Sensor Placement Under Missing-Data Constraints in Office Buildings: A Resilient Design Framework for Indoor Environmental Monitoring

1. Introduction

Indoor environmental monitoring in occupied buildings is justified by the health and comfort consequences of prolonged exposure to poor indoor air quality, unsuitable humidity, and unstable temperature. Evidence from public-building monitoring notes that indoor pollutant levels may exceed outdoor levels and that temperature and relative humidity are integral to perceived comfort alongside air-quality variables. The same literature describes commonly referenced temperature and humidity ranges associated with comfort, while emphasizing that monitoring is needed to sustain healthier indoor conditions over time. [1]

For office buildings, the design problem is not exhausted by deciding how many sensors to install or how evenly to distribute them across floor area. A network can appear adequate under complete data yet become analytically fragile when some observations are unavailable, delayed, biased, or undocumented in the metadata needed for interpretation. Losses may also be coupled when nominally separate measurements depend on the same communication or control component. In such cases, nominal spatial coverage and operational observability diverge. Placement should therefore be evaluated by what can still be assessed for occupied office zones after prespecified losses, not only by what is measurable in ideal operation.

This article develops a conceptual framework for that problem. It does not report a completed office deployment and does not claim measured performance gains. Its aim is narrower and more precise: to formulate a reproducible placement logic for fixed office-building environmental sensors under missing-data constraints, with explicit assumptions, operational definitions, decision rules, and a prospective validation protocol. In this manuscript, resilient observability means the ability to retain a usable observation or preregistered reconstruction path for a target zone-variable pair after specified failures, with the surviving path and its uncertainty status known in advance from the design.

2. Research question and evidence scope

The primary research question is: how should fixed sensors for office-building indoor environmental monitoring be placed and configured so that occupant-relevant assessment remains usable when some measurements are missing, delayed, or biased? A secondary question is how such a design should be evaluated prospectively before large-scale deployment.

The article uses a targeted narrative synthesis rather than a systematic review. Directly relevant evidence comes from occupant-centered monitoring in public buildings that combines fixed room sensors with schedule-based location inference. Additional context comes from a multizone smart-building study showing practical IAQ monitoring across several zones and variables. Design implications for hidden bias and redundancy are informed by a virtual-sensor HVAC study that models inter-sensor relationships from metadata. Statistical support for reconstruction under incomplete time series comes from work on partially observed functional data with uncertainty quantification. A review of machine-learning studies is used only to map common variables and data constraints, including heterogeneity, missingness, and non-stationarity. Evidence on office-building energy regulation is treated solely as background on offices as a managed building class. [1] [2] [3] [4] [5] [6]

Two scope boundaries follow. First, the article concerns office settings that rely on fixed room or zone sensors, building-management-system streams, and schedules or occupancy proxies. Second, it addresses monitoring design for zone-level environmental assessment and reconstruction under partial observation; it does not claim validation of personal exposure against wearable instrumentation.

3. Transferable findings and their limits

The occupant-centered public-building study shows that fixed room sensors can be connected to occupant-specific exposure estimates by combining room measurements with timetable-based location inference. It further states that the min-operator structure used for its indices can degrade gracefully after faulty channels are isolated, because assessment may proceed from the remaining available measurements, as illustrated by a CO2-only validation. For the present manuscript, these findings support two transferred premises rather than a complete office-placement solution: fixed room sensors can remain meaningful even when occupants move among rooms, and fault tolerance can be built into assessment logic rather than appended after installation. [1]

That study does not, however, solve the present problem. It begins from an installed sensor infrastructure and does not provide a rule for choosing which office zones should receive primary sensors, where backup capability is necessary, or how alternative placement plans should be scored under anticipated missingness. Those design steps are proposed here rather than attributed to the prior work. [1]

The multi-zone smart-building study demonstrates that indoor environmental sensing in institutional buildings is inherently multizone and multivariate. It reports room nodes collecting particulate matter fractions, eCO2, gas-response channels related to CO and VOCs, TVOCs, ozone, dry-bulb temperature, and relative humidity, with validation of transmitted records for exceptions and missing values. Its relevance here is practical rather than architectural: office monitoring should not be designed as a single-variable or single-room exercise when real deployments face heterogeneous zones and multiple targets. [2]

