VEWFD control logic: what each alarm level may operate

Very early warning fire detection has a hardware reputation and a software reality. The hardware — an aspirating detector sampling the air hundreds of times a second through a network of pipes — is mature, listed, and well understood. The control logic wrapped around it usually is not. In the field, the detection chain almost never fails in the direction people fear. It fails in the other direction: it operates when nothing is burning.

The numbers are lopsided. In Uptime Institute's 2017 industry survey, about one third of data center operators reported having experienced an accidental fire suppression discharge, and respondents were three times more likely to have experienced an accidental discharge than an actual fire [9]. Uptime's Abnormal Incident Reports database holds 54 reported incidents involving inert gas suppression systems: 15 were accidental discharges, and their causes split as 27 technician errors, 14 incidents of no or poor maintenance procedures, 9 manufacturing problems, and 4 design or installation omissions [9]. That is 76 percent human and procedural — failures that no amount of detector sensitivity can touch, because the detector was never wrong. When fires and false suppression events are compared on recovery time, the pattern holds from the other side: industry tallies of 53 major fire-related data center outages over ten years put average recovery at 25 hours for real fires and 17 hours for false-alarm suppression incidents [10].

So the design question is not "which detector is most sensitive." It is: what is each alarm level allowed to operate, how is a real fire confirmed before anything irreversible happens, and how many seconds does that confirmation spend of the warning the detector just bought? This article is a control-logic standard for very early warning (VEWFD/ASD) in a data hall — threshold by threshold, interlock by interlock, second by second. It is the execution-layer companion to our VEWFD installation guide, which covers sampling-hole density and pipe transport; and it feeds the same cause-and-effect chain that our clean agent selection guide prices out.

Three layers, three different documents

Fire detection control logic lives on three layers, and the commonest failure is letting one layer's document do another layer's job.

• Layer 1 — the detector's thresholds. An ASD does not have an alarm; it has a ladder of obscuration levels, typically four, each a separate output. This layer produces evidence.
• Layer 2 — the panel's confirmation logic. Alarm verification, positive alarm sequence, cross-zoning, counting zones, releasing panels listed to UL 864 for releasing service [15]. This layer produces a decision, and every feature it adds spends time.
• Layer 3 — the facility cause-and-effect matrix. The document that maps each decision to each physical output: annunciation, containment, HVAC, dampers, pre-action valve, agent release, power. This layer produces actions, most of them irreversible.

Evidence grows monotonically up the ladder. Importance of the outputs does too. The whole discipline of VEWFD control logic is keeping those two orderings aligned — because the tempting shortcut is to wire the scariest output to the first threshold that moves, and that is how a hall full of functioning detectors becomes an outage generator.

Layer 1: four thresholds, one of which may release

Aspirating detectors expose four alarm levels — Alert, Action, Fire 1, Fire 2 — each an independent output with its own threshold. The setting ranges are wide: on a representative product, Alert and Action are adjustable from 0.005 to 2.0 %obs/m, Fire 1 from 0.010 to 2.0 %obs/m, and Fire 2 from 0.020 to 20.0 %obs/m (limited to 12 %obs/m in UL-listed mode), with an event log of up to 20,000 time-stamped entries [11][12]. A reference configuration for a relatively clean IT space, used in Xtralis's own demonstration testing, looks like this [1]:

Level	Threshold	What the smoke physically is	What this level is allowed to do
Alert	0.03 %obs/m	Incipient pyrolysis — insulation heating, particles invisible to the eye	Information only: BMS/DCIM event, SMS, investigation dispatch
Action	0.065 %obs/m	Smoulder growing, still no flame	Information plus low-consequence convenience actions: pages, access unlock, camera preset
Fire 1	0.10 %obs/m	Fire condition imminent or started	Occupant notification, fire brigade signal, pre-discharge alarm — but no release on its own
Fire 2	2.0 %obs/m	Established flaming fire; visible-smoke range of ordinary detectors	The only level wired to suppression release — and then only with a second confirming zone

Two numbers put that ladder in perspective. NFPA 76 expects a very early warning fire detection system to give an alert at 0.2 %obs/ft (about 0.66 %obs/m) and an alarm at 1 %obs/ft (about 3.3 %obs/m) [7] — a reminder that "very early" in the code sense is far above what an ASD can resolve. And the spot detector in the Xtralis test series was set to 1.4 %obs/m in its most sensitive mode with a 5-second verification — the condition under which it still recorded no detection in the room tests, because measured obscuration never got within a factor of 7 of its threshold [1]. The smouldering cable produced levels the ASD resolves 47 times lower.

