Canadian Shield — Sovereign Uncrewed Systems & Advanced Manufacturing. Jam-proof autonomy in denied environments. CDNS Autonomy: the removable operator for machines already in the yard.

Sovereign Uncrewed Systems · CDNS Autonomy · Advanced Manufacturing Canadian Shield — Jam-Proof Autonomy in Denied Environments. Air · Ground · Water · Underground.

Cheap, mass-produced, no-radio interceptors and robots — built in Canada to win the cost-exchange war that exquisite systems are losing. And CDNS Autonomy: the removable operator that takes the seat of machines already in the yard, so nobody sits where the seat is the exposure.

Our Story Explore the Fleet → CDNS Autonomy → The Doctrine
Sister Platform Steady Eddie — Physical Autonomy Systems → Sister Platform Wired Industries — Wire Harness Manufacturing & Electrical Prefabrication →
The CDNS Autonomy unit on the steering wheel, the pedals and the gear levers of a military truck cab, a vehicle park beyond the windscreen.
What Canadian Shield is

Two Lines,
One Doctrine.

Canadian Shield builds sovereign uncrewed systems for contested and remote environments, and converts the machines a customer already runs into optionally uncrewed ones, engineered, manufactured and sustained in Canada.

One line is a sovereign fleet built here: Air, Ground, Water and Underground platforms that carry no weapon, and no radio and no GPS outside the two ruled mine clearance configurations. The other is an operator that takes the seat of a machine a customer already owns.

The design loop, the shop that cuts the moulds, the fire-control stack and the assembly floor all sit inside Canadian Shield. The two lines share that floor, that doctrine and that authority order. A fleet program is a machine we build. The operator is a machine we fit. Both are built to work where the radio is jammed and GPS is gone. The doctrine was written against that condition, not around it.

THE SOVEREIGN FLEET

Eleven across Air, Water and Underground

Goose CS-110 and its launch chain in the air, moulded low-signature platforms on the water, a drill and its family beneath it, and on the ground CDNS KAOS, one architecture in configurations rather than a numbered program. Carriers, never munitions, moulded in Canada on moulds cut here.

The fleet, four domains

CDNS AUTONOMY

The removable operator

The unit sits in the seat of a machine a customer already owns, works that machine's own joysticks, levers, pedals and switches, and lifts back out. Nothing is cut, wired or reprogrammed. Two profiles run on one hardware family: emergency services and defence engineering.

The unit in the seat

CDNS Autonomy

An Operator,
Not Another Vehicle.

Every other program on this site is a machine Canadian Shield builds. This one is the operator for the machines a customer already runs.

The unit sits on the operator's seat in a cradle on the seat pan, with the machine's own lap belt threaded through a closed tunnel between its rails. Actuator modules pin to the machine's own levers, pedals, rotaries and switch stations, and a camera reads the dash. Nothing connects to the machine's CAN bus, ECU or firmware, and the only wire between them is a fused feed from the accessory point.

The dock is the machine's own belt anchors and pins, and it stays behind when the unit lifts out. That takes minutes, and the machine is standard again: no integration work to buy, no new fault codes, nothing to undo. The interface is the human interface: a machine does not need electronics, a data bus or a recent model year to be worked this way, and each machine is surveyed and fitted as its own qualified configuration. It calibrates itself on every control, every day it works.

This is a machine-specific conversion rather than universal autonomy: the proposition is not that software drives any machine. Selected equipment is engineered into an optionally uncrewed configuration through removable interfaces to its own controls, independent perception, local compute, an independent safety authority and controlled machine skills, one configuration at a time. People move away from hazardous machine tasks, capital stock stays in service, and the work leans less on wide-area communications.

The CDNS Autonomy unit on a white ground: the sealed hub module with its braided lines leaving it, the wrist block beneath it, and four articulated arms running down to an actuator head with a steel pull pin and ring at the foot of each.
Two profiles, one authority order

One Unit,
Programmed Apart.

The hardware does not change between the profiles. The rule set does: the tasks each may run, the movement space it may use, and the safe state it goes to when something falls outside the rules.

