The unit sits in the operator's seat of a machine already in the yard, works the joysticks, levers, pedals and switches the manufacturer fitted, and reads the dash with a camera. It never connects to the machine's CAN bus, ECU or firmware; a fused feed from the accessory point is the only wire. When it lifts out, the machine is standard again.
The conversion is a seat, a dock, the machine's own controls and one fused wire. Only the wire is electrical to the host machine.
Nothing on the unit transmits over the air, and nothing guides on a satellite. There is no fourth tier and no radio option, and technology carries that doctrine across Air, Ground, Water and Underground.
How it works carries the mechanism in full, down to the calibration the unit runs every day it works. The unit and the dock carries the hardware, the profiles and the conversion at depth.
Coming off has a procedure behind it. Before the machine is signed back, the station is put to the baseline it was surveyed at and inspected for damage or interference.
Nothing is cut, no harness is tapped and no controller is flashed. Everything the builder put in the machine stays in place and keeps working, its own safety systems included.
The interface is the human interface. A machine with no data bus, no ECU and no firmware is worked exactly like new iron, and a mixed fleet is one system rather than one program per make and year — each configuration surveyed, fitted, calibrated and recorded.
The dock stays with the machine, at its own belt anchors and pins. The unit lifts out in minutes and a crew climbs back in, with nothing to undo and no new fault codes in the shop.
Converting is a decision about a fleet before it is a decision about a machine. The plant a service already owns, already maintains and already trains on is the plant it will run.
Because the unit works the controls a person works, a yard of different makes and ages is one job of engineering repeated, not a separate development for each machine. What changes from cab to cab is the survey, the fit kit and the calibration. The architecture above them does not, and neither does the doctrine.
What that buys is bounded, and the boundary is stated rather than smoothed over. A cab is measured, kitted, calibrated and written into the record before the unit has authority to move anything in it, and the supported list grows one qualified configuration at a time. The pathway is machine-specific by construction.
No new machine is bought, freighted, stored or fuelled for the capability. What turns up is a dock, a fit kit and a unit, for iron already in the yard or already in theatre.
A machine converted for one job takes a crew again the moment the unit lifts out. Nothing is set aside for the uncrewed work, and no machine is bought twice.
Every survey, calibration, safety case, perception setup, dynamics model, operator record, skill package and service procedure stays attached to the one machine it was made on, and none of it transfers to another.
Until a machine has been through that work, the unit has no authority to move it. The unit and the dock carries the engineering the case commits to, and machines and families carries the families, the cabs behind them and what a survey asks of you.
The hardware does not change between the two. The rule set does: the tasks each may run, the movement space it may use, and the safe state it goes to when something falls outside the rules.
Responder's answer to trouble is not the answer everywhere else. The ordinary answer, when something falls outside the rules, is to hold and send for a person. Inside a structure that is still burning, or on a slope that is giving way, holding position in the open is itself an exposure. So a Responder task is given its own safe state before the call comes: withdraw to the dock line, ground the implement and hold, or run to the tether end.
Defender's half of that rule set is written as work rather than as a capability.
Responder CS-810 is written for the seats that get people hurt: fire ground, structural collapse, hazmat, flood and wildfire earthworks, rubble and route clearance for civil agencies. Every task carries its own safe state, because in a burning structure stopping to wait for a person can itself be the harm.
Defender CS-820 takes the seat for earthworks, berms and revetments, obstacle reduction, route and rubble clearance and remote handling and driving, on ground where a person should not sit. It never operates a weapon and never fires anything. It is the profile of the CDNS Defence Platform: seven machine families, and the way a force engages, on the machines it already owns.
One hardware family serves three kinds of customer. The profile and the rule set change with the role; the seat, the dock, the wired stop and the manual release do not.
Fire, rescue, hazmat and emergency-management agencies put the machine on the fire ground, the collapse or the hazmat line and leave the seat empty.
Defence engineering units, ministries and the primes acting for them work earthworks, obstacle reduction, route and rubble clearance, remote handling and driving, on ground where a person should not sit.