Thresholds are not constants. They drift with filter loading and ambient dust, which is why the detector's AutoLearn derives them from measured ambient conditions over days — the reference product recommends a minimum learning period of one day, ideally 14, and holds pre-set thresholds fixed while it runs [11][12]. Settings derived from a commissioning-day snapshot go stale exactly as fast as the hall's dust load changes. Treat threshold changes as a change-controlled configuration item, not a service-menu item.

Layer 2: confirmation logic, and what each feature costs in seconds

Layer 2 exists because a single detector input is a hypothesis, and an irreversible output deserves at least two independent votes. The standard toolkit offers four mechanisms, and each one has a price in time or in staffing:

Mechanism	How it works	Cost
Alarm verification (NFPA 72 §23.8.5.4.1)	Panel resets the detector, then waits up to 60 seconds for it to re-alarm; transient particulates clear, sustained smoke re-trips. Smoke detectors only; must be password-protected and recorded on the record of completion [3].	Up to 60 s added to every first alarm. Should be disabled by default and enabled only where nuisance sources are documented.
Positive alarm sequence (NFPA 72 §23.8.1.2.1.1)	Qualified personnel must acknowledge at the panel within 15 s of annunciation; they then get up to 180 s to investigate and reset. No acknowledgement, no reset, a second detector, or any other initiating device → immediate general notification [2].	Up to 195 s. Requires trained staff at the panel, around the clock. In an unmanned hall it degenerates to an immediate alarm — or to nobody ever acknowledging.
Presignal (NFPA 72 §23.8.1.1)	First alarm sounds only in constantly attended locations; general alarm requires human action or a permitted delay over one minute [3].	AHJ approval required; operationally similar to PAS but with weaker structure.
Cross-zoning / counting zone	Releasing output requires two independent detector zones in alarm (2oo2), or two detector addresses on one SLC loop. Releasing panels are listed for releasing service under UL 864 category UOJZ — an ordinary FACP without that listing must not drive a solenoid [15].	No added time when zones confirm in parallel; the second zone may lag the first by the smoke transport time between them.

The sprinkler side adds one more choice that belongs in the same conversation. A pre-action system admits water to the piping on detection alone (single interlock), or on detection and loss of supervisory air pressure (double interlock) [5]. Single interlock converts the pipe to a wet system on one detector alarm — every detector false alarm puts water over the racks. Double interlock needs both signals, which is why it is the data hall default, and why the 60-second water delivery requirement of NFPA 13 becomes a binding constraint: the interlock you chose to avoid an accidental fill is the same interlock that makes the trip test mandatory [5].

What 2oo2 actually buys — and what it cannot touch

Cross-zoning is statistical, so run the arithmetic. If each zone produces λ unwanted alarms per year, and the two must coincide within a confirmation window T, the coincidence rate is approximately λ²·T:

Unwanted alarms per zone-year	Coincidence rate (120 s window)	Expected interval
2 (a well-kept hall)	0.0009 per year	1 in ~1,100 years
12 (dusty fit-out period)	0.033 per year	1 in ~30 years
50 (chronic nuisance environment)	0.57 per year	1 in ~2 years

Random coincidences are effectively eliminated by two-zone logic. The problem is that random detector faults are not what discharges systems. Recall the Uptime breakdown: 76 percent of the 54 reported incidents were technician error or maintenance-procedure failures [9]. Construction dust, hot work, a humidifier fault, a contractor with a smoke machine — these are common-cause events. They hit both zones at once, in perfect correlation, and 2oo2 logic waves them straight through. The interlock that actually addresses the dominant failure mode is not statistical at all. It is a maintenance disable interlock, and it deserves a specification:

