01
What failed?
A trend crosses a threshold. Someone still has to work out which component failed, and whether the equipment or the building schedule caused it.
AI service desk for HVAC maintenance, on AWS
Uptime Desk
When an air handler or rooftop unit starts to fail, Uptime Desk turns the sensor alarm into a diagnosis that quotes the equipment manual, a work order that a manager approves, and a qualified technician on the way. Code checks every quote, approval, and assignment.
39.4 smedian from replay start to a drafted work order (8 hosted runs)
77.3 smedian to a dispatched technician, after manager approval
$0.0021average model cost per incident (CloudWatch, 10 incidents)
0unauthorized reads across 12 adversarial assistant tests
Explainer
See one incident from alarm to dispatch
The video covers the problem, the AWS design, one recorded field day replayed through the live system, and the measured results, including where the simple baseline won.
2 minutes 30 seconds, narrated, with captions. The demo footage replays recorded LBNL field data; no reading is simulated.
The problem
The alarm is the easy part
A building automation system can tell a service manager that a supply air temperature is drifting. It cannot answer the three questions that decide how fast the building recovers.
02
Which steps are safe?
Service and lockout steps live in manufacturer PDFs that the alarm system never reads. An unsourced step on a work order is a safety risk.
03
Who can get there in time?
The nearest technician may lack the certification, the shift, the site badge, or the escort clearance. The SLA clock keeps running while the dispatcher checks.
How it works
Five steps, one trail of evidence
Models propose. Deterministic code decides. The manager stays in control of every order that reaches a technician. Each screen below comes from the recorded demo, captured from a real run.
Measured results
Every number has a source, including the losses
Each gate compared the AI path against a simple baseline on recorded LBNL data. Lab and field results stay separate. Orange cards mark where the baseline won or the system stopped itself.
Ground truth: published LBNL fault labelsMeasured: gate outputs in reports/Not validated: downtime avoided, savings (not claimed)
Detection, lab air handlers
0.957
model recall, against 0.739 for rules
23 faulted days, scored against LBNL labels. gate-1.json
MeasuredDetection, field rooftop units
0.648
rules recall, against 0.187 for the model
91 faulted days on 2 field units. The lab-trained model did not transfer. gate-1.json
Baseline wonCitation support
0.880
against 0.122 for a keyword baseline
92 cases; 0.915 on 60 held-out field days. gate-2.json
MeasuredDispatch lateness, scenario
402 min
OR-Tools, against 1,343 for nearest qualified
37 jobs, 0 constraint violations. Earliest available also reached 402. gate-3.json
Scenario modelTechnician assistant
27 / 30
answers correct; 12 of 12 adversarial tests passed
0 unauthorized reads, p50 latency 4.12 s, $0.00097 per question. gate-4.json
MeasuredHosted end to end
8 / 10
full runs passed on AWS
The other 2 were blocked because no lockout step could be sourced. gate-5.json
Stopped safelyThe rules stay the primary detector because they won on two of three equipment families. The AI's lead in naming the fault over the rule hint (0.424 against 0.326) is not statistically significant (p = 0.078). Every report is in the reports folder.
AWS architecture
Serverless, event-driven, private by default
AWS CDK in TypeScript defines every resource in us-east-2. The always-on profile holds the data, identity, and API layers. The demo profile adds the streaming pipeline and the Fargate solver only when a demo runs.
Kinesis Data StreamsLambda (arm64 containers)EventBridgeStep FunctionsECS Fargate + OR-ToolsAurora PostgreSQL Serverless v2Bedrock (gpt-oss-120b, gpt-oss-20b)Knowledge Bases on S3 VectorsBedrock GuardrailsAgentCore Gateway (MCP)CognitoAPI GatewayVPC endpointsAmplify Gen 2CloudWatchCDK
Numbered badges follow one incident: sign-in, API, replay, detection, the case machine, diagnosis through private endpoints, the draft, approval and dispatch, and the technician's question. Click to enlarge.
Start simple
Who uses it, and how one fault becomes one work order.
Then go deeper
Network, identity, orchestration, retrieval, data, delivery, and operations.
Engineering decisions
Trade-offs made on purpose
No NAT gateway
Lambdas that touch Aurora reach Bedrock, Secrets Manager, and Step Functions through four interface endpoints in one Availability Zone. That trades zone resilience for about $29 a month less idle cost (AWS list price, an estimate).
Rules first, model second
The rules baseline won on two of three equipment families, so it stays the primary detector. The model runs beside it, and any disagreement goes to a person.
The database enforces citations
Work order steps carry a CHECK constraint that accepts only verified quotes. A bug in the application layer still cannot store an unsourced instruction.
Identity from the token, never the model
An AgentCore Gateway interceptor replaces any identity the client sends with the one in the Cognito token. In the live check, a spoofed manager claim was replaced and denied.
Known limits
What it does not do yet
- Building operations faults. The diagnosis proposed an equipment fault for all 11 lab operations cases, such as schedule errors, and identified 0 of them.
- Coil valve manuals. No public manual covers the lab air handlers' coil valves, so those diagnoses abstain on 82.6% of cases.
- Small field set. Field results rest on 2 rooftop units, one per site.
- False alarms. Detection raises 0.5 to 1.9 alarm events per unfaulted operating day, too many for unattended use.
Next
What I would build next
- Exact manuals. Add model-specific and coil valve service manuals, then score a fresh episode-level holdout.
- An operations router. Separate building operations faults before any equipment diagnosis or dispatch.
- Road travel times. Replace straight-line travel at 40 km/h with a road network and live technician locations.
- Copilot Studio. Connect a Copilot Studio agent to the same API through a custom connector (plan).