The HVAC virtual-sensor study contributes a different lesson. It explains why a biased temperature sensor in closed-loop control may appear normal in isolation because the controller drives the faulty reading back toward setpoint, while the anomaly is redistributed to correlated sensors and actuators. It therefore predicts each target from related measurements and uses residuals for detection and ranking. The same study notes that real-building deployment would face noise, communication dropouts, missing values, sensor drift, and occupancy-driven variability. The placement implication drawn here is a transferred design inference: redundancy should be planned before failures occur, and the network should include informative cross-sensor relationships rather than relying on isolated readings alone. [3]

The partially observed functional-data paper is not a building study, but it matters because office sensor streams are temporal functions with gaps. It offers distribution-free uncertainty quantification with finite-sample marginal coverage guarantees under weak assumptions, and it discusses fragmented and sparse observation regimes. It also reports a boundary condition: strong phase variation makes prediction intervals less informative. In this manuscript, the building-level implication is used cautiously as an analogy rather than as a direct empirical finding: if the timing of occupancy or ventilation events varies sharply across days, reconstruction methods that depend on temporal alignment should be treated as less reliable and should receive lower design priority until validated locally. [4]

The review of machine-learning applications with indoor air-quality sensors describes IAQ monitoring as a context-dependent problem characterized by multivariate time series, heterogeneous variables, missing data, and non-stationary pollutant sources. It also notes that there is no universal algorithm across tasks and datasets. This supports a placement framework that is model-agnostic and explicit about its assumptions instead of presuming that one predictive method will solve all post-deployment inference problems. [5]

4. Problem formulation and operational definitions

The proposed framework treats placement as a resilient observability problem. Let the office building be partitioned into design zones Z = {1, ..., m}. A zone may be a single room, an open-plan sector, a meeting-room cluster, or an HVAC control area, but the zoning must be fixed before candidate plans are scored. Let Vcore = {CO2, T, RH} be the core variable set consisting of carbon dioxide, temperature, and relative humidity. These variables are justified because the public-building evidence explicitly connects them to indoor-air-quality and thermal comfort assessment. Optional variables, such as PM fractions, VOC-related measures, or ozone, may be included in Vopt when the office use case warrants them. [1] [2]

For each zone z, define D(z) as normalized occupant demand: the share of monitored occupant-hours attributable to z over a planning period, divided by the maximum such share across occupied zones. Define H(z,v) on [0,1] as variable-specific environmental distinctiveness. If pilot data exist, first define the eligible-neighbor set Nelig(z,v) before any scoring. A zone z' belongs to Nelig(z,v) if and only if z' is connected to z in the zone-dependence graph by one permissible edge for variable v and z' is not identical to z. Permissible edges for variable v must be declared in advance from the following categories only: physical adjacency, documented shared HVAC service, documented direct air exchange, or both adjacency and the same control area. The default rule is stricter for localized pollutants than for broadly mixed variables: for temperature and relative humidity, physical adjacency, shared HVAC service, direct air exchange, and same control area are all permissible; for CO2, physical adjacency, shared HVAC service, and direct air exchange are permissible, but same control area alone is not; for optional pollutants or other optional variables, only physical adjacency or documented direct air exchange is permissible unless a variable-specific rule was preregistered before scoring. If pilot data exist and Nelig(z,v) is nonempty, compute for each occupied matched timestep t the difference series Δ_t(z,v)=x_t(z,v)-median{x_t(z',v): z' in Nelig(z,v)}. Let T_zv contain the occupied timesteps with an observed target value and at least one observed eligible-neighbor value. The minimum permitted size of T_zv is an integer of at least two, registered before pilot scoring. If that minimum is not met, use the expert rubric. Otherwise define m_zv = median{Δ_u(z,v): u in T_zv}, followed by MADtime(z,v) = median{|Δ_t(z,v) - m_zv|: t in T_zv}. No imputed timestep enters this distinctiveness calculation. Let Q0.9,v be the 90th percentile of MADtime(z,v) evaluated across all zones for which Nelig(z,v) is nonempty in the same pilot dataset. Set H(z,v)=min{1, MADtime(z,v)/Q0.9,v}. If Q0.9,v is unavailable or equals zero, use the expert rubric below. If pilot data do not exist, or if Nelig(z,v) is empty, use a fixed additive expert rubric with five binary items scored before plan comparison: façade exposure for z relevant to v (1/0), local source presence relevant to v (1/0), separate ventilation service or control for z (1/0), high occupancy-density volatility for z (1/0), and special-use function likely to alter v (1/0). Then set H(z,v)=s/5, where s is the sum of the five item scores. The rubric is additive only; no item weighting is allowed. To keep the fallback reproducible, each item must be scored independently by two designated raters using a preregistered codebook; each disagreement is resolved separately for that binary item by taking the larger of the two independently recorded scores. The five resolved item scores are then summed; neither rater’s total score substitutes for this itemwise operation. Both original item-rating vectors must be archived. When both pilot-data and rubric values are available, the pilot-data value is primary and the rubric is retained only as an audit trail rather than averaged into H(z,v). Any item definitions, variable-specific edge permissions, and evidentiary documents must be declared before scoring, and the fallback rule must be applied identically across compared plans.