• A key-operated test/disable switch at the releasing panel, covered by a written permit naming the zone, the work, and an expiry time.
• A timed auto-restore — the disable expires on its own and returns a supervisory signal, so a forgotten bypass cannot outlive the shift that created it.
• Physical isolation of the release path where work is invasive: solenoid lead disconnected and the disconnection itself supervised as a trouble condition.
• Every disable and restore time-stamped in the same event log the detector keeps — so the quarterly review can reconcile permits against the log.

Layer 3: the cause-and-effect matrix

The C&E matrix is the contract between the fire alarm system and the rest of the building. It is a table — initiating events as rows, outputs as columns — and its cells carry one of three marks: operates, sequenced/conditional, or must not operate. Three rules keep it honest:

Rule 1 — exactly one row may touch the agent column. The cross-zone-confirmed row releases after the pre-discharge countdown; the manual release row bypasses zoning and countdown entirely, because a person who can see the fire should not wait for a panel's arithmetic. No other row reaches that column.

Rule 2 — outputs are ordered by evidence, never by importance. Alert operates nothing physical. Action operates convenience outputs that are cheap to undo: access doors unlock, cameras swing to a preset, a page goes to the on-call engineer. Single-zone Fire 1 starts occupant notification and the pre-discharge alarm — but the containment release, valve, and agent wait for the second zone. If a matrix cell pairs a low-evidence row with a high-consequence column, the matrix is wrong even if the wiring is perfect.

Rule 3 — the overrides are explicit and physical. Manual release outranks its row. The abort switch is dead-man type, mounted inside the protected space at the egress route, delays the countdown only while held, and never resets detection [4]. NFPA 2001 gives the pre-discharge alarm and its delay a specific job — getting people out — and the abort exists to serve the person still inside the room when the countdown starts.

Sequencing traps that are specific to data halls

Generic fire alarm logic misleads in exactly four places in a data center, and all four are ordering mistakes rather than component mistakes.

Do not stop the air before the detector has confirmed. NFPA 90A requires duct smoke detectors to stop their fans automatically on detecting smoke [6], and stopping air movement is the correct response to smoke in an air handling system. But in a hall whose ASD samples return air or duct, airflow is the detection mechanism — the FIA design guidance classifies return-grille sampling as supplementary precisely because it has limited effect when the airflow is off [13]. If your C&E fires HVAC shutdown on the first threshold, you may be switching off the thing you are listening through. The order is: confirm → release containment and agent → stop air, and where the ASD is return-side only, that order is not negotiable. Note also that NFPA 90A does not require return-side duct detection where the entire space is covered by area smoke detection [6] — a mechanical contractor who adds duct detectors to an ASD-protected hall has added a fan-stop trigger with no area-detection backup.

Containment opens on smoke, not heat. NFPA 75 requires that obstruction removal in the protected area be controlled by smoke detection rather than thermal devices, and that all obstructions in the suppression area be removed simultaneously — fusible-link drop-away panels are no longer an acceptable answer in contained aisles [7]. Thermally activated panels need the same fire size that fuses a sprinkler, which is the fire the ASD exists to prevent; and a panel that drops into an egress path is its own violation. The correct output is an electrically released, fail-safe containment actuator driven by the same cross-zone confirmation that starts the countdown — so the aisle is open before the agent arrives, not after.

EPO is a door, not a matrix cell. NEC Article 645 and NFPA 75 require a disconnecting means for all electronic equipment in the IT room — one that also disconnects the battery from the load, because a UPS that loses its input will happily carry the room on batteries while a firefighter assumes the opposite — grouped and identified at the principal exit doors [8]. Nothing in that requirement makes EPO an automatic output of the detection logic. An automatic EPO on a first alarm is a self-inflicted outage with a smoke detector as the trigger, and it also pulls the floor out from under the suppression sequence: verify which supplies the EPO shunt-trips actually drop, and that the releasing panel is not among them.