Responder CS-810 is the emergency-services profile: fire ground, structural collapse, hazmat, flood and wildfire earthworks, rubble and route clearance. Its safe states are written per task in advance, because in a burning structure stopping to wait for a person can itself be the harm. Defender CS-820 is the defence-engineering profile: earthworks, obstacle and route clearance, remote handling and driving, on the machines a defence engineering unit already runs, military-pattern vehicles included. Human safety comes first, on every line.

Both run the fleet's three tiers from inside the cab, and neither carries a radio option. Rule sets and firmware ship signed. Authorization is issued for a period and withdrawn by wire or at the dock, ending in a safe stop and then the minimum-risk condition. The customer's iron is never reached by any of it.

Doctrine
It never operates a weapon and never fires anything.

Authority runs down a fixed line and the order does not change. Independent safety carries the veto and cannot depend on the planning computer for a safety action. The qualified person approves the bounded envelope and the task, and cannot bypass an independent safety condition. The motion controller executes only what was approved, task intelligence proposes and sequences without ever energizing an actuator, and runtime learning gathers evidence without promoting a behaviour of its own.

The physical stop and the manual release on every actuator always remain, in reach of the person at the machine. A person starts the machine on Responder and civil work, every session. On Defender the machine may be started on a remote command from the stand-off station, over the tether, on ground closed to everyone the job does not need and with nobody at the machine; the authorization, the wired stop and the manual release are unchanged by it. The unit never stays fitted and unattended, never works near public traffic, and carries no guaranteed production rate or response time.

HOW IT WORKS

Seat, dock, one wire

The fit, the daily self-calibration, the one wire.

How it works

RESPONDER CS-810

Seats an agency should not fill

Fire ground, collapse, hazmat, wildfire earthworks, route clearance.

Responder

DEFENDER CS-820

Ground a person should not sit on

Earthworks, berms, obstacle and route clearance, remote handling.

Defender

MACHINES

What it fits

The conversion families, and the controls a kit is built around.

Machines

AUTONOMY

How it thinks

Perception, planning, and the skills the rules allow.

Autonomy

SAFETY

How it stops

The independent safety authority, and a stop on its own energy path, separated from the task software.

Safety

OPERATIONS

How it is run

Survey, fit, calibrate, authorize, operate, return.

Operations

THE LINE

CDNS Autonomy in full

The mechanism, the profiles, and what the line will not do.

The hub page

The CDNS Autonomy unit in the seat of a tactical wheeled vehicle, its actuators on the steering wheel, the pedals and the gear levers, the vehicle's own dash untouched.
Responder and Defender

The Callouts, and the Ground.
One Operator for Both.

One removable operator, fitted two ways. Responder CS-810 takes the seat of a civil agency's fire, rescue and hazmat plant. Defender CS-820 takes the seat of an engineering unit's own iron, on ground where a person should not sit.

Both profiles run on one hardware family, on the excavator, dozer, loader, grader or tractor the customer already owns. Neither carries a radio or a satellite receiver: guidance is preset at the dock, fibre-tethered to a person at a stand-off station, or onboard optical-AI inside the sealed rule set.

The rule set is what separates them, and it is written before the work starts, never in the moment. Both refuse the same thing. Human safety comes first, on every line. Neither profile works with public traffic within reach, stays fitted and unattended, or carries a guaranteed production rate or response time.

RESPONDER CS-810

The callouts an agency cannot crew safely

Civil agencies work these on plant they already own. A guard cut ahead of a front on ground a crew would rather not stand on. A collapse worked from sound ground before anyone walks under it. Contaminated ground where the hazard is in it rather than on top of it. A breach closed out from the bank that has held. A rescue with people inside the work area is refused, and so is public-road work during a response.

The unit stays in its case until a seat needs filling, and the machine works as it always has in the meantime; the same fleet serves crewed and uncrewed work.

Responder CS-810

DEFENDER CS-820

Ground a unit should not put a person on

Five tasks on closed ground, on plant already in theatre or already on the yard, each scored the same way before any job: whether the seat is the exposure, whether the task is fixed, whether the ground is closed, and how much the machine would work. Earthworks is where a defence unit starts: the task is fixed, the ground is controlled, and utilization is the highest of the five. Defender is an operator for the machine and for the bucket, blade or forks already on it, on the ground and the machines defence engineering already runs, military-pattern vehicles included. A route open to traffic is refused. Never operates a weapon. Never fires anything.

