Building management systems in hotels: from the plant room to the guest room

A hotel building management system (BMS) is the supervisory layer that watches and steers the building's plant: boilers, chillers, pumps, air handling units, tanks and meters. It reads sensors, runs schedules and raises alarms. It does not replace the guest room controls or the property management system, though it exchanges data with both.

The chiller trips at 03:00 on a full house. The alarm reaches a screen in the plant room, and the plant room is locked. Whether anyone acts before breakfast was decided months earlier, in a service contract and an alarm routing table that nobody read at the time. After reading this page you will be able to tell the layers apart, judge whether a proposed system is open or closed, and know which two documents to demand before the last payment.

What is a hotel building management system?#

A hotel BMS is the supervisory layer over the building's plant: it reads sensors, holds schedules and setpoints, and raises alarms. It sits above the individual controllers rather than replacing them.

Four parts make the system. Sensors and meters measure temperature, pressure, flow, level and electricity. Controllers are small computers that each hold the logic for one item of plant. A network joins them. A head end is the screen and database where a person sees and changes things.

Its job is to keep the plant inside its design envelope, catch faults before a guest notices them, and give one place to see the whole building instead of a wall of separate panels. It is not a room controller, not a property management system, not an energy accounting system and not a fire detection system. Fire detection is a separate certified system, and a BMS may at most receive a signal from it.

The unit of scale is the point: one point is one value the system can read or write. A small hotel may have a few hundred; a large one with full metering can reach tens of thousands. Monitoring and control carry different risk. Reading a tank level is monitoring; starting a pump is control. Most of the value and most of the damage sit in the second.

The daily users are the technical manager and the shift engineer, and often a maintenance contractor working remotely, which is why access rules matter as much as the hardware.

What does a hotel BMS actually watch?#

It watches the plant that makes the building habitable: heat, cooling, water, air and power, plus the alarms those systems raise.

Heating covers boilers, hot water circuits, return temperatures, burner run hours and the gas meter, so that efficiency is visible as a trend rather than a monthly bill. Cooling covers chillers, cooling towers, condenser water, air handling units and fan coils, plus chilled water differential pressure, which is the value that tells you whether pumps and valves are fighting each other.

Water covers tank levels, booster pumps, hot water storage and, where fitted, zone meters. A level that falls at a steady rate overnight is a leak, not a demand pattern. Air covers supply and return temperatures per air handling unit, filter condition read as differential pressure, and carbon dioxide in dense spaces such as ballrooms and restaurants. Power covers main and sub-meters, generator status and uninterruptible supply status; sub-metering per kitchen or per building is what turns a bill into a diagnosis.

Plant that is often left off the list and should not be: kitchen extract, pool filtration and dosing, spa, laundry and irrigation.

Trend logs matter more than the live screen. A value stored every fifteen minutes is what lets you see the fault that never crossed an alarm limit. Pair the log with a written hotel preventive maintenance plan so that a reading turns into an action.

BMS or guest room management system: which layer does what?#

The BMS runs the plant; the guest room management system (GRMS) runs the room. They meet at one place: occupancy and setpoint.

The GRMS is the room-level layer: a room controller, an occupancy source such as a key card holder or presence sensor, a thermostat, a window contact, lighting scenes and often the curtains. The BMS does not care which guest is in room 412. It cares that the block of rooms on the second floor is empty and that the air handling unit serving them can back off.

The handshake runs both ways. The GRMS reports occupancy so the plant can reduce ventilation and cooling in empty rooms, and the BMS can tell the GRMS that the building is in a demand-limiting mode.

Design out the obvious failure: if the GRMS is the only source of occupancy and it fails, rooms drop to unoccupied mode while guests are inside. Ask what the fallback is and who tests it. Do not let a room thermostat be the only temperature sensor for a public area; the two zones have different loads and different schedules. Savings claims belong to room controls, not to the BMS, and they should be weighed on their own terms, as covered in energy management and room controls: what to check before investing.

Open standards or a closed system: what does the next contractor inherit?#

Open means a second integrator can read and change the system without the first one's permission. That is a contract question as much as a technical one.

