Porchlight

Inspiration

On May 21, 2022, a derecho crossed Ottawa at 120 km/h. More than half of Hydro Ottawa's customers lost power, and the utility even had to take its own outage map offline. Every tool people would use to ask for help (phones, routers, apps, outage maps) runs on the same grid that just failed.

The people most at risk in that moment are the ones least able to go looking for help: an older resident living alone on an oxygen concentrator, a family with an infant, someone on home dialysis. We asked a simple question: when the grid goes dark, who is still there? The answer is the neighbours. Porchlight turns a street into its own emergency network, and gives the City a clear picture of who to reach first the moment it reconnects.

What it does

One button, no signal needed. A resident has a small beacon. One press signs a call for help with the beacon's own key and sends 18 bytes over Bluetooth to the nearest neighbour's node. No app, no account, no internet.

It notices when she cannot press. The beacon detects a fall (free fall, then impact, then stillness) and calls for her after a ten second purple countdown she can cancel. It also reports quiet signs of life: it was moved, someone moved in the room (the camera judges this on the chip and the image never leaves it), and whether the lights are on.

Neighbours first. Porch Circles alert her chosen buddies first, then the whole street, then the City, only widening if nobody answers. A neighbour taps On my way, and her beacon turns green. Replies are signed, so nobody can fake reassurance. The node shows what to bring for her needs, offline.

The street holds the call through the outage. Nodes are laptops on batteries. They verify, store and gossip every signed event to each other, repairing gaps each round. When any node reaches the City again, everything it held arrives, verified again and counted exactly once.

The City sees who needs help first. The operations room shows a live 3D city. Gemini ranks open calls from anonymous references and needs, never names or addresses, and explains why. A coordinator decides. Silence is a signal: once an emergency is declared, vulnerable homes with no sign of life rise up a list, and a power dependent home whose lights go out moves up the queue.

It talks to people. An ElevenLabs voice agent calls residents in English or French, asks whether they are safe, and can request a responder. If someone says they are not safe after being marked safe, the City opens a new call. Coordinators can also talk to Porchlight: "Who needs help first?" It answers aloud and moves the map.

The City can talk back. Bilingual notices (English, with Gemini drafting the French) travel over the mesh to streets with no internet, with proof of delivery ("Reached 3 of 3 nodes"), and nodes can read them aloud.

It fits the City's existing systems. Every call, and every silent or power out home, is published as an Open311 GeoReport v2 service request, so a city's own 311 software can read Porchlight without a custom integration.

How we built it

Hardware: Arduino Nano 33 BLE Sense on the TinyML shield, with the OV7675 camera. Firmware in C++: a signed 18 byte frame with SipHash, fall detection from the IMU, rotation based motion from the gyroscope, adaptive light sensing that learns the room, and camera presence detection on the chip.
Nodes: TypeScript on Node.js. Ed25519 signed events, hybrid logical clocks, gossip with store and forward, Web Bluetooth and Web Serial to the beacon, and a neighbour console in plain HTML and JavaScript.
City: Next.js and React, with a three.js city (instanced buildings and windows, moonlit edges, pools of street light that fade with the grid, a cinematic camera) and our own design system, Lamplight, where every colour has one meaning shared with the beacon's LED.
Google Gemini: triage and ranking with structured output, plus French drafting for notices. A fallback chain across several Gemini models keeps working when one model's free quota runs out, and a rules engine takes over if Gemini is unavailable.
ElevenLabs: a bilingual resident check in agent with client tools that act on the City, and a coordinator voice copilot with ten tools (overview, dispatch, mark safe, show on map, notices and more).
Tiger Data: every event is stored in TimescaleDB, with a continuous aggregate for the live timeline, verified TLS, and a 30 day retention policy so personal data expires.
Auth0: the operations room requires sign in, fails closed if Auth0 is not configured, and coordinators use MFA.
Vultr: the City runs in Docker on a Vultr instance in Toronto, behind Caddy with automatic HTTPS.
GoDaddy Registry: our domain, leavethelighton.casa.

Challenges we ran into

Our camera mistook a power cut for a person. When the lights went out, the whole frame darkened and the beacon reported someone moving. That would have reassured the City at the exact moment she was most at risk. We fixed it by comparing each part of the picture against the frame's own brightness, skipping frames too dark to judge, and requiring movement in two checks in a row.
Desk vibrations looked like handling. We moved motion detection to the gyroscope: a table can shake a beacon but not rotate it.
Fixed light thresholds fail in real rooms. Rooms we tested read anywhere from 4 to 240. The beacon now learns each room's normal brightness and treats a large drop as lights out.
The camera would not start alongside Bluetooth. Both needed the same chip resources; starting the camera first solved it.
Free AI quotas run out during a demo. Hence the model fallback chain and the rules engine, and the interface always shows current calls immediately instead of waiting for a ranking.
Campus Wi Fi blocked our database port, so the City can run in memory when it must, and says so in its own preflight checks.

Accomplishments that we're proud of

A real, signed, end to end path from a hardware button to a City operations room, working with the internet cut.
In our simulation of 30 nodes, with a third of all messages dropped on purpose and 50 City outages, every one of 200 alerts was delivered and none were lost.
144 automated tests, including firmware tests, security tests for replayed and forged events, and a check that builds the site exactly as production does.
Accessibility by design: the whole interface is set in Atkinson Hyperlegible Next, created by the Braille Institute for readers with low vision; every status is written in words as well as colour; the 3D map has a full text equivalent; and reduced motion is respected everywhere.
Privacy by design: Gemini never sees names or addresses, camera images never leave the chip, and stored events expire after 30 days.

What we learned

Failure modes are the product. Almost everything interesting in Porchlight came from asking what happens when something is missing: the grid, the internet, a button press, a model's quota, a neighbour's answer. We also learned how much trust depends on small honest details, like a signature check on every line of the trail, or a banner that says a call was held for 100 seconds during an outage.

What's next for Porchlight

A field pilot on one Ottawa street, with residents choosing their own Porch Circles.
Raspberry Pi nodes with solar panels and long range radio (LoRa) to reach further than Bluetooth.
Working with the City's emergency management team on their existing 311 and dispatch systems through the Open311 feed.
More languages, and check ins by text for people who are hard of hearing.