How to Document a Control Change So the Next Tech Can Undo It

Why this matters

The change that costs a shop the most is not a wrong one. It is a right one that nobody can reverse, six months later, when the season turns and the reason it was made no longer applies. The value is sitting there in the controller, it works, and there is no way to tell whether it is the design intent or somebody's Tuesday afternoon. So it stays, and it accumulates, and eventually a unit is running on a stack of adjustments none of which anyone will touch because none of them can be undone with confidence.

The fix is a record with specific fields, and the ordering matters more than the length: one group of fields can only be captured before you touch anything, and the rest can be filled in from the truck. Everything about reversibility lives in the first group.

Before you change a setting on running equipment

Two things go first, every time.

Know which protective device sits nearest the direction you are moving. A setpoint moved toward a limit, a pressure switch or an interlock consumes the margin between normal operation and that device's trip point. Read the device's stated trip point and write down the margin you are leaving, in the same units as the setpoint. A protective device is the last line, not a test fixture, and moving a setpoint toward it on the assumption that it will catch the excursion is how a control change becomes a safety event.

If the change requires an open enclosure, de-energize the line-voltage supply, lock and tag it, and prove dead before your hands go in, under 29 CFR 1910.333(b)(2), with live-dead-live per NFPA 70E-2021, 120.5. Where a value genuinely has to be read or set with the circuit live, that is the narrow troubleshooting allowance at 29 CFR 1910.333(a)(1), taken with meter and leads rated for the circuit's measurement category and available fault current plus the shock and arc-flash protection the assessment calls for. Where the change will move a final element, isolate the actuator supply and relieve spring or linkage tension under 29 CFR 1910.147 before any part of you is inside its swing path, and stay clear of the drive train once it is live.

The fields you cannot capture late

Once the old value is overwritten it is gone. Nothing on the controller remembers it, and no amount of care afterward reconstructs it. These four go in the record before your finger touches a key.

The addressing path, complete. Not the point name. Names are duplicated across units, renamed during upgrades, and shown differently on a graphic than in the controller. Record the physical device identity, the exact screen or menu route, the point name and the point's address or reference number. A reversal begins with finding the setting again, and on a site with four similar units that is where most attempts stall.

The pre-change value, with its units and its displayed resolution. A value written as 55 when the display shows 55.0 has already lost information, and on a device that displays 550 with an implied decimal it has lost a factor of ten.

The clock context. The device's own displayed time, and yours, both recorded. When someone later correlates this change against a trend or an alarm log, a controller clock 40 seconds or four hours off its neighbors will manufacture a false story, and the only defense is having noted the offset when you were standing there.

The intended post-change value. Written before entering it, so that what you meant and what you typed can be compared afterward. Transposed digits are caught here or not at all.

What you lose by skipping each of these is not symmetrical. Skip the clock context and a later correlation is harder. Skip the addressing path and a reversal is slow. Skip the pre-change value and the reversal is impossible, permanently, by anyone, forever. That one field carries the whole procedure.

The fields you can fill in from the truck

The observation that prompted the change, stated as evidence rather than as a conclusion. "Discharge held 4.0 F above setpoint for 40 minutes with the valve at 100 percent" survives; "unit undersized" does not, because it is an opinion the next tech cannot check.

The removal condition. A date, or a stated event. "Reverse when the replacement actuator is installed" is a condition. "Temporary" is not, and a change marked temporary with no condition attached is a permanent change with a comforting label on it.

Who else writes to this point. If a supervisory routine, a schedule or a second system also addresses it, the reversal is a coordination problem rather than a keystroke, and the next tech needs to know that before they start rather than after.

The reversal test. How someone would know the reversal actually worked. This is not the same as re-entering the old number, and the difference matters where the system has adapted: an integral term that has wound to an extreme, or a routine that has learned a schedule, does not return to its prior state when the setting does. Name the observable that confirms it.

Side effects the value change carried. Some changes move more than one thing.

The units trap, which is where most reversals actually fail

Three shapes, all common, all silent.

Implied decimals. A controller displaying 550 for 55.0 F is not unusual. Written down bare and re-entered later, 550 is a target the loop will chase forever.

