From Night-Flow Alarm to Verified Repair: A Worked Leak Case
A worked water leak investigation in our example office tower: rule out tank refill and legitimate night uses, check the data, find the leak with a step test, repair it and prove the fix over three nights. Includes a second case where the data cannot settle the answer.
Tan Kok XinWater Fundamentals
Part 11 of 12 in Cobler's Water Fundamentals course. New here?See the course page.
Part 10 set up the nightly minimum and the alert that fires when it jumps. This part follows one of those alerts in the office tower from start to finish. At 7:00am on a Wednesday, the facility manager's phone shows a message: the night flow on one of the building's water meters is more than seven times its usual figure. Is it a leak, the tanks refilling, a cleaner working late or a faulty meter? And if it is a leak, where is it, and how do you prove it has been fixed?
The investigation uses everything the course has taught so far: tanks and level readings (Part 3), meters (Part 6), the cost of a cubic metre (Part 7), the storage-corrected balance (Part 9) and night flow (Part 10). At the end there is a second, shorter case where the data is not good enough to reach an answer, because that happens too.
How to use this water leak investigation exercise
Each task gives you some evidence and asks a few questions. Try the questions first with a calculator and a notepad. The Worked answer comes straight after each task so you can check your thinking.
All the readings are fictional but consistent with each other. Prices use Part 7's figure of RM4.28 for each extra cubic metre the tower buys (water plus sewerage).
The building and its meters
A quick reminder of the layout from Parts 1 to 3. The office tower takes water from Air Selangor through a 100 mm bulk meter into a 300 m³ suction tank. Transfer pumps lift the water to two 100 m³ roof tanks. From the roof tanks, water flows down to the floors in two zones:
The upper zone serves levels 11 to 20.
The lower zone serves the basement and levels 1 (the ground floor) to 10, with a pressure reducing valve (PRV, Part 2) on each floor branch to bring the pressure down to a safe level.
FAQ
Frequently asked questions
Ask us about this topic
Something in this article you want to dig into — or a situation in your own building it doesn't quite cover? Send us your question. We don't run public comments; the team replies to you directly by email.
The cooling tower make-up line also draws from the roof tanks. The fire system has its own tank, pumps and pipes, filled from the incoming supply after the bulk meter.
The building has four water meters, all logged every 15 minutes: the bulk meter, a meter on each zone downfeed, and the cooling tower make-up meter. Level transmitters on the suction tank and the roof tanks are logged as contents in cubic metres. Each floor's branch off the riser has its own isolation valve.
{{media:509}}
The tower's meters and tanks, with the readings from the case night. The booster pump set for the top floors is not shown.
The tower's normal minimum night flow (the lowest 30-minute average between 2am and 4am) is 0.08 m³/h on the upper-zone meter and 0.12 m³/h on the lower-zone meter. That water goes to the ground-floor security post, the lobby washrooms and the urinal flush timers. The chillers are off at night, so the tower make-up meter reads zero.
The building's alert rule, set by its team, checks each zone meter every morning. It sends a message if the minimum night flow is more than 0.10 m³/h above the median of the previous 14 nights.
Task 1: Is it the tanks refilling?
The alert (Wednesday 7 October 2026, 7:00am): "Lower-zone meter: minimum night flow 0.90 m³/h. Baseline (14-night median) 0.12 m³/h." The upper zone was normal at 0.08 m³/h.
The readings from 2am to 4am that night:
Meter or tank
Reading over the two hours
Bulk meter
3.0 m³
Suction tank
276.0 m³ to 279.0 m³
Roof tanks
45.0 m³ to 43.0 m³ (transfer pumps off)
Fire tank
Level steady
Upper-zone meter
0.16 m³
Lower-zone meter
1.80 m³ (steady at 0.90 m³/h throughout)
Tower make-up meter
0
Questions:
Could the suction tank refilling explain the lower-zone alert?
Using the storage correction from Part 9, how much water did the building use between 2am and 4am? Does it agree with the zone meters?
Worked answer:
No. The lower-zone meter sits after the roof tanks. Water refilling the suction tank passes through the bulk meter only, so it cannot reach the lower-zone meter. The bulk meter's reading does include refilling, which is why it cannot be used on its own at night (Part 10).
First find the change in storage. The suction tank gained 279.0 − 276.0 = +3.0 m³. The roof tanks lost 43.0 − 45.0 = −2.0 m³. The fire tank did not change. The total change in storage is +3.0 − 2.0 = +1.0 m³.
