A fully automated ORIJO space is not one AI but a stack: a semantic nervous system, a deterministic safety kernel that owns every actuator, optimisers (MPC/RL) that propose setpoints, robots coordinated as fleets, and a remote operations centre that answers questions rather than steering. Field evidence says advanced control saves 9–21%, not 40%, and autonomy at scale still budgets human minutes (Waymo runs about one assistant per ~43 vehicles). The non-obvious advantage of ORIJO is that every module is a catalogue item: its semantic graph, emulator and fault signatures can ship in the fold passport, so commissioning labour, the main barrier to Brick, MPC and FDD adoption, disappears, and identical siblings across many sites create the labelled fault data that single buildings never have. The cautionary lessons from Freight Farms, Antarctic observatories and Gateway are that the mind must run locally, degrade gracefully for weeks, and outlive any one company or programme.
Reliable-protocol MPC/RL field savings, residential / commercial (duration-weighted)
Waymo remote-assistance agents on duty vs fleet
Unattended Antarctic observatory battery coast at ~50 W
Maturity of options assessed
Each subsystem lists the technologies the research found, with maturity, an estimated technology readiness level and the numbers that matter. Hover a TRL bar for the reason behind it.
MIND-S1 · function
Get every sensor, actuator, battery, pump, hinge lock and robot onto one addressable, self-describing data plane so that controllers and agents can be written once and reused on every ORIJO module.
How it works
Devices speak a field protocol (BACnet/IP or MS/TP for HVAC, Modbus RTU/TCP for inverters and pumps, Matter over Thread/Wi-Fi for consumer devices, CAN for battery packs). An edge gateway normalises them into a publish/subscribe bus (MQTT with Sparkplug B state-aware payloads, or OPC UA for industrial equipment) so that each point has a birth/death certificate and last-known-good value. A semantic graph (Brick ontology, ASHRAE 223P topology, Project Haystack tags) states what each point is and how equipment is connected (e.g. pump P1 feeds loop L2 that serves zone Z3), so that a fault rule or optimiser can query 'all supply-air temperature sensors downstream of this heat pump' instead of hard-coding point names. Tag systems without formal semantics drift into inconsistency; Fierro et al. showed Haystack's informal tags admit ambiguous interpretations, which motivated the formal Brick model. For ORIJO, the graph is generated from the configurator, not by a commissioning engineer, because every module and JO-PORT is a known catalogue item.
Object/property model over IP or RS-485; polled or COV subscriptions
Best for E1E2E3E4E5E6E7
Limits Weak native security (BACnet/SC fixes this, but legacy devices dominate); no semantics beyond object names [src-kaur2015, src-granzer2010]
Decades of building deployment; but security optional and often absent
IP-based application layer over Thread/Wi-Fi/Ethernet with device-type clusters; 1.5 adds tariffs, grid carbon intensity, metering, solar data, bidirectional EV charging, closures and soil sensors
Best for E1E2E7
Limits Consumer-grade scope; no ontology of plant topology; heat-pump and battery clusters not described in the 1.5 announcement [src-matter15]
Specification released Nov 2025; energy clusters only now entering certified products
Broker-based pub/sub with stateful birth/death messages and report-by-exception
Best for E1E2E3E4E5E6E7E8
Limits Broker is a single point of failure unless duplicated; semantics still external
Standard in industrial IIoT; small footprint suits 10–15 W edge PC
RDF/OWL graph of equipment, points and connections, queried with SPARQL
Best for E1E2E3E4E5E6E7E8
Limits Tooling still research-grade; models are usually hand-authored after construction [src-roa2023, src-elias2026]
Field-demonstrated for scaling ASHRAE Guideline 36 sequences; 223P newer and less deployed
MIND-S2 · function
Choose setpoints and schedules for heat, power, water, crop climate and robot tasks that minimise cost, energy and wear while honouring comfort, crop and safety constraints.
How it works
A grey-box (resistance-capacitance) or learned model predicts zone temperature, tank level, battery state of charge and crop climate over a 12–48 h horizon using weather and price forecasts; model predictive control solves a constrained optimisation every 5–15 min and applies only the first move. Reinforcement learning instead learns a policy from logged data; safe variants start from the existing rule-based policy and penalise deviation (KL regularisation, batch RL) so the first day of deployment is no worse than the baseline. DeepMind's data-centre system predicted future PUE with an ensemble of neural networks plus separate ensembles predicting temperature and pressure an hour ahead, and every five minutes sent selected actions back to the facility. Field evidence is consistently in the 9–21% savings band, not the 40% of the best-known headline, and 71% of published field demos used protocols that may give unreliable estimates. LLM agents are useful as translators of human intent into constraints and as code/model generators (e.g. auto-building MPC), but they fabricate schedules and fail commitments, so they sit above the optimiser, never in the actuation path.
Deterministic if-then sequences with trim-and-respond resets
Best for E1E2E3E4E5E6E7E8
Limits Leaves 9–21% savings on the table in field comparisons [src-luo2022, src-mulayim2025]
Industry default; the baseline every advanced controller is measured against
Receding-horizon constrained optimisation over a physics model
Best for E1E2E4E5E7E8
Limits Engineering effort per site; only 13 of 104 papers report deployment/maintenance cost [src-khabbazi2025]
104 published field demonstrations, little commercial adoption
Policy learned from data, gated by uncertainty and operator constraints
Best for E1E3E4E7
Limits Distribution drift sim-to-real; RL caused three occupant discomfort reports during adaptation [src-mulayim2025, src-liu2022]
Autonomous control in Google data centres since 2018 (TRL 8 there); two Trane-site live experiments 2022 are research trials (TRL 6–7); TRL 6 in homes
Tool-calling language model turns natural-language goals into constraints, schedules, queries and controller code
Best for E1E2E7
Limits Fabricated schedules, failed commitments and reasoning-to-action failures observed; low cost does not imply feasible behaviour [src-jonah2026]
Benchmarks and 7-day rolling simulations; no audited field deployments in actuation path found
MIND-S3 · function
Guarantee that no learned or remote command can push the habitat, robots or people outside a verified safe operating envelope, and that every failure ends in a known safe state.