High-demand zones are defined operationally rather than informally. Let tauD be a planner-chosen percentile threshold applied to the empirical distribution of D(z) over occupied zones only. The protected set is HZ = {z in Z : D(z) is greater than or equal to the tauD quantile}. If several zones tie exactly at the threshold, all tied zones are included. Unless local policy dictates otherwise, tauD must be declared before scoring and held fixed across comparators. A default demonstration value is tauD = 0.75, meaning the upper quartile of occupied zones by demand. The admissibility rule in this manuscript applies mandatorily to HZ for all core variables and optionally to remaining zones if building-wide protection is desired.

Candidate observation paths are defined over a set P of possible physical or analytical sources. Each path p belongs to a provenance class c(p). Four classes are used here: local-zone sensing, neighboring-zone sensing, HVAC-linked sensing, and virtual sensing. A local-zone path is a sensor physically located in the target zone. A neighboring-zone path uses sensors from an adjacent or environmentally coupled zone. An HVAC-linked path uses building-management-system variables tied to shared air handling or terminal units. A virtual-sensing path is an analytical predictor whose inputs are drawn from measured paths plus temporal context. Provenance classes are used in place of untestable design-time claims about statistical independence. A backup path is the role of a surviving alternative source. A virtual backup is specifically a virtual-sensing path occupying that role; physical and HVAC-linked backups remain distinct provenance classes.

The framework also requires a zone-dependence graph G. Its vertices are zones and HVAC components; its edges encode adjacency, shared HVAC service, direct air exchange, or empirically supported association if pilot data exist. To avoid circular design, empirical edges may improve scoring or backup ranking but should not create admissibility on their own. Admissibility must rest on physical adjacency, documented HVAC linkage, or direct local sensing documented before comparative scoring. G therefore limits plausible backups and helps identify common-cause failures that may remove multiple paths at once.

5. Common-cause encoding and missingness scenarios

To make common-cause separation executable from design documents, the framework defines a building-specific component catalogue C. Each candidate path p is annotated with a dependency set Dep(p) contained in C. The catalogue should be constructed from three document classes: floor and riser plans, HVAC topology, and communication architecture. At minimum, C should include node identifiers, room power circuits if relevant, communication gateways, network segments, shared controllers, HVAC branches or air-handling-unit identifiers, and any data broker or middleware element through which multiple signals pass. If a project lacks some of these records, the missing category should be declared rather than silently ignored. [3]

A path shares a common cause with another path when their dependency sets intersect on any protected component category. Formally, ShareCommonCause(p1,p2) = 1 if there exists c in Dep(p1) intersection Dep(p2) such that c belongs to a category designated as failure-relevant for the scenario under consideration; otherwise ShareCommonCause = 0. Conflict resolution is also explicit. If two paths share multiple components, the conflict is counted once for admissibility and weighted by the highest-severity shared category for scoring. An illustrative severity order is gateway or controller > HVAC branch > network segment > local node accessory, but the chosen order must be declared in advance and kept constant across compared plans.