Water used = inflow − change in storage = 3.0 − 1.0 = 2.0 m³ in two hours, or 1.0 m³/h.
The zone meters recorded 0.16 + 1.80 = 1.96 m³, or 0.98 m³/h, and the tower make-up meter recorded nothing. The two methods agree to within 0.04 m³, which is smaller than the rounding of the tank readings (0.1 m³).
This agreement tells us two things. The bulk meter's 1.5 m³/h (3.0 m³ in two hours) was all going into the suction tank, which is normal refilling. And no water is being lost between the bulk meter and the zone meters, because everything that left storage was measured by a zone meter. The extra water is being used, or lost, inside the lower zone.
Task 2: Is it a legitimate use?
The alert says the lower zone used 0.90 − 0.12 = 0.78 m³/h more than normal. Before looking for a leak, rule out the uses you already know about.
The evidence the team collected by 9am on Wednesday:
The cooling tower make-up meter read zero all night. The chillers stopped at 7pm.
The security log shows no contractors or tenants in the building overnight. The cleaners finished at 11:15pm.
The building management system shows no change to the urinal flush timer schedule.
The fire tank level was steady and the jockey pump did not start overnight.
On Tuesday evening, the lower-zone flow normally falls to about 0.12 m³/h by 8pm. This Tuesday it stopped falling at 0.90 m³/h, and stayed there all night.
The maintenance log shows a plumber replaced a pantry tap on level 6 at 2pm on Tuesday.
The leasing team showed the vacant level 8 to a prospective tenant from 3:30pm to 4:30pm on Tuesday.
Questions:
Does any known legitimate use explain the extra 0.78 m³/h?
When did the extra flow start?
The level 6 tap and the level 8 viewing both happened on Tuesday afternoon. Which one caused it?
Worked answer:
No. None of the listed night uses changed, and the extra flow is in the lower zone, not on the fire system or the cooling tower. Treat it as a leak until shown otherwise.
The data can only say "by 8pm on Tuesday". During office hours, the lower zone uses several cubic metres an hour, so an extra 0.78 m³/h cannot be seen in the daytime readings. It became visible once the evening use fell away.
The evidence cannot tell yet. Both events fit the timing. It is tempting to blame the new tap, because plumbing work happened there, but guessing here would send the plumber to the wrong floor half the time. The next step is a test that separates the floors.
Task 3: Check the data before sending people
Before asking a plumber to work at 2am, make sure the alert is not a meter or logging fault.
The checks:
All the loggers and level transmitters take their time from the building management system clock. On Wednesday morning, every clock was within one minute of it.
Every meter had all eight 15-minute readings between 2am and 4am. There were no gaps.
The lower-zone meter's total for Wednesday was 19 m³ higher than the average of the previous four Wednesdays.
The storage-corrected bulk figure for Wednesday (bulk meter minus the change in all tank contents over 24 hours) was also about 19 m³ higher than usual.
Questions:
Why does it matter that the two daily figures agree?
What would go wrong if the lower-zone logger's clock had been one hour behind?
Worked answer:
They come from different instruments. The lower-zone meter measures the water directly. The storage-corrected bulk figure comes from the bulk meter and the tank transmitters. A fault in one instrument would not make both show the same extra 19 m³. Since they agree, the extra water is real. It also matches the flow: 0.78 m³/h × 24 hours = 18.7 m³, about 19 m³ a day.
The meter's "2am to 4am" readings would really be from 1am to 3am, while the tank readings covered 2am to 4am. The refill check at the start of this case would then mix two different time periods. It could disagree when nothing is wrong, or agree when something is. This is the same read-timing problem Part 9 described for monthly readings, on a smaller scale.
Task 4: Narrow it down with a step test
A step test finds which part of a pipe system is using water by closing its sections one at a time and watching a meter. When the section with the leak is closed, the meter drops.
The plan: The team ran the test from 2am on Thursday 8 October, when the building was empty. The facility technician and the plumber told the security post first. In the office tower the fire system has its own tank, pumps and pipes, so closing domestic water valves does not affect the sprinklers or hose reels. Before any step test, check this for your own building. They closed each valve slowly, to avoid a pressure surge in the pipes (water hammer). Each closure lasted 10 minutes. They read the lower-zone meter's dial at the start and end of each closure, then reopened the valve fully and wrote down the time.
