FailSafe

Inspiration In the 2018 Camp Fire, county staff tried to phone about 1,500 disabled and elderly residents to warn them. The fire moved too fast and they had to abandon the calls. One elderly client on oxygen told a caregiver, "Honey, I'm on oxygen. No one will hear." In the 2025 Eaton Fire, 18 of the 19 people who died were in West Altadena, and their average age was 77.

The pattern repeats in every disaster. Alerts go out, but the people most at risk are the ones least able to act on them: older adults living alone, people with Alzheimer's or dementia who may not remember an evacuation order, people who can't take the stairs, and people who depend on powered medical equipment. Meanwhile phone lines flood. In Hurricane Harvey, 911 took 56,000 calls in 17 hours.

In LA County alone, that is 190,300 seniors with Alzheimer's or dementia, about 500,000 people with a mobility disability, and 67,311 Medicare patients who rely on electricity-powered medical equipment. We wanted to build the voice that already knows them before the crisis, and calls them first when it comes.

What it does FailSafe is one voice platform with two modes.

Every day, it's a companion. FailSafe calls older adults and people with Alzheimer's, disabilities or chronic illness for a short check-in. It asks how they're feeling, whether they took their medicine (self-reported, never medical advice), and reads them messages from family. Families get a short summary, not a transcript, and a missed check-in shows up for them. Over time FailSafe learns what each person needs in an emergency: their language, their barriers, their equipment and who to contact.

In a crisis, it triages at scale.

Reach them first. When a wildfire or outage hits a zone, FailSafe calls the enrolled people inside it and asks about their own situation, like "How long will your oxygen run on battery?" or "Can you get down the stairs?" Answer the public. Anyone can call the hotline. Routine questions like "When is power back?" are answered on the spot without creating a case, so urgent callers aren't stuck behind them. One ranked queue. Every call becomes a case ranked by need: danger first, then battery left versus the outage estimate, then barriers like living alone or not being able to drive. A human operator sees the person's own words and presses Accept. Priority comes from need, never from who pays. When the cell network is down, neighbors still find out. Phones and lobby screens relay a signed Bluetooth Low Energy help signal: I'm OK, I need help, device on battery, or emergency. If Helen slips in her bathtub and tells FailSafe she can't get up, it tells her to call 911, alerts the crew, and sends a BLE alert to the neighbors she enrolled. Ravi in 4C taps "I'm going," and both the crew and Helen's family see it. Neighbors are volunteers, never dispatched. (The BLE radio and hardware are simulated in our demo.)

FailSafe is not a replacement for 911. It never dials or transfers to 911, and it tells anyone in danger to call 911 themselves.

How we built it Voice: Retell AI runs the phone calls, both outbound check-ins and crisis calls and the inbound public hotline. Mid-call tools let the agent look up the outage and the caller's profile while it's talking. Backend: Python and FastAPI. When a call ends, a webhook sends the transcript to an LLM that turns it into structured fields: device, battery runtime, danger, barriers. A keyword safety net in English and Spanish sits behind the LLM, so a missed detail can only raise a case, never hide one. Ranking: a frozen, tiered policy that ranks danger first, then battery runway against the outage ETA, then life-sustaining devices with unknown runtime, then barriers. Safety checks: an audit of the agent's own words that flags false reassurance and confirms it told the caller to call 911 when needed. Outbound calls only go to an allowlist, with caps and consent. If someone doesn't answer, FailSafe retries once, then creates one "Unreachable" case and alerts their family. Operator and family views: a crew dashboard with the ranked queue and a map of cases, outage zones, lobby screens and community hubs, plus a family page with summaries and alerts. BLE layer: signed advertisements with rotating IDs, relayed by support stations like lobby screens and church or school hubs. Screens show a unit number or street only and hold no keys. Testing: 650+ automated tests and a set of labelled synthetic calls, including Spanish, to check extraction. All demo data is synthetic, and the utility, Metro Power & Light, is fictional. Challenges we ran into Making the AI safe to trust in an emergency. A voice agent that sounds calm can accidentally sound reassuring. We had to make sure it never promises help is coming, never gives medical advice, and always tells people in danger to call 911. We built an audit that checks every call against those rules. Not losing anyone to a bad transcript. LLM extraction is good but not perfect. We added a bilingual keyword backstop and a rule that later checks can only raise a case's priority, never lower it. Silence is a signal. In a disaster, the person who doesn't pick up may be the one in the most trouble. Deciding how many retries, when to escalate and who to tell took real thought. Ranking fairly. It was tempting to let paying customers go first. We decided priority comes only from reported need, and we built the ranking so a subscription can't change it. Privacy on shared screens. Lobby screens and community hubs are public, so they show a unit number or a street and distance, never a name or a condition. Accomplishments that we're proud of A working end-to-end system: real phone calls through Retell, live extraction, a ranked crew queue, family alerts and a public hotline, all in one platform. It's multilingual from day one, with English and Spanish built into both the calls and the safety checks. 650+ passing tests, plus guardrails that are enforced in code, not just written in a policy. A design that works for many kinds of vulnerability, not just one. Our demo follows Maria on oxygen, but the same call captures memory loss, a wheelchair, a chronic illness or living alone. A business model where families pay for the everyday companion and agencies fund crisis mode, so the people most at risk are already enrolled when disaster hits. What we learned The hardest part of disaster response isn't sending the alert. It's knowing who can't act on it, and that has to be learned before the crisis, not during it. A daily companion call is what makes crisis mode work. People answer a voice they already know. In a safety product, the guardrails are the product. "Never replaces 911" and "priority by need" shaped almost every design decision. Older adults and people with disabilities don't fit one profile. Asking about barriers in their own words beats any checkbox. What's next for FailSafe Pilots: start with a senior housing building and a local aging or disability services agency, running the daily companion call first. Real BLE hardware: move from a simulated radio to real lobby screens and community hubs that work when cell towers are down. More languages and regions: the engine is already multilingual, so we want to add more languages and regional settings like local emergency numbers and alert channels, so it can run in other countries. Agency partnerships: connect with utilities, counties and emergency services so crisis mode has live outage zones and ETAs instead of synthetic ones. Security and privacy review: prepare for real health-adjacent data before any live deployment.