Purge is a mode, not an afterthought. The CRAH fans that the matrix stops on fire are the same fans the post-discharge procedure needs to clear combustion products and spent agent before re-entry. A matrix that stops fans on release with no defined path back is a matrix that leaves the hall unventilatable. Add an explicit purge mode: manually armed, dampers reopen, fans restart at purge duty, and the fire alarm system supervises the whole time.

The time budget: every second of logic is subtracted from detection

Layer 2 features are usually argued as safety. They are also a withdrawal from an account with a fixed balance. The Xtralis test series gives a measured balance: the ceiling-mounted ASD crossed its Alert threshold in 93 seconds on average (74–122 s across 8 sessions) with a 1 m overheated PVC cable as the source, in the worst-case location for the sampling grid [1]. Against that 93-second head start:

Logic design	Stack	Total to agent in room	Fast t² fire size at discharge
A — ASD, cross-zone, straight release	93 detect + 2 panel + 30 pre-discharge + 10 discharge	135 s	855 kW
B — ASD + 60 s alarm verification	93 + 60 + 2 + 30 + 10	195 s	1,783 kW
C — ASD + positive alarm sequence	93 + 195 + 2 + 30 + 10	330 s	5,107 kW

A fast t² fire (α = 0.0469 kW/s²) crosses 1 MW at 146 seconds. Design A puts agent in the room just under that line. Design B crosses it. Design C is more than 2.3 times past it — and, since a data hall is ventilation-limited well below 5 MW, the honest reading is that the fire has reached the size at which it stops being a cable event and starts being a hall event. Alarm verification spends 65 percent of the measured detection window; PAS spends 210 percent of it.

Transport time belongs in the same budget. EN 54-20 class limits are 60 seconds for Class A, 90 for Class B, and 110 for Class C designs [14], and the FIA guidance urges designers toward much less — ideally under 60 seconds — where very early warning is the point [13]. In the measured 93-second detection time, up to two thirds can be pipe transport. That makes transport time a control-logic parameter, not a plumbing detail: a Class C transport budget silently converts a Class A detector into an ordinary one, before the logic has spent a single second.

The state machine behind the annunciator

Most of what looks like "panel logic" is a small state machine, and it should be written down as one. The states and the transition rules that matter:

• Alert and Action self-restore when obscuration falls back below threshold. They are level signals, not events. If your annunciation treats them as latching alarms, operators learn to clear them, which is how early warnings get normalized into background noise.
• Fire levels latch. Latching is what forces a human to look. Reset requires the smoke level to have fallen below the release threshold for a defined hold time — not merely a reset command from the panel keyboard.
• Pre-discharge is a distinct state, with its own sounder tone different from the fire alarm tone, a visible countdown, and a defined relationship to the abort switch: the abort pauses it, releasing the abort resumes it, and the countdown never silently restarts from zero after an abort cycle without an annunciated reason.
• Discharge latches until manual reset, and post-discharge the matrix shifts state: agent column exhausted, containment held open, HVAC stopped pending purge, access control held in the unlocked state for egress and responder entry.
• Everything is logged to one-second resolution in the same time base. The detector's own event log holds up to 20,000 entries [11][12]; the panel's record and the BMS feed should reconcile against it. A cause-and-effect matrix that cannot be audited from its own logs will be re-litigated after every event, false or real.

Commissioning: prove the logic, not just the devices

A fire alarm acceptance test that only proves each device works has tested the wrong layer. The device-level tests are table stakes; the logic-level tests are the ones that fail in the field:

• Point-to-point output verification. For each initiating row, physically verify each matrix cell: the door unlocks, the damper closes, the valve solenoid sees its voltage, the tone in the room is the pre-discharge tone and not the alarm tone.
• Timed injection tests. Introduce test smoke at the furthest sampling hole and time each stage: transport, Alert, Action, Fire 1, cross-zone confirmation, countdown start, discharge signal. The measured chain should match the design budget from Fig. B, not a spreadsheet's version of it.
• Negative tests. A sub-threshold aerosol must not operate anything. An abort hold must stop the countdown; releasing it must resume it; a second detector must not be needed to resume what the abort paused [4].
• Failure-mode tests. Pull the releasing circuit and confirm a trouble signal, not silence. Drop primary power and confirm the releasing panel rides through on battery. Kill the network path to the BMS and confirm the fire alarm logic runs standalone — fire alarm functions take priority over building automation by design.
• Disable/restore test. Exercise the maintenance interlock end to end: permit, key switch, timed expiry, supervisory signal, log entry.