How it works
A simplex-style architecture splits control into an untrusted high-performance channel (MPC, RL, LLM, remote operator) and a small trusted channel (PLC or safety microcontroller) that checks every proposed action against hard limits and falls back to a verified baseline controller. DeepMind's autonomous cooling removed low-confidence actions, checked actions against operator constraints in the cloud and again in the local control system, and failed over to a neutral state on any violation; human override always superseded AI. NASA's Gateway Vehicle System Manager uses assume-guarantee contracts specified in PlusCal/TLA+ and checked at runtime. Industrial patents now formalise 'setpoint source selection' between AI and local controllers. For robots near people, ISO 10218–1/2:2025 (which absorbed ISO/TS 15066 power-and-force-limiting content) and ISO 13482:2014 for personal care robots set the hazard analysis and force/speed limits; the ORIJO design rule is that the karakuri (unpowered) state of each fold, valve and hinge is itself the fallback.
Uncertainty gating, cloud constraint check, local re-verification, automatic failover to rules
Best for E1E2E3E4E5E6E7E8
Limits Envelope only as good as the constraint set operators write
Operating in Google data centres since 2018
Assume-guarantee contracts in TLA+ checked during development and at runtime
Best for E4E8
Limits Specification effort; programme risk [src-dabney2023, src-gateway-ifl]
Developed and verified in lab for Gateway; Gateway paused in March 2026, never flown
Local controller keeps authority; AI setpoint accepted only if it passes checks, else local setpoint used
Best for E1E2E3E4E5E6E7
Limits Patent held by Phaidra (a potential competitor/partner): design-around or licence needed [src-pat-us12326701]
Granted US patent 2025–06–10, assignee Phaidra Inc.; product deployment of this exact pattern not independently verified
Risk assessment, speed and separation monitoring, power and force limiting, protective stops
Best for E1E2E3E4E5E6E7
Limits ISO 13482 dates from 2014 and does not cover learned behaviours or teleoperation explicitly (not verified against full text) [src-iso13482]
Published standards; cobot certifications routine
MIND-S4 · function
Notice drift and failure before people do, isolate the faulty component, and decide whether to compensate, swap a module or call a human.
How it works
Rule-based AFDD encodes physics (e.g. mixed-air temperature must lie between return and outdoor air; a pump drawing power with zero flow is dead-headed). Data-driven FDD trains supervised classifiers on labelled faults, unsupervised anomaly detectors on normal operation, or hybrids; reviews classify these and consistently note the lack of labelled real-world fault data. A digital twin is a simulation model continuously calibrated against telemetry, so residuals between prediction and measurement localise faults and the same model is reused by the MPC. Katipamula and Brambley's landmark review estimated that degraded and improperly controlled equipment wastes 15–30% of energy in commercial buildings, which is the economic case for FDD. In ORIJO, every module ships with known physics and identical siblings, so fleet-wide comparison (the same KURA-3 at 200 sites) gives a far stronger anomaly baseline than any single building has.
Expert rules on sensor relationships
Best for E1E2E3E4E5E6E7E8
Limits Rule maintenance; high false alarm rates when sensors drift
Built into commercial BMS analytics products
Classifiers and anomaly detectors on BMS time-series
Best for E1E2E7
Limits Labelled fault data scarce; transfer between buildings weak [src-mirnaghi2020, src-chen2023fdd]
Hundreds of studies; few long-term field deployments
Simulation model updated from telemetry; residual-based diagnosis
Best for E1E2E3E4E5E7E8
Limits Older-building data gaps; model maintenance cost [src-cespedes2024]
21 use cases and 6 enterprise solutions reviewed; mostly pilots
ML on cyclic ECLSS processes to detect and respond to anomalies on a deep-space habitat
Best for E4E8
Limits No flight or analog validation found [src-ibrahim2025]
Simulation study
MIND-S5 · function
Let several robots from different vendors (TSURU crease-rail robots, farm gantries, cleaning and delivery robots) share doors, lifts, corridors, chargers and tasks without collisions or deadlocks.
How it works
Each vendor fleet keeps its own navigation; a fleet adapter translates it into a common API. Open-RMF holds a shared traffic schedule of predicted robot trajectories, negotiates conflicts, and treats doors, lifts and chargers as shared resources; lanes and vertices can be placed in mutex groups so only one robot holds them. Tasks (deliver, clean, patrol, charge) are bid for and allocated. VDA 5050 standardises the master-control-to-AGV message set in warehouses, and lightweight systems such as Robofleet handle secure, bandwidth-tolerant robot-to-operator links. For ORIJO, the crease rails are a pre-mapped graph, so the 'navigation' problem reduces to discrete-lane scheduling, exactly the case Open-RMF was built for.
Shared traffic schedule, fleet adapters, door/lift/charger integration, task allocation
Best for E1E2E6E7
Limits Integration effort per fleet adapter; single-site scope [src-openrmf-news, src-amrf2026]
Open source since Oct 2021; used in airports, hospitals, malls per vendor-neutral press; maintained by OSRF/Intrinsic
Standard JSON/MQTT order and state messages between fleet manager and AGVs
Best for E7
Limits Warehouse-centric; no doors/lifts negotiation [src-amrf2026]
Widely adopted in European intralogistics (not independently verified here)
Central server deduplicates and secures ROS messages over intermittent low-bandwidth links
Best for E2E3E4E5
Limits Not a scheduler; research software [src-robofleet]
Research system with field use at university scale
MIND-S6 · function
Provide the scarce human judgement that autonomy still needs, at a ratio of one person to many sites, without humans ever being in the real-time safety loop.
How it works
The autonomous system raises a structured request (what it sees, what options it considered, its confidence) to a queue; a remote agent answers with advice the system can accept or reject, rather than driving directly. Waymo runs about 70 remote-assistance agents at any time for about 3,000 vehicles across four redundant centres, and states it does not rely on remote drivers. Household humanoids invert this: 1X sells NEO at $20,000 (or $499/month) with owner-scheduled teleoperation that also collects training data, with blurring of people and owner-set no-go zones. Maritime regulators have codified the pattern: the IMO MASS Code (adopted May 2026, voluntary from 1 July 2026) centres on Remote Operations Centres while the master keeps overall responsibility. Situation-awareness research from MUNIN shows the hard part is handover: the operator must be brought into context before acting.
