A product of Flux Core
Field services Security Request a technical review

INTRODUCING BUILDING INDEPENDENCE

You own the building.
Stop renting the understanding.

Flux answers a hard question about your building in plain English, shows every piece of evidence, says what it doesn't know — then checks whether the fix actually worked.

app.fluxcoreos.com
Flux Core OS Performance view: grade 96, three of three buildings covered, priority issues, energy exposure, verification readiness and the action rail

Everyone is about to sell you a building assistant. Ask each one to show its work. Here's ours.

56Conformance tests run against the open BUS-1 standard. None omitted.
0Vendored third-party libraries in the realtime control stack.
2Signatures on every update — Ed25519 and post-quantum ML-DSA-65.
16Priority levels. Safety and operators always outrank optimization.

One answer, start to finish

“Why is the lab loop running on the standby pump?”

The lead chilled-water pump stopped reporting. The standby has been carrying the lab loop.

Flux put this first out of six open issues — not because it was the loudest, but because a lab had quietly lost its redundancy and nobody had been told.

Recommended action. Verify pump status with the site and inspect gateway communication before clearing the alarm.

A reference building on the real software. Demo data, production interface.

ACTION RAIL

6 ranked issues

1 ACT NOW

Critical pump status is stale while redundancy is reduced

Research Lab / Chilled Water Pump 2

Stale Open
2 PLAN TODAY

North Tower zones are cold during occupied hours

North Tower / AHU-7

Live Open
3 INVESTIGATE

Energy comparison needs a stronger baseline

West Annex / Portfolio

Insufficient baseline Open
4 INVESTIGATE

RTU-3 recurrence needs service history access

East Plant / RTU-3

Access-limited Open
5 NEEDS EVIDENCE

Main meter is missing, blocking demand review

South Campus / Portfolio

Missing Open
6 NEEDS EVIDENCE

Missing discharge air temperature blocks AHU-2

Clinic / AHU-2

Partial Open

SHOW YOUR WORK

Every answer opens.

Observation and inference, never blended.What Flux saw and what it concluded stay separate — every claim traces back to its signal.
A recommended action, not an alarm.Verify the pump with the site and check the gateway before clearing anything.

PERFORMANCE ISSUE

Critical pump status is stale while redundancy is reduced

Act Now Stale Rank 1 Reliability

The lead chilled-water pump status has not updated and the standby pump is carrying the lab loop.

critical_equipment_offline comfort reliability

Recommended action

Verify pump status with the site and inspect gateway communication before clearing the alarm.

Impact

4 comfort hrs

Annual cost: $18,000

Confidence

63% Medium

Alarm and last-good sample agree, but telemetry is stale.

63% — and it tells you why.The telemetry is stale, and Flux says so in the words a person would use.
$18,000 a year. Or no number at all.When the meter data is missing, impact isn’t claimed until the evidence exists.

How it works

Understand. Decide. Act. Verify. Learn.

Every project says up front which sources it can reach and where access stops — before anyone forms an answer.

FOUR SOURCE TERRITORIES

ControlsPoints, trends, alarms, schedules
ServiceWork orders, notes, history
OperationsOperator logs, occupancy, space
CapitalPlans, projects, asset decisions
01 UnderstandFlux Core OSEvidence assembled; observation, inference and gaps kept apart.
02 DecideQualified reviewOwnerA qualified person reviews; the accountable owner makes the call.
03 ActQualified actionWork done in the field — or consciously declined, and recorded.
04 VerifyLive buildingLive operation checked against what was predicted.

LIVE OPERATING RECORD

Evidence, decisions, actions and outcomes — owned by you.

Question Evidence Gaps Review Decision Work Result

Exports as an open Building Understanding Standard package.

The next cycle starts ahead. Verification becomes new operating context, so the next question begins with what the building already proved.

Operations triage

Five alerts. One goes first.