Each unit is configured for one machine and checks that it is on it; on any other machine it has no authority to move anything until Canadian Shield sets it up again.

Defender CS-820

For a buyer the difference is the door rather than the hardware. An agency brings the callouts it cannot crew safely; a defence engineering unit brings the ground and the iron already standing on it. Both conversations run the same way: a fit assessed machine by machine, then a first task scored on the customer's own ground, and a bounded, time-limited evaluation with support only after that. The CDNS Defence Platform carries the defence side in full: Defender, seven machine families, and the way a force engages.

Safety

Nobody in Harm's Way.
A Stop That Always Works.

CDNS Autonomy takes the person out of the seat of a machine on ground where the seat is the exposure. What follows from an empty seat is answered in hardware first: the stop is physical, and safety is independent of the computer that plans the work.

The unit works the machine through the controls a person works. No harness is tapped, no controller is flashed and no manufacturer software is touched, so the machine's own safety systems stay in place and operating, the pilot control lockout lever among them. Nothing of the unit's reaches the CAN bus, the ECU or the firmware: it brings its own cameras and proximity sensing, and one fused feed from the accessory point is the only wire that crosses in.

Coming out is a written procedure. Power is isolated, the unit's air is vented, every manual release is pulled, and a named person tags the unit and proves the machine is a machine again before anyone signs it back. Human-only operation is a designed state, demonstrated at every pre-start before the unit is trusted.

THE STOP

No software in the path

A stop unit at the machine with two independent contact blocks, and a pull-lanyard within reach of anyone working around the machine wired into the same stop. Press one or pull the other and every drive is stripped of the energy that moves it. Clearing it takes a person at the machine and a separate reset.

THE MANUAL RELEASE

One hand, no tool

A manual release on every actuator, in plain sight from the cab door. A spring performs it, so it works with the air gone and the power off. Each release separates that actuator from the control it drives and leaves it free for a person to work.

INDEPENDENT SAFETY

It can only take authority away

Its own power, its own wiring, and no processor shared with the computer that plans the work. It can hold the machine, take run permission away, dump the energy and prove neutral. It cannot start the machine, arm it, grant authority or clear its own stop.

Two pedal actuators standing on a truck's own pedals under the steering wheel, braided lines along the bulkhead, the driver's seat beside them empty.

AI plans, rules govern, humans authorize, safety has veto. The planner proposes without energizing an actuator, the sealed rule set bounds what may be proposed, and a named person authorizes each job before anything moves. Authorization is a lease: time-limited, signed, issued and withdrawable by Canadian Shield, delivered by wire or at the dock, never by radio. Neither the stop nor the manual release is ever part of it.

A carried wireless stop is refused on this line, because a radio stop can arrive late, meet a jammed band, run flat or fall out of range, and the person holding it cannot tell which. Each task carries its own safe state, decided before the job and never improvised during it. The architecture is on Safety; the hardware, the dock and the conversion are on The unit and the dock.

Roles and operations

Run in a Crew.
Kept by the Same Crew.

Three kinds of customer run one hardware family: emergency services, defence engineering, and civil resilience for municipalities and utilities. The work is done where the machine is, by the crew that already runs it.

Responder CS-810 carries the emergency-services role and the municipal and utility one; Defender CS-820 carries defence engineering. The three doors are on Who it's for, and the flood, wildfire, post-event access and route clearance work a municipality or a utility runs on its own plant is on Civil resilience.

Nothing on this line is run from a room at the far end of a radio link, because there is no radio. A named person on the customer's own crew completes the pre-start, chooses whose way of working is in the seat, clears the task and can take authority away at any moment. The unit does none of those for itself. A person starts the machine on Responder and civil work; on Defender a remote start over the tether is permitted on closed ground with nobody at the machine, and the authorization, the wired stop and the manual release are unchanged. A key is a person's authority token, and key rotation is left out of the actuator set.