Then schedule the drift. NFPA 72 requires smoke detector sensitivity testing within one year of installation and every alternate year thereafter, extendable to five years after two consecutive passing results, with nuisance-alarm trends recorded in the meantime [15]. An ASD's thresholds are recomputed by AutoLearn; the logic's assumptions about them should not be. Re-validate the matrix after any threshold change, any sampling-pipe modification, and any change to the contained-aisle geometry — because every one of those moves a cell in the matrix that nobody re-tests.

Ten mistakes that show up in the field

1. Wiring the agent release to Fire 2 alone — discarding the ASD's entire advantage and waiting for a flaming fire the spot detectors would have seen anyway.
2. Enabling 60-second alarm verification facility-wide by default, spending two thirds of the measured detection window to guard against a nuisance source nobody documented.
3. Specifying positive alarm sequence in an unmanned hall, where it either never engages or silently becomes an immediate alarm at night.
4. Treating cross-zoning as false-alarm protection against common-cause events — dust, hot work, humidifier faults — which correlate across zones and pass straight through 2oo2.
5. Stopping HVAC on the first threshold while the ASD samples return air, blinding the detector with the same output meant to fight the fire.
6. Adding NFPA 90A duct detectors to a hall already covered by area ASD, multiplying fan-stop triggers without the area-detection rationale the exemption assumes [6].
7. Heat-releasing containment panels instead of smoke-controlled, simultaneous release — explicitly the arrangement NFPA 75 no longer permits [7].
8. An automatic EPO in the C&E matrix, turning the code-required manual disconnect at the door into a self-inflicted outage on the first alarm [8].
9. No purge mode: fans stop on fire, and no documented path restarts them after discharge.
10. A maintenance bypass with no timer, no permit, and no log entry — the single arrangement that matches the dominant real-world failure mode, technician error during maintenance work [9].

Eight questions for the fire alarm integrator

1. Which threshold releases the agent, and which zone configuration confirms it? Show me the row and the column, not the wiring diagram.
2. What is the measured transport time from the furthest sampling hole, and which EN 54-20 class does the design claim [14]?
3. Which confirmation features are enabled (verification, PAS, presignal), who holds the password, and what staffed position is assumed at the panel at 3 a.m.?
4. Is the releasing panel listed to UL 864 for releasing service, and is the solenoid circuit supervised end to end [15]?
5. Walk me through the matrix rows for a single-zone Fire 1 at 2 a.m.: what operates, what waits, and what annunciate where?
6. What does the maintenance disable interlock look like — key, timer, permit, log — and what happens if nobody restores it?
7. After discharge, how does the hall get ventilated? Which mode restarts the fans, and who may arm it?
8. Can you hand me the timed injection results from the last three acceptance tests, from smoke entry to each output, and reconcile them against the design budget?

The logic is the system

Very early warning is bought with optics and aspirators, but it is kept or thrown away in three places: the threshold ladder, the confirmation logic, and the cause-and-effect matrix. The detector will reliably find a smouldering cable minutes before anything else in the room notices — that part is settled, and measured. Whether those minutes become an investigation or an outage depends on whether the first threshold operates anything at all, whether the release waits for a second independent zone, and whether the seconds spent confirming were subtracted from a budget anyone counted.

Design the ladder so that evidence, not consequence, orders the outputs. Staff the confirmation you specify, or don't specify it. Interlock maintenance work with a timer and a log, because that is where three quarters of the real incidents come from. And time the whole chain end to end — from the sampling hole to the agent nozzle — against a fire-growth line, so that the last thing you discover in acceptance testing is not that the warning you paid for was spent on hold music.

