Your building’s
energy agent.
Kilowatch reads your building automation system, catches the equipment quietly wasting energy, and hands you the fault, the hours and the dollar figure. Deterministic rules do the finding. The agent does the explaining.
- RTU-2Schedule faultSupply fan runs 24/7 — 384 unoccupied hours this month22 days$410 /mo
- AHU-3Economizer stuckDamper held at 12% across 51 h below the changeover point9 days$180 /mo
- AHU-1Simultaneous heat / coolReheat valve open while the damper calls for free cooling4 days$95 /mo
- CHW-P2Continuous runPump never cycles, no differential-pressure reset in 720 h31 days$240 /mo
- OAT-01Sensor drift — resolvedReading 4.1 °C high, recalibrated Mar 4, verified against stationclosed$0
Finding the fault
isn’t the model’s job.
Point the LLM at the trend data.
Ask a language model whether a week of temperatures looks wasteful and it will answer in a confident tone. It invents a fault that was never there and walks straight past the one that was. There is no threshold to inspect, no window to tune, and nothing you could take to a contractor and defend.
Unrepeatable, unpriceable, unauditable.
Rules find it. The agent explains it.
Deterministic fault rules run continuously over months of history, with named thresholds and minimum duration windows printed on every finding. The model never decides whether something is broken. It prices the fault, writes the work order, and turns your plain-English question into a structured query.
Every number traceable back to a point and a timestamp.
When confidence in a point mapping is low, we don’t run the rule at all. A false positive costs more than a missed fault. One wrong number in the first report and the building stops believing the second one.
From a roof unit to a dollar figure.
Three moves, and only the last one involves a language model.
We come to the building.
Haystack, straight off the station. Nothing is installed on the JACE and its control logic is not touched. We read on the interval you set: which points exist, what they are called, and what they read now. Whatever the station has already proxied onto itself comes with it, because by then it is a point on the station like any other.
→ The module listens and we call it: one rule on your firewall, one port, our address only. No VPN into the OT network.
→ Polled on your interval, not subscribed. Two operations, both reads: which station answered, and what its points say now.
→ The record starts at the first poll. History already on the station is not read, so nothing before that is back-filled.
Five thousand points, tagged in an afternoon.
Point naming is the wall every FDD rollout hits. Our inference engine reads units, writability, position in the station tree and a week of value statistics before it ever guesses from a name — a point that lives between 20 and 24 °C is a zone temp whatever the integrator called it.
→High confidence auto-accepts. The rest lands in a technician’s approval table, pre-ticked.
→We don’t classify every point — we look for the eight roles a rule needs.
→Solve one integrator’s naming habit and every building they commissioned maps at once.
Ask in plain English, get a number.
By the time you ask, the work is already done. The agent turns your question into a query against computed fault records — it never sees raw trends, and it never touches the building to answer. What comes back is equipment, duration, hours and dollars, in the order they cost you money.
→ Work orders come out as drafts with a named approver, never auto-sent.
→“What is AHU-3 doing right now” is a separate live tool, kept off the analytics path.
@kilowatch what’s costing us the most this month, and is any of it something I can fix today?
RTU-2, by a distance. Supply fan has run continuously for 22 days — 384 unoccupied hours, about $410 this month. That one is a schedule reload on the JACE, so yes, today. AHU-3 is second: the economizer damper sat at 12% through 51 hours below changeover, about $180, and that one needs an actuator on site.
It speaks what your building
already speaks.
Most of Canada’s commercial stock runs on Niagara underneath somebody else’s badge — the same N4 with a different label on the front. If there is a JACE-8000, a JACE-9000 or a Supervisor on site, we connect to it.
signed module
no module neededOne rule, pointed at us.
A read-only Haystack module goes on the JACE and listens. Kilowatch connects to it, which needs one rule on your firewall: a single port, allowed from our address and nothing else. No VPN into the OT network, nothing else published, and the account we sign in with can only read. It is the station’s own account and Haystack’s own SCRAM handshake — we did not invent a scheme for this. The host fingerprint is checked on every reconnect, so a swapped JACE stops syncing instead of quietly reporting as the old one.
one inbound rule · read-only accountA signed Niagara module.
Installs on the JACE like any other driver. Point discovery, the mapping approval table and link health live right in Workbench, where the technician already is — and nothing in it changes your control logic.
N4 4.10 → 4.15 · signed buildsNot a demo. The parts that survive
contact with a real building.
The model never finds the fault
Deterministic rules run over months of continuous history. Every threshold and duration window is named on the report, so a contractor can argue with the logic instead of with a black box.
0 invented faultsEvery fault carries a dollar
Runtime × load × your blended rate, normalized against degree days so “up 10% on last month” means something other than “it got colder.”
priced in CADPoint mapping in an afternoon
Units, writability, tree position and a week of value statistics do the inference. The technician approves a pre-ticked table instead of typing five thousand rows.
~20 min per buildingSilent drift can’t lie to you
Regenerate an export table and AI:12 quietly becomes AI:47. Every binding carries a fingerprint we re-verify on reconnect — a point that fails leaves analytics rather than reporting nonsense.
verified each reconnectCollection happens at the edge
Subscriptions rather than polling, 15–25 points per unit, buffered on site and shipped compressed. Your JACE goes on doing its real job, which is controlling the building.