System-initiated requests, human answers, system decides
Best for E1E2E3E4E5E6E7E8
Limits Labour location and transparency became a Senate issue in Feb 2026 [src-waymo-futurism]
At scale in robotaxi operations
Remote human pilots robot body through cameras; data trains autonomy
Best for E1E2E7
Limits Privacy (camera feed into the home), latency, labour cost; chore autonomy 'not anytime soon' per trade press [src-1x-robotreport]
Consumer deliveries targeted 2026; no independent data on autonomy share
ROC supervises several vessels; defined responsibility and fallback
Best for E6
Limits Experience-building phase still under way [src-imo-mass]
Voluntary IMO MASS Code takes effect 1 July 2026; mandatory code targeted for adoption by 2030 and entry into force 1 Jan 2032
Teams set climate/irrigation setpoints remotely; process computer actuates
Best for E1E7
Limits Labour for crop work (pruning, harvest) still manual in the challenges [src-hemming2019]
Four Autonomous Greenhouse Challenge editions 2018–2024
MIND-S7 · function
Keep the space alive, dry and safe for days to months with no network, no visits and partial hardware failure, then recover without human intervention.
How it works
Loads are ranked into survival tiers (life safety, freeze/overheat protection, data, comfort, production); a supervisor sheds tiers as stored energy and forecast fall, and drives each subsystem into a dormant state that survives indefinitely. The PENGUIn Automatic Geophysical Observatories ran unattended at about 100 W year-round on the Antarctic plateau, with about four days of battery coast and a rule that any two of three sources (solar, wind, battery) may fail; components shut down for more than six years still worked when powered up. Halley VI now runs autonomously through winter while staff monitor it from Cambridge, UK. Deep-space habitats add communication delay and blackout: Gateway's Vehicle System Manager was designed for fully autonomous uncrewed operation with minimal ground monitoring, and NASA material cites up to 44 minutes between asking Mars a question and getting the answer. The design consequence is that every decision the habitat must make faster than the worst-case link round trip has to live on board.
Priority-ranked loads, forecast-driven shedding, freeze-safe karakuri positions
Best for E3E4E5E6E8
Limits Requires generous oversizing (factor 5 or more recommended) [src-melville2014]
Standard in remote telecom/polar instruments
Station runs autonomously in winter, monitored and adjusted remotely from home institution
Best for E4
Limits Not a habitat for people in winter; relies on summer maintenance crews [src-bas-halley]
Operational practice since the station became summer-only (BAS: runs autonomously in winter, operated remotely from Cambridge)
Distributed subsystem autonomy coordinated by vehicle-level planner, executive and fault manager
Best for E8
Limits No flight heritage for full vehicle-level autonomy [src-anderson2024, src-gateway-ifl]
Ground-tested software; Gateway paused March 2026
6-tonne module providing own heat, electricity and satellite comms for a year
Best for E4
Limits Instrument platform, not a human habitat [src-plato2009, src-plato2010]
Deployed Dome A Jan 2008, two full years of performance reported
MIND-S8 · function
Make sure the space cannot be held hostage, spied on or turned against its occupants, even though it is remotely operated by design.
How it works
ISA/IEC 62443 organises security around roles (asset owner, product supplier, integrator, service provider), a secure product development lifecycle (4–1), component technical requirements (4–2), system requirements and security levels (3–3), and patch management (2–3). Practically this means segmenting the habitat into zones (safety controller, plant control, robots, guest/occupant network, cloud) joined by conduits with explicit allowed flows; the safety controller accepts only signed setpoint envelopes and never inbound sessions. Legacy BACnet and KNX installations have weak or no authentication, and attackers now use building systems as leverage: a 2025 report describes ransomware groups threatening hospital HVAC, and Johnson Controls itself suffered a ransomware incident in 2023. Teleoperation of robots inside homes adds a privacy channel that must be consented per session.
Segmentation, least privilege, secure-by-design components, patch process
Best for E1E2E3E4E5E6E7E8
Limits Certification cost for a small company; ongoing patch obligations [src-isa62443]
Published, certifiable standard series
Edge initiates encrypted sessions; no inbound ports; site keeps operating if cloud is cut
Best for E1E2E3E4E5E6E7E8
Limits Remote assistance latency depends on the edge polling the queue
Common IIoT practice
29 projects and companies, oldest first. 6 of them closed, failed or went bankrupt; they are kept in, because investors learn more from them than from the successes.