Municipalities and utilities convert plant they already own and already maintain for flood, wildfire, post-event access and debris and route clearance, with their own operators in their own yard.
All three run the same unit, the same dock and the same conversion, and each is entered from who it's for.
On the defence side the market is Canada first, then the Alliance: Allied forces' engineering, logistics and protected-support fleets, and every route into it starts with a screened enquiry.
Guidance runs one of three ways: loaded and sealed at the dock; a fibre tether to a person at a stand-off station; its own perception inside the same rules.
The whole task is settled at the dock and sealed there. From the moment it starts, nothing goes out and nothing comes in, so there is no emission to find and no channel to interfere with.
An optical fibre runs back to a person at a stand-off station, out of the seat and authorizing every decision that matters. A trailed fibre is a physical line, not a channel in the radio bands.
The unit does its own looking and its own planning, inside the same sealed rules. Nothing radiates outward: it works from what its own sensors take in, and asks for no channel back.
There is no fourth tier and no radio option. No radio and no satellite receiver is carried anywhere on this line, and that holds for a Responder callout in a municipality exactly as it holds for Defender on closed ground. The authorization arrives by wire or at the dock, motion commands travel on the unit's own wired network, and the safety loop is wired on its own.
Losing a link is an event with an answer written for it rather than a gap to ride out: a lost operator link produces a defined stop or a defined degrade, never a machine that carries on. Two rules hold the boundary behind that. Machine-control and safety networks stay segregated from service and mission networks. External link loss or compromise cannot create actuator authority.
Technology carries the same ladder across the fleet, program by program, in Air, Ground, Water and Underground. Defender CS-820 carries the defence configuration.
The order is fixed. It does not change with the task, the customer or the profile.
The planner proposes; the rules bound what may even be proposed; a named person authorizes each job before it runs; independent safety can only remove authority, never grant it.
Safety carries the whole architecture: the independent safety authority, the stop, lockout and the crew, and what is refused on every profile. Autonomy and machine skills carries how the line thinks, layer by layer.
Nobody in harm's way is why the line exists. What carries that principle is not a tier and not an upgrade: it ships on every unit, on both profiles.
Two of those are reached for by hand. The stop is a head at the machine that stays down once pressed, with a lanyard wired into the same path within reach of anyone working around it; either takes the energy out of every drive, and putting it back needs a person standing there. The manual release is on every actuator, in sight from the cab door, and a spring does the work, so it still releases with the air gone and the power off.
Handing the seat back is a written procedure of its own. Power is isolated, the unit's air is vented, every manual release is pulled and a named person tags the unit; then it is lifted out, the dock stays on the machine's own belt anchors, and the station is inspected before the machine is signed back.
Safety carries the architecture at full depth: independent safety and its wiring, the ranked stops and who clears each one, lockout and tagout, and what the line is built never to do.
The line is engineered and sold by machine family. Behind each family sits a controlled list of the configurations that have been surveyed, fitted, calibrated and recorded.
Excavators, dozers, loaders and graders. Hazardous earthworks, debris and rubble, fortification, route and airfield support.
Forklifts, telehandlers, material handlers and yard equipment. Remote depots, hazardous handling and resilient yard logistics, on the plant a unit already operates.
Tractors and implement carriers. Firebreaks, snow and ice, terrain maintenance and base support.
Machine families a customer names. Each follows an engineering survey and qualification of that machine.
A kit is engineered around six interface families that recur in every cab: dual-axis hand controls, rotary controls, linear foot controls, discrete switches and selectors, instrument observation, and dynamic-state sensing. Moved to a machine it was not set up for, the unit has no authority to move anything until it is set up again.
| Interface family | What it is in the cab | What the kit does with it |
|---|---|---|
| Dual-axis hand control | Joysticks and tillers | A module pins to the control and works it through the travel learned on that machine. |
| Rotary control | Steering wheels and rotary selectors | Driven from the wheel's centre through a machine-specific adapter plate, with the rim left free. |
| Linear foot control | Brake, throttle and travel pedals | Worked through the stroke and released the way the machine's own return intends. |
| Discrete control | Buttons, switches and selectors | One position at a time. On Responder and civil work the key stays a person's authority token. |
| Instrument observation | The dash, displays and indicators | A camera reads them, so the instruments are taken by looking rather than off the machine's bus. |
| Dynamic-state sensing | Attitude, external perception and linkage state | Carried on the unit, on the unit's own wiring, so no part of it is borrowed from the host. |
Which families a cab uses, and how each control is driven, is established at the survey.