This definition permits scenario-specific common-cause logic. For example, a packet-loss scenario may designate the local node and gateway as relevant, whereas an HVAC branch fault scenario may designate the branch identifier and associated controller as relevant. Because a path can depend on several shared components, admissibility is evaluated against the union of relevant components for the scenario. A backup that avoids the failed node but remains on the same gateway fails admissibility in a gateway-outage scenario even if it would pass under an isolated channel-loss scenario.

Missingness is represented by a scenario library M = {M1, ..., Mr}. Each scenario specifies the failed components, affected time window, and relevant failure categories. The library should include both random-like and structured losses. A minimum library for office planning may contain: M1 isolated channel loss within one node; M2 complete node outage; M3 gateway outage affecting multiple nodes; M4 HVAC branch telemetry loss; M5 biased reading in one HVAC-related sensor; and M6 scheduled maintenance removing one zone node during occupied hours. These are design scenarios, not empirical frequencies. [3] [5]

6. Proposed placement methodology

The methodology has two stages: design-time ranking and post-selection validation. Design-time ranking uses only quantities that can be estimated before deployment, such as schedules, access records, floor plans, metadata, and pilot observations. Post-selection validation tests whether the chosen plan actually supports reconstruction and uncertainty control under realistic missingness. Separating the stages avoids circular reasoning in which a plan is justified by performance information available only after installation.

For each zone-variable pair (z,v), define a design-time recoverability proxy Rhat(z,v | S,Mj) as an ordinal planning score under plan S and scenario Mj; it is not an accuracy estimate. Ranking is applied only after inadmissible plans have been removed under the rule stated in Section 6.4, so Rhat orders protected pairs within the admissible set rather than compensating for a structural violation. Let A1 denote survival of direct observation under Mj. Let A2 denote existence of at least one strong backup path whose provenance class differs from the surviving primary path, whose scenario-relevant metadata are complete, whose graph distance is at most k(v), and whose dependencies satisfy scenario-specific separation. Let A3 denote existence of at least one weaker but still usable backup path with graph distance in (k(v), K(v)] or with incomplete metadata outside the scenario-relevant categories, provided the path otherwise satisfies the admissibility conditions applicable to its type. Score by precedence after the best admissible backup has been selected for that pair and scenario: if A1, Rhat = 1; else if A2, Rhat = 0.7; else if A3, Rhat = 0.4; else Rhat = 0. Different candidate backups for the same pair under the same scenario do not generate multiple scores; only the highest-precedence admissible class among available backups is used. If several admissible backups exist within the same class, select one by the following fixed order: smallest graph distance, then higher metadata completeness, then lower shared-severity exposure outside the active scenario, then lower installation cost. Uncertainty-band width is not part of plan ranking unless comparable uncertainty estimates are available for every tied virtual backup under the same preregistered reconstruction and calibration procedure; only in that fully comparable case may smaller median validation-window band width be inserted after metadata completeness. A tied candidate lacking such comparable uncertainty information may not gain an advantage from the omission, so the uncertainty criterion is otherwise omitted for all tied candidates. The default distance rule for the main analysis is fixed in advance at k(v) = 1 and K(v) = 2 for CO2, temperature, and relative humidity. Sensitivity analysis may repeat scoring with K(v) = 1 and K(v) = 3. These alternative runs are for robustness reporting only: they may be reported alongside the main ranking, but the preregistered main-analysis ranking remains the binding basis for plan selection unless the entire study protocol is amended before any scoring is performed.

Metadata completeness is operationalized as MCj(p) = 1 when all dependency categories designated as failure-relevant in scenario Mj are documented for path p, and 0 otherwise. A binary rule is preferred because it is auditable. Graph distance is the minimum number of permissible edges in G between the target zone and the backup source, computed separately by variable. If an adjacency is not physically plausible for a variable, that edge is disabled for that variable. Thus a wall-adjacent zone may remain a plausible backup for temperature but not for a localized particulate measure.