Flux ranks by consequence, not volume. A generator alarm at a hospital outranks a damper fault, and it has an owner before anyone opens a ticket.

app.fluxcoreos.com
Flux Core OS Alerts triage: one critical alert needs action, priorities P1 to P4 with response expectations, and a ranked list led by a hospital generator common alarm with the on-call engineer paged

Ranked by consequence

P1 through P4, each with a response expectation the whole team can see.

Owned, not just raised

Every alert carries who has it and where it stands: diagnosed, acknowledged, paged.

Straight into corrective work

Start a response and it becomes a work order, then a verification, without retyping a thing.

Who decided

Software doesn't get the last word.

A qualified integrator reviews the evidence. The accountable owner makes the call. Both are recorded — who, when, and on what basis — beside the evidence they were looking at.

Declining is a decision too. Six months later, you'll want to know it was made on purpose.

DECISION RECORD

Recorded
QuestionWhy is the lab loop on the standby pump?
Reviewed byQualified integrator
Decided byAccountable owner
DecisionVerify on site, then clear alarm
BasisAlarm and last-good sample agree; telemetry stale

HUMAN AUTHORITY · SOFTWARE INFORMS, ACCOUNTABLE PEOPLE DECIDE

  1. SoftwareObservation
  2. SoftwareInference
  3. PersonQualified review
  4. PersonOwner authorization
  5. PersonQualified action
  6. BuildingLive verification

What the building did

Then the building grades it.

Flux follows every action into live operation and compares what happened against what was predicted — the discipline software teams use to stop a working system from quietly regressing. CI for buildings.

Map Author Run Verify Monitor

Verification matrix

CI for buildings: every equipment and test pair shows its latest verdict, drift, and evidence entry point.

COVERAGE

4 checks

Certified

0

Blocked

2

Pending

0

Non-certifying

2

Equipment ╲ Test VAV Reheat Valve Response AHU Economizer Free Cooling Zone Occupancy Conformance AHU-1 NON-CERTIFYING VAV-204 BLOCKED↘ drift VAV-310 BLOCKED↘ drift NON-CERTIFYING

Zero certified. Flux does not turn an incomplete result into proof. This is the step that can prove us wrong. That's the point.

Capital planning

Replace what the building says to. Not what the calendar says.

The same understanding that runs the building ranks its capital. Every asset carries its condition, criticality, modeled failure window and financial case — so the replacement plan your board sees is the one the equipment is actually asking for.

app.fluxcoreos.com
Flux Core OS Capital Plan overview for a hospital: funded program, P50 and P90 replacement need, P90 reserve, deferred work, risk left and capex gap from a 1,024-trial scenario
app.fluxcoreos.com
Flux Core OS Prioritized Replacement Plan: assets ranked by priority and criticality with modeled replacement timing, deferred-cost risk, P50 and P90 failure windows, NPV, IRR, payback and benefit-cost ratio

Plan vs. modeled timing

Your scheduled year next to the P50 and P90 failure windows, so early and late both show.

Risk of deferral, priced

What waiting costs, in dollars, before anyone decides to wait.

A financial case per asset

NPV, IRR, payback and benefit-cost ratio — with the evidence behind every input.

Criticality you set

Suggestions never write. A person applies criticality, and the plan re-ranks.

Three doors

Whoever is accountable for something should own the understanding of it.

The realtime engine

Written from scratch.
Signed twice.
Replayable to the byte.

The realtime engine runs beside the equipment — or inside it. Verification only works if the building is still running, so it was built for equipment that ships in 2027 and is still in the field in 2045.

01A stack with nobody else's code in itControl, protocol, TLS, HTTP/2 and cryptography written from scratch in Zig. No vendored third-party libraries.
02Post-quantum signing at every power-onHybrid Ed25519 + ML-DSA-65. Both arms required, downgrade-rejecting, fail-closed.
03Optimization is an authority classA 16-level BACnet-compatible priority array. Advanced control can never outrank a freeze-protection interlock.
04Safety enforced by the build graphDangerous operations gated at compile time. Every field write passes a durable at-most-once journal.
05An update path the cloud can't subvertDigest-only releases, immutable A/B slots, automatic rollback. No URL, command or credential from the cloud.
06Determinism you can diffRecorded traces replay to byte-equal command records. A value it can't parse is an error — never a fabricated zero.