The group's own 290G, D6T and 930 are the first reference iron for engineering plant.
Machines and families states the fit in full and what a survey asks of you. Operations and training walks a day with the unit in a crew.
The planner proposes inside rules it cannot edit. What it may propose is set by a package that arrives with its own entry conditions, its own envelope and its own way of giving up.
The planner reads the scene, sequences the task and offers the next move. It holds nothing of its own: it cannot energize an actuator and it cannot grant itself safety authority. Whatever it offers passes the sealed rules, then the person who approved the envelope, then the controller that measures the motion against the machine's limits.
The unit of behaviour is a machine skill package rather than a setting. Each one carries:
A signed manifest ties the package to the exact machine, hardware, software and calibration it was frozen against, and a deployment check confirms that what is running on a machine is what was released for it.
Runtime learning sits at the bottom of the authority order, and this is where that placement is felt. What it collects goes into the case for the next release and nowhere else: it has no path by which a behaviour it observed becomes a behaviour a machine runs. Promotion is by signed release only.
The technique inside a package comes from the customer's own qualified operators, captured from the seat with the unit out of it and the rig wired to nothing. What survives review is bounded by the same rules as everything else. Autonomy and machine skills carries the layer model, what the planner may never decide, and how a demonstration becomes a signed package.
The customer's own timeline for one machine, from the first measurement in the cab to the seat coming back.
The operator station is measured control by control, and the plain questions are asked beside the measurements: the work this machine is put to, the ground it is put on, and who is able to walk within reach of it.
The dock goes on the machine's own belt anchors and pins, the modules pin to the controls already there, the sensor mounts go up and the fused feed is connected. Nothing is cut, tapped or flashed.
The unit learns that cab: where neutral sits, where the limits are, and how much slack there is before the machine answers. Static checks and bounded motion under supervision follow before an envelope is accepted.
The envelope, the task and the terms for stepping in go to a qualified person, and nothing runs until they are approved. The configuration is then accepted, signed and sealed with a package to roll back to, and only skills compatible with it will load.
A person starts the machine on Responder and civil work; on Defender it may be started on a remote command from the stand-off station, on closed ground with nobody at the machine. Three things end the task: finishing it, the authorization running out, or a limit being crossed. All three put the machine into the safe state that task was given.
The unit lifts out, the operator station goes back to baseline and is inspected, and the seat belongs to a person again. The dock stays where it was fitted, ready for the next time.
Every step leaves something on the record, and the record is what makes the next machine quicker than the last. The unit and the dock carries each step at depth. Operations and training carries the shift that follows, the pre-start a named person answers on the day, and the training behind it.
A conversion does not bring a new trade onto the site. It changes where the crew stands, what they sign, and what they no longer have to sit through.
Every session begins with a person on foot at the machine: the walk-around, the pre-start, the start and the clearance are all theirs, and the unit takes the controls only once they are done. On Responder and civil work it never starts, wakes or inspects a machine.
The unit then puts every coupled control through a routine of its own, finding neutral, the limits, the slack before the machine answers, and the way each control comes back when let go. Yesterday's numbers are not reused.
An empty cab takes an operator's body language off the site, so the machine reports itself: a light tower, an indicator for which way the swing is going, and a broadband warning sound. The signal is advisory and stops nothing.
Approach sensing is wired to the safety side. A person inside the zone holds the machine and then takes it to a safe stop, and it stays there until someone at the machine clears it.
A hold handed round on a lanyard by radio is refused here. A stop that travels over the air can be late, out of range or on a flat battery, and the person holding it cannot tell which. What each person in the work area gets instead is a wired stop they can reach.
