Capstone: commissioning a floor of PoE devices

The capstone brings the course together on the job it has followed since lesson 1: the Brightwater Insurance floor at the Kellerman Building. The 348 links are certified, room 6A is built, and the four access switches are racked, powered and configured by Omar Haddad. Cobalt Line's scope is to mount, connect and commission 14 access points, 6 cameras, 4 door controllers, 126 phones, 8 room booking panels and the network side of 8 displays, and to hand over a floor where every device works and every record is complete. Colette gives the job three weeks, working evenings while Brightwater's staff move in on the floors above. Maya, now in her fifth term, runs the commissioning with Teo Barros, under Dev's supervision. This lesson follows the work from planning to handover.

Week one: plans and checks before the ladder

Maya starts with the documents. From Omar she has the IP plan, the VLAN plan, the port map, the switch power budgets and the firmware versions Brightwater has approved. From Cobalt Line's security team she has the camera and door layouts. From Sanjay's records she has the outlet labels and certification reports. She checks them against each other before anything is mounted, because a mismatch found on paper costs minutes and a mismatch found in the ceiling costs hours.

The cross-check finds three problems. Two outlets in the port map have been given the same switch port. One camera in the security layout has no outlet in the cabling records; it was moved after the cabling design. And the PoE budget for switch 6A-SW1, with all seven of its access points at Class 6 plus its cameras, door controllers and phones, is closer to its limit than Omar intended. Omar fixes the port map, Sanjay confirms that a spare outlet within 3 ft of the moved camera can serve it, and Omar moves two door controllers to the new PoE switch, 6A-SW4, to leave headroom on SW1.

# Week one: PoE budgets for the four access switches, reserved by class
CLASS_W = {2: 7.0, 3: 15.4, 4: 30.0, 6: 60.0}
switches = {
    "6A-SW1": {"budget": 1100, "devices": [(6, 7), (3, 3), (4, 1), (2, 4), (2, 40)]},
    "6A-SW2": {"budget": 1100, "devices": [(6, 7), (3, 2), (2, 4), (2, 40)]},
    "6A-SW3": {"budget": 0,    "devices": []},          # no PoE: computers, displays
    "6A-SW4": {"budget": 1100, "devices": [(3, 4), (2, 46)]},
}
for name, sw in switches.items():
    reserved = sum(CLASS_W[c] * n for c, n in sw["devices"])
    if sw["budget"] == 0:
        print(f"{name}: non-PoE switch")
        continue
    pct = 100 * reserved / sw["budget"]
    note = "ok" if pct <= 80 else "over 80 percent: move devices or add power"
    print(f"{name}: {reserved:6.1f} W reserved of {sw['budget']} W ({pct:3.0f} %)  {note}")

6A-SW1:  804.2 W reserved of 1100 W ( 73 %)  ok
6A-SW2:  758.8 W reserved of 1100 W ( 69 %)  ok
6A-SW3: non-PoE switch
6A-SW4:  383.6 W reserved of 1100 W ( 35 %)  ok

Cobalt Line's design rule from LVT-110, keeping supplies at or below 80 percent, applies to PoE budgets too, and the check confirms the new split leaves every switch below it. Phones are allocated by actual draw rather than class, as lesson 6 described, so they reserve less in practice; Maya's check uses class values to be safe.

Next is the shop. Each access point, camera and controller is unpacked, labeled with its planned name, its serial number and MAC address recorded, its firmware brought to the approved version, and its speed, duplex and time zone set, the checks the fault log from lesson 10 added. Cameras and door controllers get their fixed addresses on the shop bench, on a small isolated switch with no connection to any other network. The 32 security and building devices take a day and a half. The access points are not configured in the shop; Omar loads their serial numbers into the cloud controller from Maya's list.