WHAT THE ARCHITECTURE MAKES POSSIBLE · EACH WITH ITS STATUS

Model-predictive controlLooks ahead over a horizon to minimize comfort violation and energy cost together — permanently below safety and operator.Advisory today · closed loop gated
Black-box warranty verificationA recorder on the equipment shows what was commanded, by which authority, and when — replayable to the byte.Recording & replay: production
Optional cloud-managed fleetRegistry, signed update campaigns and portals for every unit shipped — on its own meter, never bundled.Portals & updates: production

The blocks you expect, deterministic to the byte.

One static ARM64 binary from the cheapest 64-bit module to an industrial edge computer. Boot it bare metal as its own kernel, or inside your RTOS. Your control logic ships as signed plug-in kits — without forking or disclosing it.

PIDCascadeSplit-rangeLead/lagDemand resetEconomizerFreeze protectionOptimal startMorning warm-upNight setbackSupply-air resetStatic-pressure resetDemand limitingHumiditySafetiesSchedulingTrend & totalizationRuntime accumulationAlarm history

The open standard

Understanding you can take with you.

Flux Core OS reads and writes the Building Understanding Standard — an open, published package for a building's operational understanding. So what your building learns is never trapped in anyone's software. Including ours.

WHAT THE OWNER KEEPS

Everything that describes the building.

Points, spaces, assets and relationships. Setpoints, schedules and the reasoning behind them. Alarms and routing. Events and notes. Floor plans and their live bindings.

WHAT THE VENDOR KEEPS

Everything that describes the software.

The rendering, the workflow, the speed, the polish. A better product is still worth paying for. That's the point.

ExportA standard .buspkg in canonical JSON.
ImportWhat it can't enforce is preserved and reported.
ReconstructFloor plans and bindings rebuilt from the package.
Round tripHash-for-hash identical across implementations.
Conformance, stated as evidenceFull BUS-1 v0.2 Annex A suite — all 56 tests run, nothing omitted.Read the conformance statement

The Independence Test

Twelve conditions. One challengeable claim.

Can the owner change providers without losing what the building already taught them? If not, it isn't Building Independence.

  1. 01A qualified integrator other than the founder can deliver it.
  2. 02Flux assembles the evidence for one consequential question.
  3. 03Observation, inference, confidence and gaps stay distinct.
  4. 04The interpretation is in plain English.
  5. 05The owner can explain the answer and its limits.
  6. 06A qualified person reviews consequential judgment.
  7. 07The authorized owner makes the decision.
  8. 08The action is completed or consciously declined.
  9. 09Live evidence verifies whether the condition changed.
  10. 10The complete live record stays available to the owner.
  11. 11A second provider can continue without rebuilding context.
  12. 12The learning informs a later service, building or capital decision.

WHAT ISN'T HERE YET

Two things are missing, and we won't fake either.

A real operating traceBefore, action, after — from a real building, once permission and verification are complete.
A provider transferA second provider continuing the record — shown when one actually has.

CLAIM DISCIPLINE

Production Project-specific Limited deployment Prototype Roadmap

Every public capability claim carries one of these.

Security & deployment

Understand the boundary before you connect.

Deployment, connector permissions, data paths and approval boundaries — validated against your site and agreed before a project begins.

DEPLOYMENT CHOICES

Edge On-prem Your cloud Managed Hybrid

Nothing is a commitment until it's checked against your site, with a stated support boundary and your approval.

CONNECTOR BOUNDARIES

ReadExactly which sources and objects, stated up front.
WriteExplicit, bounded and project-approved — never universal.
AuthorizeHuman approval wherever the consequence requires it.
UnsupportedDeclared before conclusions are formed.
Architecture brief, questionnaire and terms at technical review

Delivery

Deployed by your integrator. Or by ours.

Own your next answer

Bring us one hard question about one building.

Four to six weeks. One accountable owner. You keep the answer and everything behind it.