Preventing AHU Freeze Damage: Economizer Safety Design

Problem Details

A common and expensive failure mode in commercial HVAC: an outdoor air damper (OAD) is left open — commanded, stuck, or manually overridden — while outdoor air temperature drops below freezing. Sub-freezing air migrates through the air handler and duct system to downstream hydronic coils. Water in the coil tubes freezes, expands, and splits the tubes. On thaw, the coils flood the occupied space.

The incident pattern that produced roughly $300,000 in damage in one documented case:

1. Building overheating on a floor served by an AHU with no hydronic coil at the unit; all heating is done by hot-water reheat coils in the VAV / fan-powered boxes.
2. Technician commands the OAD open from the automation system to free-cool. The actuator does not respond.
3. Technician manually strokes the damper open at the linkage, defeating the actuator.
4. Outdoor temperature falls below freezing over an unoccupied weekend. Two VAV reheat coils burst. Restrooms and classrooms on two levels are flooded.

Root Cause Analysis

Note also the possibility of infiltration independent of the AHU: if the building runs at negative pressure and the coils sit close to the exterior envelope, cold air can reach the coil even with fans off. That is why the terminal-unit valve fail-open strategy matters as much as the fan shutdown.

Freeze Protection Design

1. Hard-wired freezestat

Install an averaging-element capillary freezestat on the downstream face of the coldest coil, or in the mixed-air plenum on units without a preheat coil. Serpentine the capillary across the coil face and secure it with clips at regular intervals so the element sees the coldest tube, not just the average.

• Wire the normally-closed contact in series with the fan safety circuit — not as a BAS input only. On trip, the supply fan and return fan drop out and the OAD spring-returns closed.
• Use a manual-reset device. Auto-reset units cycle the fan across the setpoint and mask the fault.
• Bring a second contact (or an auxiliary relay from the safety circuit) into the DDC controller as a digital input so the BAS can annunciate the trip, not just observe the fan is off.
• Verify the trip setpoint against the manufacturer's data sheet and the coil fluid: for a pure-water coil, a low setpoint chosen well above 32 °F gives margin for sensor tolerance and coil-face stratification.

2. Spring-return outdoor air damper actuators

Specify spring-return-to-closed actuators on every outdoor air damper on a system with a water coil anywhere downstream. On power loss, on freezestat trip, on controller failure, and on loss of the control signal, the damper closes without any software decision.

3. Terminal unit valve fail-safe

Program VAV and fan-powered box controllers so the hot-water valve drives fully open on any of:

• Loss of communication with the supervisory controller for a defined timeout
• Space temperature below a hard low limit
• Global freeze-protect command broadcast from the AHU controller or supervisor
• Loss of the discharge or space sensor (open/short)

Physically, that means normally-open valve bodies or spring-return actuators on the reheat coils. Flowing water is dramatically harder to freeze than stagnant water; open valves also let the hot-water pump deliver heat to the coil.

4. Global freeze-protect sequence in the AHU controller

Write the low-limit routine at a control priority above normal scheduling and above operator overrides, so a temporary override cannot suppress it.

// Pseudocode - AHU freeze protection, evaluate every scan
FreezeAlarm := (MAT < MAT_LowLimit) OR (DAT < DAT_LowLimit)
              OR (FreezestatDI = TRIPPED)
              OR (OAT < OAT_Lockout AND OAD_Feedback > MinPos + Deadband
                  AND SupplyFanStatus = OFF)

IF FreezeAlarm THEN
    OAD_Cmd        := 0%          @ Priority 2   // above operator override
    SupplyFan_Cmd  := OFF         @ Priority 2
    ReturnFan_Cmd  := OFF         @ Priority 2
    HW_Valve_Cmd   := 100%        @ Priority 2   // AHU coil, if present
    HW_Pump_Cmd    := ON          @ Priority 2
    Broadcast(GlobalFreezeProtect := TRUE)       // to all VAV/FPB controllers
    Alarm("AHU-1 FREEZE PROTECTION TRIP", CLASS := CRITICAL, ACK := REQUIRED)
END_IF

// Latch until manual reset from the workstation or a local reset
// Do NOT auto-clear on temperature recovery

5. Economizer lockout and enable logic

Do not let the economizer sequence itself become the freeze source:

• Lock out economizing entirely below a low-OAT threshold; hold the damper at the minimum ventilation position.
• Modulate mixed-air temperature to a low-limit setpoint by closing the OAD, so the economizer PID cannot drive the mixed-air temperature down without limit.
• Drive the OAD to minimum position — or fully closed on unoccupied — whenever the supply fan is off, with a proving interlock on fan status, not on fan command.

6. Position feedback and deviation alarm

Add an end switch or analog position feedback to the OAD actuator. Alarm when commanded position and feedback differ by more than a set deadband for longer than the actuator stroke time plus a margin. This is the single change that would have caught the original problem before anyone touched the linkage: the tech commanded open, nothing moved, and the system had no way to say so.

7. Envelope isolation dampers

On buildings in cold climates, use a two-position isolation damper at the building envelope in addition to the modulating economizer damper at the AHU. The envelope damper closes on unoccupied and on freeze trip and provides a second seal that a manual override at the AHU cannot defeat.

8. Alarm routing

Freeze protection is worthless if the trip is logged and nobody reads it. Configure the BAS to escalate low-temperature and freeze-trip alarms as critical events to an on-call recipient by SMS/email/paging, with acknowledgement required and escalation to a second contact on timeout. Add a nightly low space-temperature sweep across terminal units — a room drifting below its unoccupied setpoint is the earliest warning of a stuck damper.

Cold-Weather Operating Procedure

1. Never manually stroke a damper and leave it. If an actuator does not respond, either restore it to fail-safe position and tag it out, or leave it manually positioned only while you are physically present and remain until it is reinstated.
2. Diagnose the actuator instead. Check the 24 VAC supply at the actuator, the control signal at the terminals, the actuator's manual-release lever or clutch button (many float actuators disengage when the release is left pressed), the linkage set screws, and the damper blade for ice or debris.
3. Log every override. Any point overridden in the BAS gets a note with the reason, the tech, and an expiry. Run an override report before every weekend and every cold-weather event.
4. Run a cold-weather checklist before a forecast freeze: verify OAD closure, freezestat continuity, hot-water pump operation, hot-water supply temperature and reset schedule, glycol concentration where applicable, and that no terminal unit is reading an abnormally low space temperature.
5. Treat an overheating complaint as a control fault first. On a system where all heating is at the terminal boxes, a hot floor usually means stuck-open reheat valves, a failed VAV controller, a bad space sensor, or an unnecessary hot-water reset — not a lack of outdoor air. Chasing it with the economizer in winter is the higher-risk path.

Commissioning and Verification

Professional Handling of the Failure

Two things are true at once: manually overriding a damper and leaving it open going into a freeze was an error, and a building whose reheat coils can be destroyed by a single open damper had no functioning freeze protection. Both need to appear in the corrective action.

• Report it immediately and in writing with a factual timeline. Self-reporting is what preserves credibility.
• Separate the trigger from the root cause in the report. "Damper left open" is the trigger. "No freezestat interlock, no damper position feedback, no terminal-unit fail-open, no off-hours alarm routing" is the root cause, and it is the part that prevents a repeat.
• Submit the freeze-protection scope as a concrete remediation proposal, not as a defense.
• Expect the loss to be handled through property insurance. Your contribution is preventing the second occurrence.

FAQ