import ipaddress
# Week one: validate the fixed-address list against the IP plan before the devices leave the shop
plan = {40: ("10.60.40.0/26", "10.60.40.1"), 50: ("10.60.50.0/27", "10.60.50.1")}
devices = [("CAM-6-01", 40, "10.60.40.21"), ("CAM-6-02", 40, "10.60.40.22"), ("CAM-6-03", 40, "10.60.40.23"),
           ("CAM-6-04", 40, "10.60.40.24"), ("CAM-6-05", 40, "10.60.40.25"), ("CAM-6-06", 40, "10.60.40.26"),
           ("DC-6-01", 50, "10.60.50.11"), ("DC-6-02", 50, "10.60.50.12"), ("DC-6-03", 50, "10.60.50.13"),
           ("DC-6-04", 50, "10.60.50.41")]
used = {}
for name, vlan, addr in devices:
    net, gw = ipaddress.ip_network(plan[vlan][0]), plan[vlan][1]
    ip = ipaddress.ip_address(addr)
    problems = []
    if ip not in net:
        problems.append(f"outside {net}")
    if addr == gw or ip in (net.network_address, net.broadcast_address):
        problems.append("reserved address")
    if addr in used:
        problems.append(f"duplicate of {used[addr]}")
    used[addr] = name
    print(f"{name:9s} VLAN {vlan} {addr:13s} " + ("ok" if not problems else "; ".join(problems)))

CAM-6-01  VLAN 40 10.60.40.21   ok
CAM-6-02  VLAN 40 10.60.40.22   ok
CAM-6-03  VLAN 40 10.60.40.23   ok
CAM-6-04  VLAN 40 10.60.40.24   ok
CAM-6-05  VLAN 40 10.60.40.25   ok
CAM-6-06  VLAN 40 10.60.40.26   ok
DC-6-01   VLAN 50 10.60.50.11   ok
DC-6-02   VLAN 50 10.60.50.12   ok
DC-6-03   VLAN 50 10.60.50.13   ok
DC-6-04   VLAN 50 10.60.50.41   outside 10.60.50.0/27

The check catches a typing error on the last controller: 10.60.50.41 is outside the /27, whose usable range ends at .30. The plan says .14. Maya corrects it on the bench, where it takes thirty seconds, rather than on a ladder at the far end of the floor.

Week two: mounting and connecting

The second week is mounting. Teo and Maya work zone by zone, following the floor plan, with one person in the ceiling and one at the switch or on a network tester. For each device, the sequence is the one from lesson 8: mount it at its marked location, connect it with the design's cords, then watch the switch port for PoE, link and speed, and the device for its boot. Access points must appear online in the controller with the right name; cameras must answer at their fixed address on the camera VLAN; controllers at theirs on the door VLAN. Each line on the commissioning sheet is filled in before the ladder moves.

Most devices come up first time. The ones that do not are worked through in the bottom-up order and logged. Over the week the log records nine faults. Three are patching: two cords in ports one away from the map, and one from the old map revision that Maya corrected in lesson 9. Two are cords: one two-pair cord from an access point box, which linked at 100 Mb/s, and one damaged cord under a desk. Two are device settings: a camera fixed at 100 Mb/s full duplex, missed in the shop, and a camera with its time zone wrong. One is a switch port with a phone template on an access point port, limiting it to 30 W. And one is a missing DHCP relay on the building systems VLAN, which left all eight room booking panels on 169.254 addresses until Omar added it.

# Week two: summary of the commissioning fault log
faults = [("patching", "port one away from map"), ("patching", "port one away from map"),
          ("patching", "old map revision"), ("cord", "two-pair cord at access point"),
          ("cord", "crushed desk cord"), ("device setting", "camera fixed speed and duplex"),
          ("device setting", "camera time zone"), ("switch setting", "phone template on access point port"),
          ("network service", "no DHCP relay on VLAN 60")]
devices = 14 + 6 + 4 + 126 + 8 + 8
groups = {}
for kind, _ in faults:
    groups[kind] = groups.get(kind, 0) + 1
print(f"devices commissioned: {devices}, faults found: {len(faults)}")
for kind, n in sorted(groups.items(), key=lambda kv: -kv[1]):
    who = "network team" if kind in ("switch setting", "network service") else "installer"
    print(f"  {kind:16s} {n}   fixed by {who}")
print(f"first-time success: {100 * (devices - len(faults)) / devices:.0f} % of devices")

devices commissioned: 166, faults found: 9
  patching         3   fixed by installer
  cord             2   fixed by installer
  device setting   2   fixed by installer
  switch setting   1   fixed by network team
  network service  1   fixed by network team
first-time success: 95 % of devices

None of the nine is a cable fault, and that is the result of LVT-130's certification: every link was proven before the devices arrived, so the crew never had to suspect the cable. Seven of the nine were fixed by the crew in minutes. The two network team faults were handed to Omar with the information lesson 10 described and fixed the same evening.