| When | Project | What | Status | Outcome or lesson |
|---|---|---|---|---|
| 1996–2014+ (five stations operational in 2014) | PENGUIn Automatic Geophysical ObservatoriesUS Antarctic Program (Virginia Tech, UC Berkeley et al.) · Antarctica | Unmanned ~100 W year-round observatories on the plateau | shipped | Propane thermoelectric generators' exhaust ducts froze and propane will not vaporise below about -40 C (abandoned 2001); shunt regulators failed shorted; authors recommend oversizing by 5x or more and surviving any two of three source failures. melville2014 |
| 2000s-2026 | FANUC highly robotised factoriesFANUC · Japan | Highly automated plants with 'long hours of continuous unmanned machining' | active | Widely repeated claims of robots running unattended for weeks are not confirmed on FANUC's own page; only 'long hours' is stated. fanuc |
| 2003- | AASTINOUNSW · Antarctica (Dome C) | Automated site-testing observatory designed to run through winter without intervention | closed | Hybrid power plus automation can keep instruments alive through polar night. aastino |
| 2004–2025 | AeroFarmsAeroFarms · US | Aeroponic vertical farming | restructured | Went through Chapter 11 (2023) and re-emerged smaller; Fast Company May 2025 headline describes a turnaround (article body returned 403, so details unverified). aerofarms-news |
| 2005 onward | ISS Timeliner / HAL automated commandingNASA / Draper · US | Onboard automated command sequencing for ISS payloads and systems | shipped | Moving routine ground-operator functions onboard was proven on ISS from April 2005. stetson2011 |
| 2008–2010+ | PLATO robotic observatoryUNSW / Polar Research Institute of China · Antarctica (Dome A) | 6-tonne self-contained module with own heat, power and satellite comms | shipped | Two full years of autonomous performance reported; the closest existing analogue to an ORIJO KITA module. plato2009plato2010 |
| 2010–2025 | Freight Farms container farmsFreight Farms · US | Container farms controlled through the Farmhand cloud platform | failed | Ceased operations and filed Chapter 7 on 30 Apr 2025 with ~$7.0M liabilities vs ~$0.59M assets; Farmhand cloud phased out, remote access and data history lost; growers reverse-engineered controls. freightfarmsfreightfarms-ch7 |
| 2012–2015 | MUNIN unmanned bulk carrierEU FP7 consortium (Fraunhofer CML, Chalmers et al.) · EU | Concept and simulation of a 200 m bulk carrier unmanned during ocean passage with a shore control centre | closed | Shore-centre situation awareness and handover identified as the critical human-factors problem. munin2013porathe2014 |
| 2013–2019 | HI-SEAS / BASALT analog communicationsUniversity of Hawaii / NASA · US | Mars analog missions with delayed communication between crew and mission support | research | Analogs validated delay-tolerant file exchange and crew autonomy practices for deep-space comms. seibert2019 |
| 2014–2025 | Plenty vertical farmsPlenty Unlimited · US | Highly automated vertical farms | restructured | Chapter 11 on 23 Mar 2025 after ~$961M raised; Compton farm halted Dec 2024; emerged from Chapter 11 around end of May 2025 as a smaller strawberry-only operator (Richmond, VA). Automation did not fix leafy-green unit economics; post-2025 commercial performance unverified. plentyplenty-emerge |
| 2016–2018 onward | Google data-centre cooling AIGoogle DeepMind / Google · UK/US | Neural-network ensembles predicting PUE, temperature and pressure; first recommendations, then direct autonomous control every five minutes | shipped | Up to 40% cooling-energy reduction (15% PUE-overhead reduction) when ML recommendations were applied in 2016 live tests; about 30% average in autonomous mode after nine months (from 12% at launch). Lesson: savings grow with operating time; safety layers made autonomy acceptable to operators. dm2016dm2018 |
| 2016–2026 | Brick schema consortiumUC Berkeley, UCSD, CMU, Johnson Controls and others · US | Open ontology for building equipment and points; converging with ASHRAE 223P and Haystack | active | Field demonstration showed Brick can scale ASHRAE G36 sequences across buildings; adoption limited by modelling labour. balaji2016fierro2019roa2023 |
| 2016–2025 | Vertical FutureVertical Future · UK | Automated vertical farming technology | failed | Put up for sale on an insolvency market after pre-tax losses above GBP 10M (~USD 13.2M) (AgFunderNews, 31 Jul 2025). vertical-future |
| 2017–2026 | BrainBox AI autonomous HVACBrainBox AI (acquired by Trane Technologies) · Canada | Cloud AI that writes setpoints to existing BMS | active | Claims up to 25% energy and up to 40% GHG reduction across 14,000+ buildings; acquisition agreed Dec 2024 (terms undisclosed), completed start of 2025 per BetaKit; May 2026 claims of 68,000+ buildings. Lesson: supervisory AI is consolidating into HVAC OEMs. trane-bbaitrane-lab |
| 2017–2032 | IMO MASS CodeInternational Maritime Organization MSC 111 · International | First global code for autonomous ships; ROC-centred, master retains responsibility | active | Voluntary from 1 July 2026, mandatory code expected to be adopted by 1 Jul 2030 and enter into force 1 Jan 2032 (target). A ready-made regulatory template for 'remotely supervised autonomous habitats'. imo-mass |
| 2017–2026 | Halley VI winter autonomyBritish Antarctic Survey · UK / Antarctica | Relocated 23 km inland in 2017; now summer-only, runs autonomously in winter monitored from Cambridge | active | Geohazards (ice cracks) turned a crewed station into an autonomous one: autonomy is also a hedge against site risk. bas-halley |
| 2018–2026 | Waymo remote assistanceWaymo · US/Philippines | Fleet response agents answer vehicle-initiated questions; no remote driving | active | 70 agents on duty at any time for about 3,000 vehicles (~1:43 calculated; Futurism says ~1:41), about half in the Philippines. Lesson: L4 autonomy still budgets human minutes, and the public cares where those humans sit. waymo-futurism |
| 2018–2026 | Lunar Gateway Vehicle System ManagerNASA · US | Hierarchical autonomy for a station uncrewed most of the year | paused | Gateway paused/deferred 'in its current form' in March 2026 (not formally cancelled; hardware redirected to surface goals) in favour of a ~$20B surface base; autonomy software and TLA+ contracts remain reusable knowledge. anderson2024dabney2023gateway-iflgateway-req |
| 2018–2024 | Autonomous Greenhouse ChallengeWageningen University & Research (with Tencent sponsorship in early editions) · Netherlands | International teams grow crops remotely with AI setpoints in 96 m² compartments | active | Edition 1: one AI team beat the human reference; edition 2: all five did; edition 4: six algorithms all profitable on dwarf tomato. hemming2019hemming2020maree2025agc-yt |
| 2019–2026 | Phaidra industrial/data-centre AI controlPhaidra (founded by former DeepMind data-centre team members, per press) · US | Autonomous control agents for data centre cooling | active | Cited PRWeb funding release now returns HTTP 404 (unverified). Independent evidence of activity: US12326701B2 'Deterministic industrial process control' assigned to Phaidra Inc., granted 2025–06–10. Performance figures not verified. phaidra-newspat-us12326701 |