Segregation comes first and sensing is the last resort: gates, spotters, barriers and a sweep before work, with the exclusion zone drawn from the machine's reach and its swing, marked on the ground rather than only on a screen.
Training is measured by what a customer can do without the vendor. Four roles are trained, the operator, the maintainer, the depot and engineering support, with controlled publications for installation, operation, maintenance, recovery and safety behind them, so the crew that runs the machine also services and recovers the system. Operations and training carries the shift end to end, and how it works carries the mechanism behind it.
The article that is manufactured is the conversion: a survey, a kit, a calibration and a record, made and held under Canadian control.
Machine identity, and what the machine does all day and where. Then a control-geometry survey of the operator station, control by control.
The dock at the machine's own belt anchors and pins, the cradle on the seat pan, actuator modules on each control, the sensor mounts, and the fused feed.
The numbers belong to that one machine: established on it, recorded against it, and established again every day the unit works.
The configuration is accepted for its envelope, then signed and sealed with a rollback package. Only skills compatible with it will load, and the customer can show exactly what is fielded.
Control of that kind only counts if it can be shown afterwards, so every act lands on one record and nothing on it is deleted. Each entry is chained to the one before: the authorization, the configuration it was checked against, the task, the motion and the stop. Signed releases, logs, support, the configuration record, calibration and skill distribution are one controlled service, with event and maintenance logs protected.
Ownership follows the same split as authorization. The customer owns the machine and owns the hardware. The configuration and the application that turn it into Responder or Defender are Canadian Shield's, licensed and revocable, and that division makes the limits a property of the thing rather than a promise in a contract. Sovereignty carries all ten dimensions.
The line is narrow on purpose. The left column names the seats and the plant it is built for; the right names the one refusal and everything outside the scope.
Each profile has a page of its own, built to the same four parts: the mechanism, the data card, the doctrine and the deployment.
The callouts the profile is sent into, the safe state each task carries, and the data card grouped for a walk-around: interface and fit, drive and control, authority and states, security and authorization, and the standards named at design. Responder CS-810.
What the line refuses and why; the sealed rules and the leased authorization; an install and a task walked end to end; and the same grouped data card, with the export posture on its own face. Defender CS-820.
Every program on the roster carries a page built the same way, and the programs index holds all thirteen, by family.
One half is the fleet Canadian Shield designs and builds. The other half is the operator for the machines a customer already runs.
CDNS Autonomy is that operator, and it is what this property is built around; the machines for Air, Ground, Water and Underground are on the sovereign fleet.
One doctrine runs through both halves. Nothing transmits by radio and nothing guides on a link, in the air, on the ground, in the water or under it. Nothing in the fleet carries a warhead, a fuze or any energetic material: carriers, not munitions. Nothing on either half operates a weapon or fires anything. AI plans, rules govern, humans authorize, and safety has veto, whether the thing being authorized is a round on a launch chain or a unit in a seat.
What differs is who owns the machine. On one side Canadian Shield ships the machine itself, with the shop floor behind it. On this side it ships the operator for iron already in the yard.
Tell us which machines you run and which seats you would rather nobody sat in, and we will say which of them the unit can work without a wire cut into the host.
It starts with an enquiry. From there the conversation moves to the two profile pages, then to a fit assessed machine by machine and a first job scored on your own ground: whether the seat is the exposure, whether the task is fixed, and whether the ground is closed. A bounded, time-limited evaluation with support follows only after that. Nothing on this page is an offer.
Utilization is the fourth question on that first job: how much of the year the seat is filled, and how predictably. A fixed task on closed ground that comes round most weeks is where a conversion starts. A one-off on open ground is not.
Defender CS-820 carries one extra step at the front, and export control is the reason for it: an enquiry is screened before there is any discussion. Supply is subject to Canadian export permits issued per shipment, and the posture is counsel-first, so counsel comes before the permit and the permit before the shipment. Canadian Shield may decline an enquiry without giving a reason.
None of that is a commitment, and none of it speaks for any government body. No price appears anywhere on this site. Patent pending.