The scenario score of a plan is computed on a declared evaluation set E. By default, E = HZ x Vcore, that is, protected zones crossed with core variables only. If a project elects to score additional unprotected zones or optional variables, those pairs must be declared before scoring as a supplementary set Esup and reported separately; they may not alter admissibility for HZ x Vcore. For any evaluated pair, define W(z,v)=D(z) x H(z,v) if (z,v) belongs to HZ x Vcore, and W(z,v)=0 if the pair is scored only in Esup. The protected scenario score is ScoreP(S,Mj) = [sum over (z,v) in HZ x Vcore of W(z,v) x Rhat(z,v | S,Mj)] / [sum over (z,v) in HZ x Vcore of W(z,v)] minus PenN(S,Mj), provided the denominator is positive. If the denominator is zero because no protected occupied pairs exist, design scoring must stop and the zoning or demand specification must be revised. The normalized dependence penalty is PenN(S,Mj) = lambda x Nconflict(S,Mj) / NevalP, where Nconflict is the number of protected zone-variable pairs whose surviving primary and selected backup paths still intersect on a scenario-relevant component, and NevalP = |HZ x Vcore|. To keep the scale interpretable, lambda must satisfy 0 <= lambda <= 1 and must be fixed before scoring; the default operational value is lambda = 0.2, with sensitivity runs at 0.1 and 0.4 reported separately if desired. Any supplementary score for Esup, if used, must be reported separately and cannot compensate for a lower protected score. The overall design score is Overall(S) = sum over j of [w(Mj) x ScoreP(S,Mj)], where the scenario weights satisfy w(Mj) greater than or equal to 0 and sum to 1. To avoid an underdetermined ranking, the weighting rule must be declared before scoring. The default operational rule is uniform weighting across all declared scenarios. A nonuniform alternative is allowed only if the weights are justified prospectively by a written risk register or operational policy that maps each scenario to an ordinal severity class and then to fixed numeric weights before plan comparison; those weights must then be held constant across all compared plans. If cost-sensitive ranking is required, a separately normalized cost term may be subtracted after the scenario-weighted protected score has been computed.

The proposed primary admissibility rule is the framework's central design constraint. For every z in HZ and every v in Vcore, a plan is admissible under scenario Mj if and only if there exists a surviving primary path pprim and at least one backup path pback such that: (1) c(pprim) is not equal to c(pback); (2) Dep(pprim) and Dep(pback) do not intersect on any component category declared failure-relevant in Mj; and (3) if pback is virtual, its parent set Par(pback) contains at least two distinct direct physical measurement paths as inputs, each such input survives Mj individually, no required parent input is itself virtual, and there exist two parent inputs pa and pb in Par(pback) such that Dep(pa) and Dep(pb) have empty intersection after restriction to the component categories relevant in Mj. The rule does not require every pair of parent inputs to be disjoint; it requires the existence of at least one such disjoint surviving pair. A virtual backup therefore fails admissibility if it depends on fewer than two distinct physical nodes, if any required parent input fails under Mj, if any required parent input is virtual rather than direct physical measurement, or if no surviving parent pair satisfies the stated disjointness condition. This rule is mandatory for all z in HZ and optional outside HZ.

The decision sequence is as follows. Step 1: define zones and variables. Step 2: estimate D(z) and declare tauD. Step 3: estimate H(z,v) by the preregistered pilot-data estimator or expert rubric. Step 4: construct G and the component catalogue C; annotate Dep(p) for all candidate paths. Step 5: specify the scenario library M and failure-relevant categories for each scenario. Step 6: declare the protected evaluation set E = HZ x Vcore and, if desired, a supplementary set Esup that will be reported separately. Step 7: generate candidate plans, beginning with direct coverage of HZ. Step 8: add physical or HVAC-linked paths until the admissibility rule is met for every protected pair under every declared scenario. Step 9: add virtual backups only where their full parent sets satisfy the virtual-backup condition. Step 10: compute Rhat and the protected scenario scores, remove inadmissible plans, and rank the remainder. If several plans have equal overall protected score to the declared precision, choose the plan with fewer protected pairs at Rhat = 0.4, then lower normalized cost, then fewer total components.