BACnet is the common language for building plant; it lets a chiller from one maker and a head end from another exchange values. Modbus is an older, simpler language that many meters, pumps and inverters still speak; it is easy to read and easy to misconfigure. KNX is a European bus standard used mostly for room and lighting control, and it can be bridged to BACnet so the two layers share occupancy and status. DALI covers lighting: dimming, ballasts and lamp status, usually inside the room layer rather than the plant layer.

What open protocols do not cover: the head-end software licence, the engineering tool that edits the controllers, the passwords, and any gateway that translates a proprietary device. A system can be open at the wire and closed at the laptop.

The practical test is to ask, in writing, whether a third party can obtain the engineering tool and the program files, and whether any password is held only by the installer. Also settle ownership of the point list, the as-built drawings and the network addresses, because those three documents are what any future contractor will quote from.

Who reads the alarms at 03:00?#

Someone must, and the contract should name them. An alarm that reaches an inbox nobody opens at night is a log entry, not an alarm.

Classify alarms by consequence, not by source. Critical means plant stopped, a water leak, a freezer failure or a generator failure. Major means degraded. Minor means review tomorrow. Informational means log only. Route by class: critical to a phone call or a duty phone, major to the shift, minor to the daily review. Email alone is not a night-time route.

Use delays and dead bands. A value that crosses a threshold for thirty seconds is not the same event as one that stays there, and without a delay the console floods and people stop reading it. Put the 03:00 question in the service contract: who is called, within what time, what they are authorized to do on site, and what counts as chargeable.

Review the alarm log weekly and count alarms per point; a point that alarms every day is either badly set or a real fault, and both need a decision. Remote access for the contractor must be a named, revocable account with a log, not a shared password that survives staff changes.

What passes between the BMS and the PMS, and what does not?#

Room status and occupancy pass; guest records, billing and plant control do not cross the line.

From the PMS to the BMS: check-in, check-out, room move, out-of-order and out-of-service status, and expected arrivals. The BMS uses these to set a room mode, not to identify a person. From the BMS to the PMS: almost nothing, and that is healthy. The useful exception is a maintenance flag, for example air conditioning out of service in a room, so the front desk stops selling it.

The link is a gateway or a small middleware service, not a cable between two vendors' databases; someone must own it, monitor it and test it after every upgrade on either side. Keep the plant on its own network segment, away from guest Wi-Fi and away from anything that touches payments, as described in hotel network design: separating guests, staff, payments and devices.

What people expect and do not get: the PMS does not start the chiller, and the BMS does not know the rate or the guest's name. Both limits protect you. Decide the failure behaviour in advance: if the link drops, a room must fall back to a safe default, not stay in unoccupied mode indefinitely.

What should the handover file contain before the last payment?#

A BMS is only as good as the file that comes with it. Without the point list, the drawings and the passwords, you own a black box.

The points list records every point with its address, engineering units, normal range and alarm limits, in a format you can open without the vendor's software. As-built drawings and a network diagram with addresses let the next technician find a device without tracing cables. Program files and the engineering tool must come with licences issued in the hotel's name, not the installer's. Passwords are delivered in a sealed handover, plus a written process for changing them when staff or contractors leave.

The service contract should state response times by alarm class, spare parts held, remote access terms, and what happens if the integrator stops trading. Training for at least one named staff member who can change a setpoint and a schedule without calling anyone, and a first-year trend baseline, so next year's comparison means something. That baseline pairs naturally with energy and water per occupied room: daily meter readings a hotel can act on.

Questions to ask before you sign#

How many points? Who owns the software licence? Can a third party service it? What is the alarm routing? What exactly is in the handover? What is the response time at night? Each of these has a written answer before the last payment, or the answer defaults to the installer's goodwill.

What to do next#

Before the next service renewal or the next purchase order, ask for two documents in writing: the points list with its alarm limits, and the alarm routing table with named recipients and response times. Everything in this article follows from those two pages. They show whether the system is open or closed, whether anyone is answerable at 03:00, and whether the file you own is worth anything without the installer.