Week two, continued: the phones

The 126 phones go out in a single evening. They are the simplest devices on the floor: each is plugged into its desk outlet, it powers up from Class 2 PoE, learns the voice VLAN, gets its address and configuration and registers. Brightwater's IT team has preloaded each phone's extension against its MAC address, so a phone on the wrong desk rings with the wrong extension. Teo places them from the desk plan; Maya watches the phone system's registration list fill up on a laptop Omar has set up on a commissioning port. After an hour, 124 are registered. The two missing phones are at desks whose outlets were patched to switch SW3, the non-PoE switch: the phones are dark. Two cords move to SW4, as the port map shows, and both register.

Week three: application tests

The third week proves that each system works end to end, with the people who will use it. The security team and Brightwater's facilities manager review each camera's picture on the recorder: view, focus, the time stamp and recording. The access control administrator adds a test card, and Maya and the administrator walk the four doors: each opens for the card at its scheduled times, refuses it outside them, reports the door held open and forced open alarms, and releases on request-to-exit. The phone system administrator places test calls from a sample of phones in each pod. Omar's team checks the wireless coverage in each zone with a survey tool, which LVT-320 explains, and confirms that the guest network reaches only the internet.

Then the resilience tests. With Lucia's approval and at an agreed time, Omar switches the UPS to battery and the floor runs on it: every access point, camera and controller stays up, and the UPS reports a runtime close to the estimate in lesson 9. Omar then turns off one power supply on each PoE switch in turn; each switch stays up on its second supply. Finally, he disconnects one fiber uplink; traffic moves to the second one in a few seconds, and the ping logs Maya has running to a camera, an access point and a controller show a short gap and then steady replies.

# Week three: resilience test results compared with the design
results = {
    "UPS runtime estimate (minutes)": (28, 27),
    "devices online on battery": (158, 158),
    "switches up on one supply": (4, 4),
    "uplink failover gap (seconds)": (5, 3),
}
for test, (design, measured) in results.items():
    if "gap" in test:
        ok = measured <= design
    elif "runtime" in test:
        ok = measured >= 0.9 * design
    else:
        ok = measured == design
    print(f"{test:34s} design {design:5} measured {measured:5}  {'pass' if ok else 'review'}")

UPS runtime estimate (minutes)     design    28 measured    27  pass
devices online on battery          design   158 measured   158  pass
switches up on one supply          design     4 measured     4  pass
uplink failover gap (seconds)      design     5 measured     3  pass

The UPS runtime is a minute short of the estimate, within the expected range, but below the specification's 30 minutes. The estimate in lesson 9 had already warned of it. Colette raises it with Lucia, who decides to add a battery pack before the displays are moved to PoE next year, and the decision is recorded in the handover file.

Security check and handover

Before handover, Maya runs the security check from lesson 11: every default password changed through Brightwater's password manager, temporary accounts removed, firmware at the approved versions, every security device on its planned VLAN with its port locked to its MAC address, unused ports disabled, room 6A locked with the key log current, and the crew's testers and phones cleared of Brightwater's network details. Lucia's team spot-checks five devices and a room key log entry, and signs.

The handover package is the record of everything this course and the three before it have produced, for one floor: certification reports for the 348 links, the as-built port map, IP plan and rack elevations, the commissioning sheets for all 166 devices with identity, address, firmware, power, speed and application test result, the fault log, the resilience test results, and the photo of every device as mounted. Dev reviews it page by page before it goes out. His comment to Maya is the same one he made at the end of LVT-130: the job is finished when the next technician can maintain the floor from the records without calling us.

What the capstone shows

Three lessons from the job stand out. The first is that most of the work is preparation: the week of document checks and shop configuration made the mounting week fast, and the faults that remained were small. The second is that a certified physical layer changes troubleshooting: with every cable proven, the crew went straight to the layers above. The third is the value of clear handoffs between trades: Cobalt Line, Brightwater's network team and the security team each did their own part, and each fault went to the person who could fix it, with the evidence they needed.

Maya's last entry in her logbook for the term lists what she will do differently next time: run the PoE budget check before the switches are ordered, not after; check every cord from a device box before it goes into a ceiling; and add a question about the UPS runtime to the first-week document check. The next course, LVT-230, takes her deeper into the cameras and doors she connected here, as a security systems installer.