| 2019–2026 | BOPTEST benchmarkIBPSA Project 1/2 (LBNL, KU Leuven et al.) · International | Standard virtual building test cases and API for comparing controllers | active | Lets MPC/RL/LLM controllers be compared on identical emulators before touching a real building; ORIJO should publish its module emulators the same way. blum2025arroyo2022wang2023rlmpc |
| 2019 | NASA MAST frameworkNASA JSC · US | Component-based distributed hierarchical autonomy framework for spacecraft subsystems | research | Each subsystem keeps local autonomy; vehicle-level coordinator respects their independence: the right pattern for module-based habitats. badger2019 |
| 2021–2026 | Open-RMFOpen Source Robotics Foundation / Intrinsic (origin: OSRC Singapore, acquired by Intrinsic Dec 2022; Singapore-government programme origin not verified in cited source) · Singapore/US | Open-source multi-fleet traffic, door, lift and task coordination on ROS 2 | active | Proves vendor-neutral robot coordination is feasible; YouTube demos show simulated doors/lifts, real hospital footage less visible. openrmf-newsopenrmf-ytfrota360 |
| 2022 | RL control of commercial coolingDeepMind, Google, Trane Technologies · US | Live RL control of chillers at two commercial facilities | research | 9% and 13% savings: one third of the data-centre headline once moved to messier commercial buildings with constraint and sensing challenges. luo2022 |
| 2022–2025 | Matter 1.5Connectivity Standards Alliance · International | Consumer smart-home standard; 1.5 adds tariffs, carbon intensity, metering, solar data, bidirectional EV charging, soil sensors | shipped | Energy-aware residential devices become vendor-neutral; useful for ORIJO consumer appliances, not for plant topology. matter15 |
| 2023–2024 | Johnson Controls ransomware incidentJohnson Controls International · US/Ireland | Ransomware encrypted internal servers of a major BMS vendor | closed | Customer environments reportedly not affected (expert comment in Cybersecurity Dive, Sep 2023). The often-cited >$27M cleanup cost could not be verified (Dark Reading page 403; no other primary source fetched) — unverified. jci2023jci-27m |
| 2024–2025 | Residential RL vs MPC field comparisonCarnegie Mellon University / Cornell · US | Same occupied house controlled alternately by MPC and RL | research | MPC 18.1%, RL 20.9% heat-pump energy savings with overlapping CIs; RL needed about one-third less engineering but caused three discomfort reports. mulayim2025 |
| 2024–2025 | GrowyGrowy · Singapore | Automated vertical farm | failed | Winding up within a year of official launch (headline-level evidence). growy |
| 2025–2026 | 1X NEO home humanoid1X Technologies · Norway/US | Home humanoid sold with scheduled remote teleoperation to complete chores and gather training data | pilot | $20,000 or $499/month; owner approval per teleop session, people blurring, no-go zones. Lesson: teleop-first is the honest go-to-market for manipulation, but privacy is the product. 1x-engadget1x-robotreport1x-yt |
WhyCompany went into Chapter 7; cloud platform phased out, remote access and production history lost, parts and support discontinued.
Lesson for AnygroundEvery ORIJO module must run its full control stack locally, export its data in open formats (Brick + CSV/Parquet), and carry an escrowed firmware/source licence that activates on insolvency. Cloud is advisory only.
WhyHigh capex/opex vertical farms; automation did not fix unit economics or energy cost. Plenty and AeroFarms survived only by restructuring through Chapter 11 into much smaller operations; Growy wound up; Vertical Future put up for sale.
Lesson for AnygroundAutonomy is sold on labour minutes saved per kg and per guest-night, not as a technology story; the mind layer must expose that metric from day one.
Why40% data-centre cooling headline became 9–13% in commercial buildings; 71% of published field demos use protocols that may be unreliable.
Lesson for AnygroundPromise 10–20% and measure it with switch-back (A/B by day) protocols against a rule-based baseline; never quote data-centre numbers for homes.
WhyRL explored cooler setpoints early; three occupant discomfort reports.
Lesson for AnygroundWarm-start from rules (batch RL with KL penalty), hard comfort bands in the safety kernel, and shadow mode before control.
WhyExhaust ducts froze, propane would not vaporise below about -40 C; regulators failed shorted; screw terminals loosened by thermal cycling.
Lesson for AnygroundPolar ORIJO (E4) uses no combustion in the critical path, oversizes 5x, tolerates loss of any two energy sources, and uses spring-clamp terminals.
WhyA major BMS vendor's own IT (incl. ESXi servers) was encrypted; customer environments reportedly unaffected. A cleanup cost above $27M is widely reported but unverified here.
Lesson for AnygroundVendor cloud is part of the attack surface; ORIJO sites must keep operating with all vendor clouds cut, and the safety kernel accepts only signed envelopes.
WhyProgramme-level budget and architecture change despite mature autonomy work.
Lesson for AnygroundDo not tie the autonomy stack to one flagship customer or programme; build it as reusable modules (MAST-style) that move between typologies.
WhySenator Markey's inquiry and public concern (Feb 2026) over remote-assistance staffing, about half located in the Philippines.
Lesson for AnygroundPublish the human-minutes ledger and ROC locations per site; guests and residents must know when a human can see or act.
WhyReasoning-to-action failures and failed commitments under constraint conflicts.
Lesson for AnygroundLLMs never write actuators directly; their output is a proposed constraint set that a deterministic solver and the safety kernel must accept.
Newest first. Each line states the finding that the dossier relies on.
LLMs for Agentic Home Energy Management
Jonah, Moses et al. · arXiv 2607.04569 · experiment
Five LLM backends scheduling appliances vs a MILP benchmark over a 7-day rolling test: near-optimal on ordinary days but fabricated schedules and failed commitments under constraint conflicts.
Mulayim, Pergantis, Reyes Premer, Chen, Qu, Kircher, Berges · arXiv 2510.01475 · field-trial
MPC saved 18.1% and RL 20.9% weather-normalised heat-pump energy vs constant setpoint; RL needs about one-third less engineering effort.
Khabbazi, Pergantis, Reyes Premer et al. · Applied Energy 399:126459 · review
Of 104 field demonstrations, 71% used protocols that may give unreliable estimates; reliable ones average 16% (residential) and 13% (commercial) cost savings; only 13 report deployment costs.
Maree, Zhang et al. · Sensors 25(14):4321 · field-trial
In the 4th challenge, all six intelligent algorithms that fully controlled dwarf tomato achieved a profitable strategy; best reached ~45 kg/m²/year (reported), above commercial high-wire cherry tomato.
Baker, Phillips · arXiv 2503.01049 · standard
Proposes 6 levels of spacecraft autonomy deliberately parallel to automotive and aircraft levels.
A review of building digital twins to improve energy efficiency in the building operational stage
Cespedes-Cubides, Jradi · Energy Informatics · review
Systematic selection of 21 DT use cases plus 6 enterprise solutions for O&M energy efficiency.