CREWS AND TRAINING

Trained to independence

Operators, maintainers, depot and engineering support are trained by role, with controlled publications for installation, operation, maintenance, recovery and safety. A trained operator is a safety measure the same way a wired stop is.

SUSTAINMENT

Repaired where the machine works

Serialized line-replaceable units and machine-family spares kits, calibration intervals with repair-triggered recalibration, and depot repair and secure re-image in Canada and in selected allied depots. Recovery does not need a network: signed images and recovery media are held offline for every supported field version.

THE RECORD

Proof of what is fielded

Every converted machine carries a configuration record covering thirteen domains, and a skill loads only against the configuration it was frozen for. Every act of a shift lands on one chained record, and nothing is deleted.

A way of working taught on a customer's own machine by their own operator stays theirs and goes nowhere else. The host machine carries no record of the task, and nothing on the line transmits. Operations walks a day with the unit in a crew, from the dock through calibration, authorization and the return.

WHO IT IS FOR

Operations that run their own iron

  • An agency filling the seats hardest to fill safely, with Responder CS-810.
  • A defence engineering unit working ground where a person should not sit, with Defender CS-820.
  • A municipality or a utility converting plant it already owns.
  • Each job has a defined work area and a person present to authorize and watch it.
WHAT IT IS NOT

Named before the first conversation

  • Not a remote operations centre on a radio link: authority is on the ground and the stop is at the machine.
  • Not a new vehicle to procure, ship, park, fuel or train a crew on.
  • Not permanently fitted, and not for public-traffic work.
  • Not a guaranteed production rate.
  • Never operates a weapon and never fires anything, on either profile. The line's one refusal.
The thirty-two tube launcher standing on its levelling jacks on open gravel, the tube array raised, the air receivers and hose runs along its frame, forest and mountains behind.
The lead program

The Goose System.
Nothing Aboard to Jam.

Countering small uncrewed aircraft is a manufacturing problem before it is an aerospace one. The lead round carries no battery, no motor and no guidance electronics, and its guidance is set at the barrel.

Goose CS-110 is a fully unpowered, tube-launched moulded body with barrel-set fin trim. It defeats an uncrewed target by kinetic collision alone: no warhead, no fuze, no energetic material, no receiver, no emitter, no navigation computer. A ~30 bar class pneumatic tube takes the 1.6 kg round to ~189 m/s at the muzzle, on shop air.

There is no propellant to load, no motor to spool and no arming sequence: the round is inert until the ground tank's air is behind it, and every joule spent on the ground is a joule it does not carry.

ProgramWhat it isGuidance
Goose CS-110The lead round. Unpowered, tube-launched, moulded, non-explosive.Preset at the barrel
Encapsulator CS-111A capture nose on the Goose envelope. Stored gas inflates an entangler that fouls the target's rotors, so it comes down intact.Preset at the barrel
CS-120Goose's launch chain with the power on: a tail sustain motor and bow-thruster ring.Fibre-guided

One launch chain, three programs. Every tier is no-radio and no-GPS.

The thesis is industrial rather than exquisite. The cost exchange is won on unit cost and magazine depth: on tooling, moulding and throughput. The launcher holds the energy. The round is a moulded consumable designed for volume, and a carrier in its own right: one envelope, a swappable mission-nose, one production line.

CDNS UAV Platforms → Goose CS-110
The Forward Manufacturing Cell

Don't Ship the Rounds.
Ship the Factory.

A containerized slice of the line, commissioned on an ally's own floor, so the rounds are born in-country.

A shipped round crosses the ocean once and is expended. A shipped factory crosses once, and every round after it is made where it is used: polymer body, fins and nose mass moulded on the buyer's own floor from local feedstock, local recycled PET included, then assembled around the shop-air launcher. The resupply convoy stops being an interdiction target because it stops existing.

The cell exports the low-tech, non-explosive end of the line and only that. Fire control, autonomous seekers and guidance electronics never leave Canada, nothing carries a warhead or a fuze, and no energetic material exists anywhere in it. That boundary is what makes the cell exportable. What travels is the ability to make simple things in defensible volume, which is what a partner under drone attack runs out of first. Dependence does not disappear; it narrows to the dies, the design IP and the doctrine.