7. Analytical reconstruction and uncertainty handling

Analytical redundancy supplements placement; it does not replace it. The HVAC fault-detection study shows that inter-sensor relationships can be used to infer expected values and reveal hidden inconsistencies even when a biased sensor looks normal by itself. That logic transfers to office monitoring: a temporary reconstruction of temperature, CO2, or humidity is plausible only when the physical design has already created informative cross-zone and HVAC-linked inputs. [3]

Uncertainty should be represented explicitly whenever reconstructed values are used operationally. The functional-data literature is relevant because it provides conformal prediction for incomplete trajectories and discusses sparse or fragmented observation patterns under exchangeability assumptions. In the present framework, such methods are optional for validation and operation. Their role is to quantify uncertainty after candidate plans have been selected, not to determine placement on their own. [4]

A practical rule follows from the boundary condition on phase variation. If validation data show that a zone-variable pair has highly irregular temporal alignment across comparable days, the designer should down-rank virtual backup for that pair and favor direct sensing or physically separate backup sources. This is not a universal theorem for building data; it is a transfer of a documented limitation in prediction from partially observed functions to a cautious design principle. [4]

8. Comparison with specific prior methods

The present framework differs from the cited methods by addressing predeployment placement under expected partial observation. The occupant-centered public-building method begins with installed room sensors and then links room data to people through schedules; it therefore supports the relevance of fixed infrastructure and graceful degradation, but not sensor-allocation decisions. The multizone smart-building study shows that real deployments are simultaneously multizone and multivariate, yet its main problem is processing efficiency rather than resilient placement. The HVAC virtual-sensor study uses metadata to choose predictor relationships after sensors already exist; here metadata and topology are moved earlier, into the placement stage, through explicit dependency sets and common-cause rules. The functional-data study concerns prediction with incomplete trajectories; this manuscript uses that literature only to justify explicit uncertainty treatment and caution when temporal alignment varies strongly across days. [1] [2] [3] [4]

9. Prospective evaluation protocol and explicit acceptance rules

Because no office deployment is reported here, a detailed prospective protocol replaces an empirical results section. The comparator is a conventional coverage-first plan defined in advance as follows: under the same installation budget, it allocates direct sensors to maximize the number of protected zone-variable pairs with local measurement, using only floor-area coverage and occupied-zone demand as selection criteria, and it does not score common-cause dependencies, scenario-specific losses, or virtual backup admissibility during placement. The intervention plan is the resilience-oriented framework proposed above. Both plans must be evaluated on the same zones, variables, budget, and scenario library.

Before either data-based phase, Stage 0 checks planning admissibility: complete scenario-relevant dependency metadata, a documented common-cause separation test, and feasible surviving sources for every protected pair. A Stage 0 pass permits evaluation to proceed; it is not empirical acceptance. Evaluation should proceed in two phases. Phase A uses pilot measurements, temporary campaigns, or existing building-management-system histories before full deployment. Candidate plans are emulated by masking channels according to each scenario. Phase B is a limited pilot deployment on one or more office floors, followed by approved stress tests such as temporary disabling of designated nodes or channels during authorized periods. Phase B must be governed by a written safety and rollback procedure declared before testing. At minimum, that procedure must identify noninterruptible sensors or zones, the maximum allowed interruption duration for each tested component, the responsible operator, the monitoring checks required during the test, and the immediate restoration steps if any predefined stop condition is triggered. A stop condition should include any loss of a safety-critical building function, any unplanned outage outside the authorized scope, or any failure of restoration after the permitted window. A failed stress test invalidates the plan for the tested scenario. After any scoring, masking, or stress test has begun, no scenario may be withdrawn, redefined, or reweighted for comparative analysis.