The results (litres through the lower-zone meter in 10 minutes):
Valves closed
Litres in 10 minutes
None (all open)
150
Levels 2 to 5
150
Levels 6 to 10
20
Level 6 only
150
Level 7 only
150
Level 8 only
20
Level 9 only
150
Level 10 only
150
{{media:510}}
Only closing level 8 brings the flow down to the normal night figure of 20 litres in 10 minutes.
Questions:
Convert 150 litres and 20 litres in 10 minutes to m³/h. Do they match the alert?
Where is the extra flow?
What does the 20 litres that remain with level 8 closed represent?
Worked answer:
There are six 10-minute periods in an hour. 150 L × 6 = 900 L an hour = 0.90 m³/h, which matches the alert. 20 L × 6 = 120 L an hour = 0.12 m³/h, which is the lower zone's normal night flow.
On level 8. Closing levels 6 to 10 together removed 130 litres in 10 minutes, so the extra flow is somewhere on those five floors. Closing each of them in turn shows that only level 8 makes a difference. Closing level 6 changed nothing, so the new pantry tap is not the cause.
The normal night uses on the ground floor: the security post, the lobby washrooms and the urinal flush timers. They are below all the floor branches that were closed, so they kept running.
The extra flow is 150 − 20 = 130 litres in 10 minutes, which is 0.78 m³/h, or about 0.22 L/s.
Task 5: Find the leak and repair it
The test gives a floor, not a fitting. The plumber went to level 8 at 2:50am and listened at each washroom and pantry.
What they found: In the men's washroom, one WC's flush valve was stuck part-open. A flush valve is the push-button valve that flushes a WC straight from the water supply, without a cistern. Water was running quietly into the pan and down the drain. Nothing was on the floor, and because level 8 is vacant, nobody had been there to hear it. The WC had last been used during Tuesday's viewing.
What they did:
At 3:00am, the plumber closed the small isolation valve on that WC's supply pipe, which stopped the loss straight away. The rest of level 8 was left in service.
They reopened the level 8 branch valve and read the lower-zone meter for 10 minutes: 20 litres, back to normal.
On Thursday afternoon, the plumber replaced the flush valve's worn seal, reopened the WC's isolation valve and flushed it five times, checking each time that the flow stopped.
The facility manager recorded the fault, the times and the repair on a work order.
Question: Why close the WC's own isolation valve first, rather than leave the whole of level 8 shut off until the repair?
Worked answer: Closing the smallest possible section stops the loss while keeping the rest of the floor in service. It also confirms the diagnosis: if the lower-zone flow had not returned to 20 litres with only that WC isolated, the plumber would have known there was another leak on the floor.
Task 6: Prove the repair worked
A repair is not finished until the data shows the problem has gone. Decide what "fixed" means before you look, so the result cannot be bent to fit.
The team's test, set on Thursday: the lower-zone minimum night flow must be back within the range of the four weeks before the fault (0.10 to 0.14 m³/h) for three nights in a row. The storage-corrected bulk figure must also be back to normal. The Thursday night of the step test does not count, because valves were being opened and closed.
The results (lower-zone minimum night flow, 2am to 4am):
Friday 9 October: 0.12 m³/h
Saturday 10 October: 0.11 m³/h
Sunday 11 October: 0.12 m³/h
The storage-corrected bulk figure agreed with the zone meters on all three nights.
Questions:
Is the repair verified?
Why wait for three nights rather than one?
Roughly how much water did the leak waste, and what did it cost? What would it have cost if it had been found on the next monthly bill, or not at all for a year?
Worked answer:
Yes. All three nights are inside the 0.10 to 0.14 m³/h range, and the two methods agree. The alert can be closed, with the work order attached.
One quiet night could be a coincidence, for example if the leak was intermittent. Three nights in a row inside the normal range is much stronger evidence.
The leak ran from Tuesday afternoon until 3:00am on Thursday. Taking 4:00pm on Tuesday as the start (the data only proves "by 8pm"), that is 35 hours:
Water lost: 0.78 m³/h × 35 hours = 27.3 m³. At RM4.28 per cubic metre, that is about RM117.
Found on the next monthly bill instead (about 30 days): 0.78 × 24 × 30 = 561.6 m³, about RM2,404.
Left for a year: 0.78 × 24 × 365 = 6,832.8 m³, about RM29,244.
The exact start time makes little difference. Starting two hours earlier would add 1.6 m³, about RM7. In October's water balance (Part 9), the 27.3 m³ appears inside the lower zone's measured use.
Task 7: A case the data cannot settle
Not every morning ends with an answer. Here is a second case, twelve days after the first alert.