Moulds and dies wear by design, and replacements are re-cut in Alberta on the same owned 5-axis machines. The cell is capital, commissioned once; the tooling, consumables, per-round production licence and service line follow it. The group has spent three decades building and running mobile horizontal-directional-drilling rigs up to 1,000,000 lb, and the cell is plant of the same kind. The cell is patent pending and controlled technology: transfer requires Canadian permits.

The Forward Manufacturing Cell along its access road: the row of containers FMC-A to FMC-D under the aisle canopy, the utilities box at the end, the fence and the proof berm beyond, drawn at true metres from the 3D model.
FMC-A with its walls dropped in the 3D model: the feedstock hoppers and dryers inside the feedstock and drying container.
Crate-out at the D end in the 3D model: sealed crates staged beside FMC-E, the red banner behind.
The Forward Manufacturing Cell →
The fleet

One Fleet,
Four Domains.

One chassis philosophy across Air, Ground, Water and Underground, with every program opening to a family page from the fleet front door. Outside the two ruled mine clearance configurations, nothing in the fleet transmits by radio, and nothing guides on a link.

Three tiers carry the whole fleet: loaded and sealed at the dock; a fibre tether to a person at a stand-off station; its own perception inside the same rules. Every platform is a carrier, and none operates a weapon. What the fleet is for, capability by capability, is set out on the capabilities page.

AIR

CDNS UAV Platforms

One pneumatic launch chain and three programs on it: an unpowered interceptor round, a capture nose and a powered premium interceptor. Nothing on the lead round can be jammed, because nothing is aboard it.

Goose CS-110 · Encapsulator CS-111 · CS-120

CDNS UAV Platforms

GROUND

CDNS KAOS

A tracked work platform that takes standardized mission modules and goes into ground a person should not. The engine charges, the motors drive, and the deck powers whatever is fitted to it.

KAOS Light · KAOS Core CS-270 · KAOS Heavy

The Ground platform

WATER

The Water family

Two moulded low-signature platforms, where the manufacturing story and the low-signature story are one. CS-310 is the survey-and-carrier hull, and CS-320 is the creeper it carries out and releases at a surveyed point.

CS-310 · CS-320

The Water family

UNDERGROUND

The Underground family

Send the robot down the hole, not the soldier: boring, tunnel reconnaissance, buried sensing and pipeline riding, on thirty years of directional-drilling heritage. CS-410 is the drill, in air-drop, skid and trailer configurations.

CS-410 · Aquifer CS-411 · CS-425 · CS-430 · Trembler Line CS-435 · CS-460

The Underground family

Every program →
The doctrine

Four Sentences.
Every Program Obeys Them.

The doctrine is not a preference. It is what a Canadian Shield design is allowed to be, settled before a drawing starts, and the doctrine page carries it in full.

DOCTRINE 01

One rule, one exception.

No radio and no GPS aboard the fleet, with the one ruled exception: the two mine clearance configurations, KAOS-MC Land and KMM-01, carry GNSS and command links, and KMM-01 also carries a marine radar and AIS to see traffic and be seen. Everywhere else nothing transmits by radio and nothing guides on a link, so there is no emission to find and no link to break.

DOCTRINE 02

Carriers, not munitions.

No warhead, no fuze, no energetic material. Nothing operates a weapon or is fitted to one. Goose defeats a target by kinetic collision; the capture tier brings one down intact.

DOCTRINE 03

Rules ship sealed.

AI plans. Rules govern. Humans authorize. Safety has veto. A rule set is signed before it ships, and a qualified person authorizes the job for a period. Where a machine can be authorized at all, that authorization is a lease: withdrawn by wire or at the dock, it ends in a safe stop.

DOCTRINE 04

Nobody in harm's way.

The seat is the most exposed place on the machine, and the hole, the highwall and the uncleared route are the ground it works. The machine can be there. The person who authorizes the work need not be.

Network segregation is the structural half. Machine-control and safety networks stay segregated from service and mission networks, an external command system asks for tasks and priorities through a gateway that passes only permitted requests, and an external link cannot create actuator authority: losing one ends in a defined stop or degrade, never in uncontrolled continuation. The three guidance tiers and the authority order are on the technology page.