Percent of span versus engineering units. A proportional band expressed as a percentage of the input span on one device and in degrees on another is the same setting with two meanings. A record reading "P: 10 to 20" tells the next tech nothing about whether the loop was made twice as gentle or half as gentle, and on some devices increasing the number softens the response while on others it sharpens it. Record which convention the device uses, in the same line as the number.

Time in mixed units. A reset or integral term stated in repeats per minute is the reciprocal of one stated in minutes per repeat. Doubling one halves the other.

The defense is one habit: every recorded value carries its unit and the convention the device displays it in, in the same field. Not in a note, not in a heading, in the field.

The side effects a value change can carry

A range change is the clearest case, and it is worth working out because it teaches the shape.

Change an analog output's range from 0 to 10 volts to 2 to 10 volts - a reasonable change, made so that a broken wire produces a value below the live floor and announces itself. The controller now spans 0 to 100 percent over 8 volts instead of 10. A 50 percent command that used to leave the terminals at 5.00 volts now leaves them at 6.00 volts.

If the actuator at the far end is still configured for 0 to 10 volts, it reads 6.00 volts as 60 percent. Every commanded position in the system has shifted by 10 points at midscale, permanently, with nothing on any screen indicating it and no alarm anywhere. The change did exactly what it was supposed to do at the controller and quietly re-scaled the machine.

So a range change is two changes and the record has to hold both, at both devices, or the reversal restores half of it and leaves the system in a state it has never been in before.

Worked example: one change, recorded properly

A discharge air temperature setpoint moved up.

Two entries on that record are doing most of the work. The pre-change value with its resolution and its no-implied-decimal note makes the reversal a keystroke. The "other writers" line prevents the next tech from entering 55.0 F, watching a supervisory routine overwrite it 60 seconds later, and concluding the controller is faulty.

The margin line is the one people skip. Written down, it says plainly that this change spent 3.0 F of 35.0 F, so a later tech asked to raise it another 5.0 F knows exactly how much room is left and where the boundary is, without going to find the limit's trip point again.

The same change, recorded the way it usually is

"Raised DA setpoint per customer request. RTU."

Now try to reverse it. Which rooftop unit - there are three on this building and the ticket does not say. What was it before, since the controller now reads 58.0 and holds no history. Is 58 the setpoint or the reset low limit, both of which live on adjacent screens with similar names. Was the supervisory reset routine disabled as part of this, and if it was, does re-enabling it restore the original behavior or overwrite whatever value you just entered.

None of those is answerable, so the practical outcome is that nobody reverses it. The value stays. Two winters later somebody documenting the system writes 58.0 F into the sequence of operation as the design setpoint, and the record is now not just missing but wrong, which is worse, because the next person will trust it.

The tell that a record has failed is that it contains only what changed. A record of a change that carries no prior state is a note, not a record.

Where this is heavier than the job deserves

Not every adjustment earns twelve fields, and pretending otherwise produces a procedure nobody follows.

The minimum viable record is three fields: the addressing path, the pre-change value with its units, and the removal condition. That fits on a phone in under a minute and it preserves reversibility, which is the whole point. Everything else improves the next tech's speed rather than their ability.

The full record is not optional in three cases. Where the change consumes margin against a protective device, because the next person needs to know how much is left. Where more than one thing writes to the point, because a reversal there is a coordination problem. And where the value cannot be re-derived from anything else on site, which covers most tuning parameters and every scaling range.

Where a change is genuinely self-documenting, say so and move on. Replacing a failed sensing element with the identical type changes no setting and needs no reversal path. Confusing that with a parameter change is how a documentation habit becomes something the crew works around instead of using.

References

• 29 CFR 1910.333(a)(1) - live parts de-energized before work, and the narrow conditions permitting energized troubleshooting
• 29 CFR 1910.333(b)(2) - lockout and tagging for work on electric circuits and equipment
• 29 CFR 1910.147 - control of hazardous energy for mechanical isolation and stored energy
• NFPA 70E-2021, 120.5 - process for establishing and verifying an electrically safe work condition
• Manufacturer documentation for the controller's display convention on setpoints, proportional band and integral time, and for the analog output's selectable range
• See related: What an Override Does and How Long It Lasts; The Sequence of Operation as a Diagnostic Instrument; How to Find Which Controller Is Actually in Charge