Monday 19 October 2026, 7:00am. No leak alert was sent, but the morning data check shows two problems:
The upper-zone meter has no readings from 1:00am to 5:00am. Its logger went offline and came back at 5:10am.
The suction tank's level has read exactly 88.0 percent since 11:40am on Saturday. A real tank level moves all day, so the transmitter has almost certainly frozen.
The other readings, 2am to 4am:
Bulk meter: 4.8 m³ (2.4 m³/h).
Suction tank: 88.0 percent, frozen.
Roof tanks: 46.0 m³ to 45.6 m³, with the transfer pumps off.
Lower-zone meter: 0.24 m³ (0.12 m³/h).
Tower make-up meter: zero.
Fire tank: level steady, and the jockey pump did not start.
Questions:
What can you conclude about the floors?
What can you not conclude?
What should the team do today?
Worked answer:
The roof tanks fell by 0.4 m³ in two hours, which is 0.20 m³/h. With the transfer pumps off and the tower make-up at zero, that water went down the two zone downfeeds. The lower zone took 0.12 m³/h, so the upper zone took about 0.20 − 0.12 = 0.08 m³/h, its normal figure. The floors look normal. This is an estimate, because it relies on the roof tank transmitter rather than the missing upper-zone meter, but it is a reasonable one.
You cannot say where the 4.8 m³ through the bulk meter went. If the suction tank was refilling, its level should have risen by 4.8 m³, which is 1.6 percent. With the transmitter frozen, you cannot tell refilling apart from water running out of the overflow, or from a leak on the buried pipe between the bulk meter and the tank. The flow itself is not unusual: a normal night in Part 10 showed 3.0 m³/h of refilling. So the night can be neither cleared nor called a leak.
Record the night as unresolved: missing data, and do not start a floor-by-floor step test, because the floors look normal. Then:
Raise work orders to repair the suction tank transmitter and the upper-zone logger.
Today, walk to the suction tank's overflow outlet and look for running water. Check the tank's level against the gauge or markings on the tank and compare it with the frozen 88 percent.
Tonight, if the transmitter is not yet fixed, read the tank level by hand at 2am and 4am. If the rise matches the bulk meter volume, the flow was refilling and the case can be closed.
If the rise is clearly smaller than the bulk meter volume, water is being lost before the tank. A quick check is to close the suction tank's inlet valve for a short time at night, with the fire tank full: the bulk meter should then stop. If it keeps turning, water is escaping between the meter and the tank. At that point, call a leak detection specialist, who can use acoustic equipment to locate a leak on a buried pipe.
We do not know the answer to this case, and on Monday morning neither would you. The correct result is a clear record of what is known, what is missing and what will be checked tonight.
Worth knowing: Catching this leak the next morning kept its cost to about RM117. The same stuck flush valve, on a vacant floor where nobody would hear it, would have cost about RM2,404 if it had waited for the next monthly bill, and about RM29,244 if it had run for a year.
What comes next
This case followed one fault from alarm to verified repair. The last part steps back to the whole building and the whole year. Part 12, Water Consumption Benchmark KPIs for Buildings, shows how to build your own baseline, and ends with a recap of the course and a monthly review checklist. It opens with the question: is the building's monthly water use good or bad for a building of its size and type?
Check your understanding
During a step test, closing a floor's branch valve makes the zone meter drop from 150 litres to 20 litres in 10 minutes. How large is the leak in m³/h? The drop is 130 litres in 10 minutes. There are six 10-minute periods in an hour, so that is 780 litres an hour, or 0.78 m³/h.
Why did the team not blame the level 6 pantry tap, even though a plumber had worked there on the same afternoon? The timing fitted both the level 6 work and the level 8 viewing, so the logs alone could not choose between them. The step test could: closing level 6 changed nothing, and closing level 8 brought the flow back to normal.
Recap: Work through a night-flow alarm in order. Rule out tank refill by using meters after the tanks or the storage correction. Rule out known night uses. Check clocks, gaps and a second, independent measurement before sending people. Then narrow the search with sub-meters and a step test, isolate the smallest section, and repair it. Decide what "fixed" means before you look, and confirm it over several nights. When the data is missing or frozen, record the case as unresolved, fix the data, and use cheap manual checks before calling in a specialist.
Cobler builds CobiNeural, a platform that shows a facility team its building's energy, water and indoor air data as live numbers across the whole site. To see how your building performs, talk to us.
Tan Kok XinWater Fundamentals