Gateway Autonomy for Enabling Deep Space Exploration
Anderson, Badger · IEEE Aerospace Conference · model
Autonomy needed to handle long communication outages and reduce sustaining operations costs via the Vehicle Systems Manager.
Wang, Zheng, Wang et al. · Applied Thermal Engineering · model
Head-to-head RL vs MPC on the BOPTEST hydronic heat pump case (168 citations); numbers not verified here.
A review of data-driven fault detection and diagnostics for building HVAC systems
Chen, O'Neill, Wen et al. · Applied Energy 339:121030 · review
Recent comprehensive data-driven FDD review (299 citations); identifies data and transferability gaps.
Trustworthy Autonomy for Gateway Vehicle System Manager
Dabney, Badger, Rajagopal · IEEE SCC · model
VSM spans 4 function categories and levels from fully autonomous uncrewed operation to advisory automation, verified with TLA+ assume-guarantee contracts.
Cheng, Utne, Wu et al. · Reliability Engineering & System Safety · model
STPA-style analysis of human-system collaboration across two IMO degrees of autonomy (63 citations).
Controlling Commercial Cooling Systems Using Reinforcement Learning
Luo, Paduraru, Voicu et al. (36 authors) · arXiv 2211.07357 · field-trial
RL controlling real commercial chiller plants saved about 9% and 13% energy at two live sites.
Safe HVAC Control via Batch Reinforcement Learning
Liu, Balaji, Gao et al. · ICCPS 2022 · field-trial
KL-regularised batch RL starting from the rule-based policy beats existing control from day one of deployment in a real multi-zone building (savings number not captured in abstract).
Zhang, Prakash, Paul et al. · Advances in Applied Energy · field-trial
Real-world MPC coordinated HVAC, PV and battery for demand flexibility (107 citations); quantitative results not verified here.
Comparison of optimal control techniques for building energy management
Arroyo, Spiessens, Helsen · Frontiers in Built Environment · model
Benchmarks MPC, RL and hybrids on BOPTEST in a unified framework (52 citations).
Robofleet: Open Source Communication and Management for Fleets of Autonomous Robots
Sikand, Zartman, Rabiee et al. · IROS · experiment
Lightweight secure multi-robot/multi-user communication robust to intermittent low-bandwidth links.
Mirnaghi, Haghighat · Energy and Buildings 229:110492 · review
Classifies data-driven FDD into supervised, unsupervised and hybrid, recommending hybrids; 360 citations.
Cherry Tomato Production in Intelligent Greenhouses — Sensors and AI for Control
Hemming, de Zwart, Elings et al. · Sensors 20(22):6430 · field-trial
Over 6 months of cherry tomato in six compartments, all five AI-supported teams outperformed the human-operated reference (net-profit objective).
Beyond a House of Sticks: Formalizing Metadata Tags with Brick
Fierro, Koh, Agarwal et al. · ACM BuildSys · model
Shows Project Haystack's informal tags have inherent interpretability and consistency issues; proposes formally defined Brick+.
Remote Control of Greenhouse Vegetable Production with Artificial Intelligence
Hemming, de Zwart, Elings et al. · Sensors 19(8):1807 · field-trial
Five teams each remotely ran a 96 m² cucumber compartment for 4 months; one AI team outperformed the manual reference.
A Distributed Hierarchical Framework for Autonomous Spacecraft Control
Badger, Strawser · IEEE Aerospace Conference · model
MAST framework: component-based, distributed hierarchical autonomy that respects subsystem independence.
Seibert, Lim, Miller et al. · Astrobiology · field-trial
BASALT and HI-SEAS analogs validated delay-tolerant communication architectures for Mars operations.
Brick: Towards a Unified Metadata Schema For Buildings
Balaji, Bhattacharya, Fierro et al. · ACM BuildSys · standard
Introduced the Brick ontology for portable building applications (375 citations).
Implementation of model predictive control for an HVAC system in a mid-size commercial building
Bengea, Kelman, Borrelli et al. · HVAC&R Research · field-trial
Landmark full-scale MPC proof-of-concept on a multi-zone dual-duct unit (142 citations); savings figure not verified here.
Melville, Stillinger, Gerrard, Weatherwax · Review of Scientific Instruments 85:045117 · field-trial
About 100 W year-round unattended (solar, wind, batteries); ~4 days battery coast for the ~50 W instrument load; recommends oversizing by 5x or more and tolerating loss of any two of three sources.
Situation awareness in remote control centres for unmanned ships
Porathe, Prison, Man · RINA Human Factors in Ship Design · experiment
Shore-based operators of unmanned ships lose situation awareness; handover design is critical (138 citations).
The HAL 9000 Space Operating System
Stetson, Knickerbocker et al. · IEEE Aerospace Conference · field-trial
Timeliner-based automated commanding moved ground-operator functions onboard ISS from April 2005.
Performance of the autonomous PLATO Antarctic Observatory over two full years
Luong-Van, Ashley et al. · Proc. SPIE · field-trial
A self-contained robotic observatory at Dome A operated autonomously across two full years (detailed uptime not verified here).
Security in Building Automation Systems
Granzer, Praus, Kastner · IEEE Trans. Industrial Electronics · review
Building automation protocols originated when security was a side issue; analyses BACnet/KNX/LonWorks protection gaps (167 citations).
Methods for Fault Detection, Diagnostics, and Prognostics for Building Systems — A Review, Part I
Katipamula, Brambley · HVAC&R Research 11(1) · review
Degraded and improperly controlled equipment wastes an estimated 15–30% of energy in commercial buildings (1,024 citations).
Autonomy Levels for Unmanned Systems (ALFUS) framework: an update
Huang, Pavek et al. · Proc. SPIE · standard
Autonomy measured on three axes (mission complexity, environmental difficulty, human independence) rather than one ladder (134 citations).