Primary outcomes should be defined at two levels because they answer different questions. First, the resilient observability rate (RORcore) is a zone-time metric: over occupied timesteps for protected zones, count 1 only when the full core set Vcore for that zone-time is available either by direct observation or by accepted reconstruction with declared uncertainty status; otherwise count 0. RORcore therefore tests joint continuity of the complete monitoring bundle required for zone-level assessment. Second, the protected pair coverage rate (PCR) is a zone-variable-time metric: over protected zones, core variables, and occupied timesteps, count 1 when that specific pair is directly observed or accepted by reconstruction with declared uncertainty status. PCR tests marginal continuity for individual variables and can remain high even when different variables fail at different times within the same zone, a situation that lowers RORcore. Occupant-weighted continuity is the proportion of protected occupant-hours for which the full core set remains available. Secondary outcomes may include reconstruction error on intentionally hidden observations, median uncertainty-band width when bands are used, and detection lag for channel loss or bias when residual monitoring is implemented.

At least one exact acceptance rule is required for reproducibility. This manuscript therefore proposes a minimal rule, with thresholds stated explicitly as provisional decision defaults for planning rather than as validated standards of adequacy. A candidate plan passes Phase A if and only if, for every scenario Mj, all three conditions hold jointly within HZ: (i) RORcore is at least 0.95, (ii) PCR over HZ x Vcore is at least 0.98, and (iii) no protected zone-variable pair has Rhat = 0 under Mj. A candidate plan passes Phase B if and only if the same three conditions hold under the approved pilot stress tests and its occupant-weighted continuity is not lower than that of the comparator in any evaluated scenario. Passing the two ratio thresholds does not offset failure of condition (iii); one protected zero-rated pair is sufficient to fail that scenario. A plan is accepted overall only if it passes every declared scenario in the relevant phase. These numerical cutoffs are proposed defaults pending local calibration to operational risk, available sample size, and building-specific monitoring objectives; they are not empirical findings and should not be read as universal adequacy thresholds.

Where uncertainty-aware reconstruction is used, an additional optional rule may be declared in advance: a reconstructed segment is counted as operationally accepted only if its uncertainty-band width stays below a locally chosen bound B(v) for at least a proportion q of occupied timesteps in the segment. This manuscript does not fix universal values for B(v) or q. It requires only that these values be stated before validation if uncertainty width is used as an acceptance criterion. [4]

Temporal validation should respect chronology. The HVAC virtual-sensor study trains on earlier fault-free occupied data and validates on later data to avoid leakage, and uncertainty calibration for partially observed functions likewise depends on the relation between calibration and deployment conditions. Office validation should therefore separate training, calibration, and testing windows in time and stratify them where possible by occupancy regime, season, and ventilation mode. To keep placement plans comparable, the reconstruction family used for validation must be preregistered. A default rule is to compare one linear baseline with one tree-based baseline over the same fixed hyperparameter grid for every plan and variable, then choose between them by one time-ordered validation criterion declared in advance. These predictive models are validation and operational reconstruction models only; they do not alter backup-path admissibility, which is determined solely by the structural rules in Sections 5 and 6. If neither data volume nor reference observations are sufficient to support that comparison, the study must report a Stage 0 planning assessment only; neither a Phase A nor a Phase B empirical pass may be awarded from structural evidence alone. [3] [4]

If reference observations or data volume are insufficient to evaluate the preregistered reconstruction criteria, report only structural planning admissibility. Empirical acceptance requires the measured Phase A and Phase B outcomes and all predeclared thresholds for the intended deployment. A masking test without adequate reference values demonstrates execution of the test procedure, not reconstruction accuracy. Any later change to the thresholds or model family requires a new protocol version and fresh held-out evaluation.

10. Boundary conditions, conflicting considerations, and limits of generalization

Several failure cases are foreseeable. First, inter-zone relationships may be weak or unstable. The functional-data evidence indicates that strong phase variation reduces the informativeness of prediction intervals. Offices with irregular hybrid-work attendance, frequent manual window opening, or rapidly changing room use may therefore require more direct sensing and less reliance on analytical reconstruction than highly scheduled workplaces. [4]

Second, recoverability is variable-specific. Temperature and CO2 may often benefit from HVAC and occupancy structure, whereas episodic pollutants produced by local activities can remain sharply localized. The multi-zone study demonstrates the feasibility of measuring many variables across zones, but it does not show that all of them can be reconstructed equally well from neighboring measurements. Placement decisions should therefore be made separately by variable rather than by a single generic coverage score. [2]

