Note
When the tablet can start a pump the panel never showed
The site believed the fire pump could only be started from a keyed panel in the pump room. That was true for the original starter. It was not true for the IoT retrofit.
A contractor had added a gateway so facilities could see run hours in a browser. The same gateway subscribed to a command topic used during commissioning. The commissioning app was still on a tablet in the supervisor’s drawer, logged in as admin, with no PIN. From the mezzanine office you could start the pump without walking downstairs.
Nothing in the cloud dashboard advertised this. The dashboard was labelled monitoring. The write path lived in a retained MQTT message and a firmware default that treated an empty ACL as “allow”.
We found it by listing topics the gateway would act on, then trying each one from a spare laptop on the same VLAN — with the operations manager watching. The pump started. The local panel still showed “off” because the retrofit never wrote status back to the original controller.
The fix was unglamorous: remove the command subscription from production firmware, put the tablet on a named account, and add a physical confirmation on the starter for remote starts. The lesson travels. If a control application can change a physical state, treat the application as part of the machine, even when the sales deck said “visibility only”.