Arcturus only writes setpoints — the BMS is always the local authority that actually runs the building. The failsafe story is different per BMS, because the mechanism that protects against "Arcturus stopped writing and the building got stuck on the last setpoint we sent" lives on the BMS side, not ours.

IWMAC sites — the watchdog handshake

IWMAC has an explicit watchdog mechanism. Each setpoint we are allowed to write is registered as a watchdog tag on IWMAC's side, with a fallback value and a timeout. As long as Arcturus keeps refreshing the tag inside the timeout, IWMAC honours our setpoint. If we stop (network outage, our service down, decommissioning), IWMAC reverts that setpoint to its fallback after the timeout. The fallback is typically the value the BMS was running on before we took over. The handshake is set up once during onboarding via Step 7 of the new-site wizard — see "Connect IWMAC" for the per-site procedure.

Niagara N4 (MQTT) sites — station-side fallback

Niagara does not use the IWMAC-style watchdog. The equivalent protection is configured inside the Niagara station itself: your integrator sets up a station-side rule that reverts a setpoint to a safe value after a defined timeout if our writes stop. The exact mechanism (which driver block, how the timeout is configured) is up to the integrator. From our side, we publish setpoints on a regular cadence so any timeout-based rule has a clean signal to react to.

Sensor-only sites — nothing to fail safe

If the platform is only reading sensor data and not writing setpoints, the failsafe question does not apply — there is nothing the BMS needs to revert. If we stop reading, you simply stop seeing fresh data on the dashboard until we are back.