy consumption, and operating hours can be used collectively to control heating, cooling, ventilation, lighting, and sun protection.

The difference, therefore, lies not only in the visualization but primarily in the architecture: TIBA3 centralizes project-specific intelligence and allows building technologies to work together as a single cohesive unit.

What is the fail-safe behavior of the installation?

Critical functions are assigned a safe resting position that is guaranteed even without control signals.

Safe position per function

Fire dampers close or open according to their safety function, and heating circuits revert to frost protection.

Hardware-based safety chains

Safety chains — frost, smoke, thermostats — are implemented at the hardware level, independent of the software. The essential safety of the building therefore never depends on the control system alone.

What is the spare pool?

The spare pool is a stock of replacement components that Fixsus maintains for its service contract customers.

Rapid replacement in the event of a defect

In the event of a defect, a component is quickly delivered or replaced without waiting for the manufacturer’s delivery times.

Minimal downtime

Since the components do not contain project-specific logic, a replacement part from the spare pool works immediately. This keeps downtime in the event of a defect to a minimum.

Which redundancy levels are available?

There are three redundancy levels, and the desired level is determined per project.

Three levels

• ring redundancy: the EtherCAT bus line forms a ring, so that a single cable break is compensated for;
• ring & cold redundancy: in addition, a second PLC in standby;
• ring & hot redundancy: two PLCs with data synchronization (in development).

Tailored to criticality

For a typical office building, ring redundancy is often sufficient; for critical environments, a redundant PLC can be provided. This assessment is made during the concept phase.