15-minute packetsThe history record is yours
The station seeds us whatever it has on day one, then we keep the copy. When the JACE is replaced and the station rebuilt from scratch, your baseline survives it.
12+ month baselineFive hours decide
your whole bill.
A Class A building pays most of its Global Adjustment on what it drew during the year’s five coincident peak hours, and the province’s time-of-use bands price the rest of it. The same stuck damper costs several times more at four in the afternoon than at four in the morning, so a fault list sorted by duration puts the expensive one somewhere in the middle. Kilowatch prices every finding against the band it actually ran in, and that is what decides the order you read them in.
It does not touch the building to do any of that. There is no command path in this product — not one that is switched off, one that was never built.
AHU-3’s economizer sat at 12% for 51 hours. Nineteen of them fell inside the on-peak window, and that is where two thirds of the $180 came from. The same 51 hours overnight would have been worth a quarter of it.
Nothing about this should worry
your IT department.
The fastest way to kill a building analytics rollout is to ask a facilities team to defend a connection they cannot describe. So here is the whole of it: one port on the JACE, open to one address, answering reads to an account that cannot write.
Canadian residency
Every trend, tag and report stays in a Canadian region. Nothing silently egresses to a US bucket because a vendor found it cheaper.
ca-centralRead-only. Not by default — by construction
There is no command path in this product. The Haystack client has no pointWrite and no invokeAction, so there is no capability to grant, revoke or misconfigure. Nothing we install can move a setpoint, a damper or a schedule.
no write pathNo model key on your JACE
The module on the JACE answers reads and initiates nothing — it never calls out at all, least of all to a model provider, so there is no key sitting on your OT network. What authenticates the connection is a station account, not a certificate: there is no client certificate anywhere in this product.
reads only, calls nobodyNever trained on
Your point names, trends and reports are not used to train anything. The abbreviation dictionary we build is ours; your building’s data isn’t in it.
yours stays yoursEvery rule run is replayable
Which points fed a finding, which thresholds applied, which window, which rate. Reproduce any dollar figure on the report months later.
full audit trailYour contractor keeps the station
Nothing we install alters control logic or sequences. The integrator keeps ownership, gets the mapping table, and can see exactly what we read.
no control changesPriced by what you
actually record.
A station offers thousands of points and a site is analysed on dozens. You approve the ones worth recording, and those are the ones counted — points you never approved cost nothing. How often a station reports is part of the plan too, because that is the load it puts on us and the resolution you get back.
Starter
One site, one station, proof on your own building.
- 1 site
- 1 Niagara station per site
- 100 recorded points per site
- Pushes every hour
- Point mapping, findings and work orders included
Standard
A handful of sites under one account.
- 3 sites
- 3 Niagara stations per site
- 500 recorded points per site
- Pushes every hour
- Point mapping, findings and work orders included
Enterprise
A portfolio, with the limits set to suit it.
- 10 sites
- 10 Niagara stations per site
- 2,000 recorded points per site
- Pushes every 10 minutes — negotiable
- Point mapping, findings and work orders included
The questions facilities teams actually ask.
Do we have to open our building network to the internet?
One port, and only to us. The Haystack module on the JACE listens and Kilowatch connects to it, so this is an inboundrule on your firewall rather than an outbound one — scoped to our address, on the single port the module answers. No VPN tunnel into the OT floor and nothing else published. The station account we use is read-only, and the client has no operation that could write with it: no pointWrite, no invokeAction. Nothing about the security is ours — it is Haystack’s own: the station’s account model, and SCRAM, which never sends the password itself.
Our BAS contractor owns the station. Is that a problem?
Usually the opposite. We install like any other driver, change no control logic or sequences, and hand the integrator the mapping table so they can see exactly which points we read. Several of them resell us rather than build analytics themselves — that’s what the Integrator tier exists for.
How do you keep from reporting faults that aren’t real?
Three ways. A rule only runs on points mapped with high confidence — low confidence means the rule sits out rather than guessing. Every threshold carries a minimum duration window, so one noisy hour proves nothing. And in a new building the first findings get physically verified before any report leaves us. If the fan is supposedly running at 2 a.m., someone goes and listens.
Niagara already stores history. Why keep a second copy?
Because in practice it doesn’t. History extensions are off by default and rarely exist on the points fault detection actually needs — damper position, cool command, fan status, outside air temp. Adding five hundred of them fills the JACE’s storage and slows the device whose real job is controlling your building. And retention is weeks, not the twelve-plus months an economizer baseline needs. We pull whatever history is there on day one as a seed, then keep the record ourselves — so when the JACE is replaced and the station rebuilt, your baseline survives.
Which systems and versions do you support?
Niagara 4, 4.10 through 4.15, on a JACE-8000 or a JACE-9000 — a signed module, or Haystack straight off the station where one is already exposed. Whatever the station has proxied onto itself comes with it, because by the time we read it, it is a point on the station like any other. A head-end that is not Niagara we do not connect to today, and we would rather say that here than have you find out on the roof.
How long until we see the first report?
Backfilling from whatever the station already holds usually puts a first fault report in your hands inside the first week, rather than waiting thirty days to collect enough history. Where the station holds nothing, expect two to four weeks before the duration-based rules have anything honest to say.
Start with one building.
We would rather prove this on a real site than pitch it on a slide. One building, one season, every finding checked in person before it reaches your desk — and a number at the end you can take to whoever signs for it.