Planning a hall where the detection logic has to survive both an AHJ and a 3 a.m. contractor? Send us your one-line diagram and C&E draft — we will mark up the matrix before it becomes wiring.

References

1. Xtralis, IT/Server Room Fire Tests Demonstration — VESDA and Conventional Detectors: threshold settings Alert 0.03 / Action 0.065 / Fire 1 0.1 / Fire 2 2.0 %obs/m; spot detector at 1.4 %obs/m with 5 s verification; 8-session activation times (ceiling VLP 93 s, 74–122 s); room obscuration peak 0.1–0.2 %obs/m; point detector ND in room tests. xtralis.com (PDF)
2. NFPA 72 §23.8.1.2.1.1, Positive alarm sequence: acknowledge within 15 s, alarm investigation phase up to 180 s, immediate notification on failure, second detector, or any other initiating device. nfpa.org (PDF)
3. NFPA 72 §23.8.5.4.1 (alarm verification, 60 s maximum, password-protected) and §23.8.1.1 (presignal, delay over one minute). iafc.org (PDF)
4. NFPA 2001 pre-discharge alarm and time delay; abort switch §4.3.5.4 — dead-man type, inside the protected area, delays only while held, never resets detection. usmadesupply.com
5. NFPA 13 preaction system types — single interlock (detection only) and double interlock (detection plus loss of supervisory pressure); 60-second water delivery; trip test practice. anvilfield.com
6. NFPA 90A §6.4 — smoke detection for automatic control: duct detectors shall automatically stop their fans (§6.4.3.1); return-side detection not required where the entire space is protected by area smoke detection (§6.4.2.2). meyerfire.com (PDF)
7. NFPA 75 §5.6.10.1 — obstruction removal controlled by smoke detection, all obstructions removed simultaneously (aisle containment); NFPA 76 VEWFD alert 0.2 %obs/ft, alarm 1 %obs/ft. blog.qrfs.com
8. NEC Article 645 / NFPA 75 EPO — disconnecting means for all electronic equipment, battery disconnected from the load, grouped and identified at principal exit doors. Understanding EPO and its Downtime Risks, Schneider Electric White Paper 22. schneider-electric (PDF, mirror)
9. Uptime Institute, Fire Suppression Systems Bring Unexpected Risk: 2017 survey — about one third of operators experienced an accidental discharge, three times more likely than an actual fire; AIRs database — 54 inert gas incidents, 15 accidental discharges, causes 27 technician error / 14 maintenance / 9 manufacturing / 4 design. journal.uptimeinstitute.com
10. TIA, The Importance of Correct Design and Management for Data Center Fire Safety Systems: 53 major fire-related outages in ten years; average recovery 25 h for real fires, 17 h for false-alarm suppression incidents. tiaonline.org
11. VESDA-E VES-A10-P Product Guide: threshold ranges (Alert/Action 0.005–2.0, Fire 1 0.010–2.0, Fire 2 0.020–20.0 %obs/m), four alarm levels, AutoLearn minimum 15 min / max 15 days, 20,000-event log. honeywell.com (PDF)
12. VESDA-E aspirating smoke detection — product specification: sensitivity 0.005–20 %obs/m, four alarm thresholds (two pre-alarms, two alarms), 20,000-event log, relay contacts configurable as latching or non-latching. source.thenbs.com
13. FIA Code of Practice for ASD systems — design guidance: primary (return-air) sampling has limited effect when airflow is off; transport time ideally under 60 s. xtralis.com (PDF)
14. EN 54-20 class transport-time limits — Class A under 60 s, Class B under 90 s, Class C under 110 s; verified in the sampling-pipe design calculation. protec.co.uk (PDF)
15. NFPA 72 §14.4.3.2 — sensitivity testing within 1 year of installation, every alternate year thereafter, extendable to 5 years; releasing service panels listed under UL 864 UOJZ. nfpa.org; lifesafetywiki.com