Third, metadata quality can constrain the entire approach. The HVAC study identifies real-world metadata completeness as a practical bottleneck, alongside missing values, communication dropouts, and operational variability. In offices with poor naming conventions or undocumented topology, both common-cause encoding and virtual-sensor specification will be weakened. Under such conditions, the framework should default toward more direct local sensing in protected zones. [3]

Fourth, office occupancy structure may be less regular than the institutional schedules used in the public-building study. That study supports timetable-linked exposure inference in structured settings, but hybrid offices may require access-control aggregates, desk-booking records, or room reservation logs instead of formal timetables. The transfer is therefore conditional, not automatic. [1]

11. Conclusion

This manuscript has proposed a conceptual and operational framework for sensor placement under missing-data constraints in office buildings. Its central claim is methodological: placement should be formulated as resilient observability rather than nominal spatial coverage. The framework combines occupant-demand weighting, variable-specific environmental distinctiveness, a zone-dependence graph, an explicit component catalogue for common-cause detection, a scenario library of plausible data losses, and a mandatory source-diverse backup rule for protected zones.

The article's contribution is bounded. It translates evidence from fixed room sensing in structured public buildings, multizone IAQ monitoring, metadata-guided virtual sensing for HVAC fault analysis, and uncertainty-aware prediction from partial functions into a design logic for office monitoring. It also fixes implementation choices that are often left implicit: protected zones are derived from normalized occupant demand over occupied zones; variable distinctiveness has a reproducible fallback rubric; common-cause dependencies are encoded as documented component sets; admissibility rests on source diversity plus scenario-specific separation; and prospective acceptance rules are stated for both zone-time and zone-variable-time outcomes. [1] [2] [3] [4]

What remains untested is equally important. No office deployment or comparative field trial has been conducted within this manuscript. The percentile threshold for protected zones, the ordinal categories inside Rhat, the normalized penalty weight lambda, the graph-distance limits, and any uncertainty-width bounds are planning parameters until calibrated locally. The practical value of virtual backups will depend on metadata quality, occupancy regularity, variable-specific dynamics, and the preregistered reconstruction family used in validation. The manuscript should therefore be read as a precise design proposal for office-building trials, not as evidence of demonstrated superiority over existing placement practice.

References

1. Ruffa, Filippo; Iadarola, Grazia; De Capua, Alberto; De Capua, Claudio (2026). A Method for Optimized Monitoring of Indoor Air Quality in Public Buildings. Sensors. 26(14), 4559. doi:10.3390/s26144559.
2. De Jesus, Luigi Carlo M.; Africa, Aaron Don M.; Illahi, Ana Antoniette C.; Gustilo, Reggie C.; Brucal, Stanley Glenn E. (2026). Spike-Driven Neuromorphic Sensing for Energy-Proportional Indoor Air Quality Monitoring in Multi-Zone IoT-Enabled Smart Building Environments. Sensors. 26(13), 3992. doi:10.3390/s26133992.
3. Chahine, Khaled; Noura, Hassan N. (2026). BRICK-Automated Virtual Temperature Sensors for Sensor Fault Detection, Isolation, and Discrimination in Smart-Building HVAC Systems. Sensors. 26(11), 3465. doi:10.3390/s26113465.
4. Wang, Fangyi; Kurtek, Sebastian; Zhang, Yuan (2026). Joint Registration and Conformal Prediction for Partially Observed Functional Data. Journal of Computational and Graphical Statistics. 1-11. doi:10.1080/10618600.2026.2634823.
5. Rosca, Cosmina-Mihaela; Stancu, Adrian (2026). Machine Learning Applications with Sensors for Indoor Air Quality Research. Sensors. 26(9), 2909. doi:10.3390/s26092909.
6. Eichholtz, Piet; Kok, Nils; Sun, Xudong (2026). The impact of minimum energy performance standards on the commercial real estate market. Nature Communications. 17(1), 4038. doi:10.1038/s41467-026-70684-w.