Measured, reported, claimed, calculated or target: the basis travels with the value.
| Quantity | Value | Unit | Basis | Sources |
|---|---|---|---|---|
| Data-centre cooling energy reduction from ML recommendationsGoogle 2016; equals 15% reduction of PUE overhead | up to 40 | % | reported | dm2016 |
| PUE overhead reductionSame 2016 deployment | 15 | % | reported | dm2016 |
| Autonomous data-centre cooling savings after nine monthsDirect AI control with two-layer verification, 2018 | about 30 (about 12 at launch) | % | reported | dm2018 |
| AI decision cycle in autonomous cooling'Every five minutes' cloud AI takes snapshot and sends actions; operator constraints checked in cloud and again on site | 5 | min | reported | dm2018 |
| RL savings at two commercial cooling sitesDeepMind/Google/Trane live experiments | 9 and 13 | % | measured | luo2022 |
| MPC / RL heat-pump energy savings in one occupied house95% CIs 4.4–30.9 and 2.6–38.3; overlap | 18.1 / 20.9 | % | measured | mulayim2025 |
| RL engineering effort relative to MPC for a fresh houseAuthors' estimate | about 2/3 | ratio | reported | mulayim2025 |
| Field demos with possibly unreliable protocols24 residential + 80 commercial papers | 71 | % of 104 | measured | khabbazi2025 |
| Duration-weighted cost savings in reliable field demosMPC and RL pooled | 16 residential / 13 commercial | % | measured | khabbazi2025 |
| Field-demo papers reporting deployment/O&M costThe business-case gap | 13 of 104 | papers | measured | khabbazi2025 |
| Energy wasted by degraded/poorly controlled commercial equipmentLandmark FDD review estimate | 15–30 | % | reported | katipamula2005 |
| BrainBox AI claimed energy reduction / deployed buildingsFigures stated in Facilities Dive at agreement announcement, 20 Dec 2024 (deal closed early 2025 per BetaKit). By May 2026 BetaKit reports BrainBox claiming a network of 68,000+ buildings; all company claims, not independently verified | up to 25 / 14,000+ | % / buildings | claimed | trane-bbaitrane-lab |
| Remote-assistance agents per vehicle (Waymo)Feb 2026; four operations centres (Arizona, Michigan, two in the Philippines); agents advise, Waymo states it does not rely on remote drivers. 'Redundant' not stated in source | 70 agents on duty at any time / about 3,000 vehicles (calculated ~1:43; Futurism states ~1:41) | agents : vehicles | reported (ratio calculated) | waymo-futurism |
| 1X NEO price / subscriptionTeleoperation scheduled by owner | 20,000 / 499 | USD / USD per month | reported | 1x-engadget |
| IMO MASS Code voluntary in force / mandatory expectedAdopted at MSC 111 (13–22 May 2026). Roadmap: mandatory MASS Code adoption expected by 1 Jul 2030, entry into force 1 Jan 2032 | 2026–07–01 / 2032–01–01 | date | reported (mandatory date is a target) | imo-mass |
| Unattended polar observatory powerPENGUIn AGO, operating continuously since 1996 (five stations operational in 2014); solar + wind + batteries | about 100 | W | reported | melville2014 |
| AGO battery coast timeAbout 4 days for the ~50 W instrument load (not the full ~100 W) on new batteries; lead-acid carry-over about 2 days in wind outage | about 4 | days | reported | melville2014 |
| Recommended oversizing for unattended polar systemsBalance logistics against failure costs | ≥ 5 | x | reported | melville2014 |
| Dormant survival of shut-down equipmentAGO4 science equipment unused >6 years, worked on power-up in 2010–11 season | >6 | years | reported | melville2014 |
| Mars question-to-answer delay (worst case)NASA NTRS 20180007474 PDF could not be text-extracted; the 44-min figure was not found in the source. Physically consistent: max Earth-Mars distance ~2.67 AU gives ~22 min one-way light time, so ~44 min round trip (calculated, not source-verified) | up to 44 | min | calculated | nasa-mars-delay |
| Autonomous Greenhouse Challenge compartment / duration (ed. 1)Five teams, cucumber | 96 / 4 | m² / months | measured | hemming2019 |
| AI teams beating human reference (ed. 2, cherry tomato, 6 months)Second Autonomous Greenhouse Challenge, six compartments, six months, net-profit objective; abstract: all AI-supported teams outperformed the human-operated reference | 5 of 5 | teams | measured | hemming2020 |
| Freight Farms liabilities / assets at Chapter 7Chapter 7 filed 30 Apr 2025 (D. Mass. 1:25-bk-10908); $7,010,826 liabilities vs $593,916 assets per Official Form 206Sum; Farmhand cloud phased out | 7.01 / 0.594 | million USD | reported | freightfarmsfreightfarms-ch7 |
| Plenty capital raised before Chapter 11Chapter 11 filed 23 Mar 2025 (S.D. Texas); about $961M over eight rounds per Bondoro. Emerged from Chapter 11 about 29 May 2025 (Bloomberg Law headline via search; plenty.ag shows 'completes restructuring, emerges from chapter 11') and now focuses on Richmond VA strawberries | about 961 | million USD | reported | plentyplenty-emerge |
| NASA surface base budget after pausing GatewayIFLScience 24 Mar 2026 (amended 25 Mar): Gateway paused 'in its current form' / deferred, not cancelled; phases 2028–2030, 2031–2033, 2033–2036 | about 20 | billion USD | reported | gateway-ifl |
| Halley VI former winter crewBAS: 16 people formerly wintered; now summer-only (~40 summer staff), runs autonomously in winter, operated remotely from Cambridge | 16 | people | reported | bas-halley |
| EU Machinery Regulation 2023/1230 mandatory applicationAdds provisions for AI-powered safety functions and cyber-safety of safety control software; replaces Directive 2006/42/EC | 2027–01–20 | date | reported | ec-machinery |
Human minutes per week for this layer at each level (log bars). The unified site-level scale is on the Autonomy Stack page.
Manual. People operate every system; no remote visibility. Island operation 0 days without a person on site. MTBI not defined.
Thermostats, manual valves, paper logs
Assisted. Local rules and alarms; remote monitoring dashboard. Needs a person within 1 day for most faults. MTBI <1 day; island <1 day.
BACnet/Modbus/Matter devices, rule-based sequences, SMS alarms
Supervised automation. Optimiser (MPC/RL in shadow or advisory) sets schedules; remote human approves changes daily; robots do scripted tasks. MTBI ≥ 1 day; island ≥ 3 days with comfort maintained.