Manufacturing and sovereignty

Built in Canada.
Controlled in Canada.

Sovereignty here is control and recoverability rather than the nationality of every component, and it is told as a manufacturing story: an owned shop, owned tooling, and a register behind every critical part.

For most hardware programs, injection moulding begins with a wall: an outsourced tool, a supplier's queue, an industry-typical eight weeks to a first part. Canadian Shield owns the machines and the machinists. The 5-axis cell cuts cavity, core and inserts in-house, the presses and the process engineer are on the same floor, and launcher hardware, fittings, jigs and gauges are machined in the same bay. A new platform is a new mould family on machines already owned, and every critical component sits on an approved list carrying its origin, lifecycle, lead time, export sensitivity and its substitute. Detect, track, classify and cue are built on that floor, where final assembly and inspection close the line.

Every structural part is moulded glass-filled nylon. Recycled Alberta PET is strictly non-structural, in housings, covers and the cheapest moulded bodies: real and deliberate, and never flying under load. The program runs from approximately 40,000 ft² of facility and Alberta land held within the group, ground for launch, recovery and flight trials under Class G airspace.

What is controlledWhat that means
Design authorityRequirements, architecture, drawings and release, controlled in Canada.
Software authoritySource, builds, signing and field versions. Keys held in Canada.
Data authorityDefined ownership of machine data, operator data and logs. Where a derived skill is put on the Tacit Tessera register, Even Steven owns what is made of it, for the person or company it came from, and the skill itself stays the person's.
ManufacturingNamed assemblies built, integrated and tested in Canada.
Supply chainA register of critical dependencies, each with a substitution plan.
ServiceRepair, calibration, recovery and secure re-imaging in Canada and selected allies.
Cloud and networkOperations continue without a foreign cloud, on offline artifacts and recovery media.
Update authorityOne controlled authority for any field software or model change.
TrainingOperators and maintainers trained without perpetual vendor dependence.
ConfigurationA customer can prove exactly what is fielded, down to the skill set.

Control and recoverability, dimension by dimension.

Manufacturing → Sovereignty The company
Who we work with

Three Doors.
One Screened Conversation.

A government, a prime and a supplier each need a different first conversation. Each has its own door on this site, and each opens the same way: a screened enquiry, then the briefs.

GOVERNMENT

Ministries and agencies

Sovereign, machine-specific, optionally uncrewed capability with Canadian sustainment, and a conversion evaluation program to begin it. For allies, a country-specific pilot.

The government door

PRIMES & OEMS

An integrable subsystem

An autonomy subsystem with isolated machine authority, a controlled external interface carrying mission objects, status, health and events, and a licence or teaming path. No external system gets actuator authority.

The prime and OEM door

SUPPLIERS

The sovereign supply chain

A place on an approved component list carrying origin, lifecycle, lead time, export sensitivity and substitutes.

The supplier door

A defence infrastructure contractor working an airfield or a route comes in through whichever of the three fits the work. A municipality, a utility or an agency planning for a hazard it cannot send a crew into has a door of its own, on civil resilience. Every enquiry is screened before any discussion. Defence-line business carries end-use screening, and permits where they are required. Export posture is counsel-first and permits are issued per shipment. Access escalates from this site to the program briefs, to an evaluation, then to controlled technical data, and the procurement page sets out each step. There are no prices and no checkout, and nothing on the site is an offer, a commitment or a representation to any government body.

Partners and procurement → Start a screened enquiry
A dozer on a freshly cut corridor through winter forest, seen from the air, the graded ground dark against the snow.
The conversation

Start With the Ground.
The Programs Follow From It.

Tell us the ground, the domain and the mission, and we will say which programs answer it and which do not.

It starts with a screened enquiry: what you buy, build, integrate or regulate, and the ground you are trying to hold. Cleared, it moves to the program briefs, then to a fit worked domain by domain and mission by mission, then to a bounded, time-limited evaluation with support behind it. A person answers. The conversation that counts happens before a procurement window opens.

Start a screened enquiry → Contact Canadian Shield