Semantic model (Brick), MPC, rule FDD, single-vendor robots
Conditional autonomy. System controls within a verified envelope and asks the ROC for advice when confidence is low (Waymo pattern); FDD isolates faults; multi-fleet robots coordinate. Human on call, response ≤ 4 h. MTBI ≥ 7 days; island ≥ 14 days.
Safety kernel + supervised RL/MPC, data-driven FDD, Open-RMF, remote-assistance queue
High autonomy. Self-heals by redundancy and module swap by robot; humans visit only for scheduled renewal (shikinen) or swap of a failed sealed module. MTBI ≥ 30 days; island ≥ 90 days (Halley-winter class).
Calibrated twin, fleet-wide anomaly baselines, crease-rail service robots, tiered load shedding
Earth-independent. No routine dependence on outside humans or networks; all decisions faster than the worst link round trip are onboard. MTBI ≥ 180 days; island ≥ 365 days (PLATO/AGO class, Mars conjunction).
Hierarchical autonomy (MAST/VSM), formal runtime contracts, 5x oversizing, onboard planning
ORIJO roadmap for this layer
Flows into and out of this layer from the synthesis, coloured by currency.
What ORIJO adopts from the state of the art, the new mechanisms this layer adds and the 12-month prototype for each, with its pass and kill criteria.
| Subsystem | ORIJO choice | Why |
|---|---|---|
| MIND-S1 | Modbus/CAN/BACnet devices → MQTT Sparkplug B on the KURA-3 edge; Matter 1.5 only for consumer appliances; Brick + 223P graph generated from the configurator and stored in each module's fold passport | Every ORIJO module is a catalogue item, so the semantic model can be auto-generated, removing the main adoption barrier of Brick. |
| MIND-S2 | Rules (G36-style) as baseline; grey-box MPC for heat/battery/water tank; batch RL warm-started from rule logs for crop climate and HVAC fine-tuning; LLM only as intent-to-constraint translator and ops copilot | Field evidence supports 13–21% savings for MPC/RL; LLM actuation is not yet safe. |
| MIND-S3 | BANSHO safety kernel (see below) on a separate microcontroller per KURA-3, with karakuri fallback positions | Same pattern that made DeepMind autonomy acceptable, applied at home scale. |
| MIND-S4 | Rule AFDD + fleet-sibling anomaly detection across identical modules; BOPTEST-style emulator per module type | Identical modules at many sites give the labelled-fault data that single-building FDD lacks. |
| MIND-S5 | ROS 2 + Open-RMF with crease rails modelled as lanes and JO-PORT chargers as shared resources | Discrete lane graph is exactly what Open-RMF schedules well; open source avoids lock-in. |
| MIND-S6 | YOBIDASHI remote-assistance queue with human-minutes ledger; teleoperation only with per-session consent | Proven at robotaxi scale and codified by IMO MASS for ships. |
| MIND-S7 | FUYU-GOMORI island mode with five survival tiers and 4–14 day coast target | Antarctic AGO and Halley VI lessons. |
| MIND-S8 | IEC 62443 zones (safety, plant, robots, occupant, cloud), outbound-only edge, signed envelopes | Building systems are now ransomware leverage. |
01 New mechanism
A small deterministic controller in every KURA-3 that owns the actuators and accepts only signed, bounded setpoint envelopes from any AI, remote human or LLM.
The kernel holds per-port hard limits (temperature bands, tank minimums, battery reserve for N island days, robot speed/force zones) compiled from the Brick graph. Each incoming command is checked against limits and rate-of-change; if the untrusted channel is silent, uncertain or violating for more than one cycle, the kernel reverts to the baseline rule controller, and if that fails to the karakuri state (valves spring-closed, hinges locked, heat-pump in frost protect). All decisions are logged to an append-only ledger visible to occupants.
02 New mechanism
Each module ships with a machine-readable Brick/223P graph and calibrated emulator; docking at a JO-PORT merges graphs automatically.
The configurator emits RDF for every module; JO-PORT contacts carry a module ID (e.g. NFC + wired 1-Wire) that the edge reads on docking, pulls the graph from the passport, and connects it to the site graph (feeds/isFedBy relations). Controllers query the merged graph, so a new YOSHI-6G greenhouse becomes controllable without commissioning labour.
03 New mechanism
Habitat-initiated requests to a remote operations centre for advice, with a public human-minutes ledger per site.
When FDD confidence or a robot planner's confidence falls below threshold, the site packages context (graph snippet, last 24 h trends, camera stills with blurring, candidate actions) into a ticket; an operator chooses or edits an option; the site validates it through BANSHO before acting. Minutes per ticket are logged to compute human_minutes_per_week, the KPI of the autonomy ladder.
04 New mechanism
Tiered graceful degradation that lets any ORIJO site run without network or visits, then recover by itself.
Five tiers: T0 life safety and freeze protection, T1 water integrity, T2 data and comms beacon, T3 comfort, T4 production. A daily energy forecast vs stored energy decides the highest affordable tier; robots park on rails at chargers; a low-rate satellite beacon reports status. Recovery replays the reverse order with self-tests.
points = sum(module_points); telemetry_bytes_day = points x 1440 samples x 8 bytes; edge_energy_kWh_day = P_edge_W x 24 / 1000; ROC_sites_per_operator = 2,400 productive min/week / human_min_per_site_week. Point counts and edge power are design assumptions, not sourced.
Substantially sound. Core quantitative evidence (DeepMind, Luo, Mulayim, Khabbazi, AGC papers, AGO, IMO, Freight Farms) matches primary sources with correct units. Main errors were status labels (Plenty and AeroFarms restructured rather than failed/pilot; Gateway paused not closed), a battery-coast figure applied to the wrong load, a Mars-delay figure not actually found in its source, and an over-stated TRL for the patented setpoint arbiter (which is Phaidra's patent). No fabricated papers or DOIs found. Three trade-press claims (JCI USD 27M, Phaidra USD 12M, Growy) remain headline-level.
Provisions for AI-powered safety functions and cyber-safety of safety-relevant software
For ORIJO: Keep learned components out of safety functions: the local deterministic kernel stays the certified safety function; ML proposes only.
Zones and conduits, secure development lifecycle
For ORIJO: Already adopted in mind dossier; required for remote operations credibility.
Raw data: /d/layers/mind.json. Search log and method: Evidence.