The CDNS Autonomy unit's hub module on a truck's steering wheel, its arms out to the rim, the truck's own instrument cluster and switch panel behind it untouched.
CDNS Autonomy · Autonomy and machine skills

AI Plans. Rules Govern.
Humans Authorize. Safety Has Veto.

Four sentences run the line, one way. A planner that proposes. Rules that admit or refuse. A named person who authorizes each job, with an end on the approval. A safety side that can only take authority away. Its skills are taught on the group's own machines and shipped as signed packages. Local compute. No cloud, no radio, no GPS.

The safety architecture → How a skill is taught Start a screened enquiry
The order of authority

Four Sentences.
One Direction.

The doctrine is the program's constitution, and every part of the unit is built to obey it. Read the four lines as an order of authority that only ever flows down.

Anyone at the machine can take the unit's control away, at any time, with one hand. Nothing anyone can do, in any mode, removes its ability to stop. No release of this line lets a planner or a general-purpose operating system command an actuator directly.

The loop, drawn

What Proposes, What Admits,
What Signs, What Stops.

Every command runs down one stack. What thinks can be replaced; what governs, moves and protects cannot, and it sits below, out of any model's reach.

LayerWhat lives thereIts authority
Independent safetyEnergy removal, a proved neutral, the emergency pathThe veto. Not a rank in the order
Machine interfaceThe removable kit on the machine's own controlsFixed per machine, surveyed and recorded
MotionApproved primitives inside travel, rate and force limitsExecutes; cannot invent intent or widen an approval
Machine-state perceptionInstrument, control and actuator state; machine feedbackCan only remove authority
Environmental perceptionCameras, proximity; objects, free space, hazards, confidenceCan only remove authority
Localization and dynamic statePose, frames, slip, terrain; upperstructure, chassis and tool stateCan only remove authority
Task intelligenceTask decomposition, sequencing, local planning, progressProposes only
Operator means and methodsOperator capture, technique extraction, skill packagesOff the machine. No authority
Human authorityApproval, supervision, intervention, recoveryAuthorizes, with an end on it
Fleet and configuration servicesSigned releases, logs, calibration and skill distributionBy signed release only

Ten layers. The three that perceive can only remove authority; the planner can only propose; the person authorizes; safety outranks all of it.

AI plans

The Planner Proposes.
It Holds Nothing.

The task intelligence does one narrow thing: it turns an approved task into bounded actions and says when each runs out. What it cannot do is a property of how it is built, not a setting.

The planner receives an approved task and breaks it into ordinary bounded actions: a cut, a lift, a pass, a swing. Each proposal asks a control to go somewhere between the two ends of its own travel, and carries the moment it expires. It carries no force and no pressure; the planner cannot ask for a force, because it has no way to name one.

Where a skill allows a choice of technique, the planner selects among approved elements by machine state, terrain, attachment, task objective and its own confidence. A skill is a library of reviewed technique, never a synthetic operator personality, and the planner cannot compose a behaviour the package does not contain.

IT MAY

Read, propose, record

Read every sensor. Propose a bounded action into limits set below it. Record and hash the evidence. Serve the cab screen and the one approved link. Be replaced in the field.

IT MAY NEVER

Grant, restore or extend motion

No path runs from the planner to an actuator except through the rules and the motion layer. It cannot restore motion after a stop, and it cannot write to the limits a person approved.

IT MAY NEVER

Be needed for safety

No safety function credits it, the safe state is reached without it, and it holds no veto over any link. Take its power away and the stop, the hold and the return to neutral still happen.

Rules govern

Rules Small Enough
to Write Out in Full.

Fixed: the same proposal gets the same answer every time, with no model inside the decision. Sealed: signed, and not a setting the customer edits. Auditable: every admission and refusal is on the record.

A move happens only when four things are true at once: the safety side is clear, a named person has signed for this task, the action is inside the limits that person approved, and the rate, force and position clamps are satisfied. All four, on every command, or the machine does not move.

They are four separate yeses, not a ranking, because a ranking has an order and an order can be got wrong. Written out, the decision is sixteen lines, of which exactly one lets the machine move, and a decision that short can be checked line by line.

Below the rules sits the motion layer: a small dedicated controller, separate from the computer that plans, working each control on a fixed cycle the way the daily calibration taught it, inside that machine's travel, rate and force limits. A faster model makes a better decision; it does not move a lever faster.

Sealed. The rule sets and the firmware are signed. A hardware root of trust runs nothing unsigned. There is no debug access on a shipped unit. Tamper detection ends in a safe stop and a retained log, and the keys are held in Canada. The limits are the product, and they are built into the unit.

Auditable. Every command is admitted or rejected against limits a named person approved. Each decision goes into the one chained record below; a rejected command leaves the same trace as an accepted one. The Safety page carries the wired side of the same story: the independent stop and the manual release on every actuator.

The unit fitted to a military truck cab, seen from the driver's door: the wheel actuator, the lever actuators and the modules on the tunnel.
Humans authorize

A Named Person, Per Job,
With an End on It.

Prepared, installed and authorized are three different states, and only the last lets the machine move. A named person authorizes each job; the approval is bound to the plan, and it expires.

An approval carries a fingerprint of the plan it was given for, and the rules check it on every command; a plan changed after approval has every command under it refused. The approval ends at the earliest of supervision ceasing, a change to the safety software or the site model, or the end of the session.

The key that signs an approval is on a token held by the person, not on the machine, because an approval signed by the machine about to carry it out is not an approval. The order of people and parts is fixed: independent safety, then the person at the machine, then an authorized person on the fibre, then the motion controller, then the planner.

Authorization is a lease: time-limited, signed, issued and withdrawable by Canadian Shield, delivered by wire or at the dock, never by radio. Withdrawal or expiry ends in a safe stop at the next safe point and then the minimum-risk condition. A de-authorized unit stays installed and will not run; the host machine is never touched.

Every session begins with a person on foot at the machine, who walks it around and completes the pre-start. A person starts the machine on Responder and civil work, every session. On Defender the machine may be started on a remote command from the stand-off station, over the tether, on ground closed to everyone the job does not need and with nobody at the machine; the authorization, the wired stop and the manual release are unchanged by it. A key is a human authority token. The person supervising sees the mode and authority chain, the approval envelope and what ends it, the active skill and revision, calibration and perception health, the safety status and the next planned action; a controlled stop is theirs regardless of what the planner is doing. The Operations page follows that person through a working day.

Perception without emission

It Looks at the Ground.
It Sends Nothing.

The unit brings its own eyes and never uses the machine's sensors or its bus. Cameras on a calculated ring, an optical read of the dash, inertial sensing. Nothing aboard radiates a radio signal.

Eight cameras sit on a ring, and the ring is a calculated geometry: count, height and downward tilt set so that every patch of ground from the edge of the blind disc at the machine's feet out to the visibility circle for a machine of its class is seen, the outer part by two cameras at once. Seven lenses would cover the ground but leave much of it to one lens, and a single lens goes blind the moment it is dirty; the eighth takes most of that away, and anything seen by two lenses has a distance and not only a bearing.

A camera high on a machine cannot see the ground at its own feet, so the geometry leaves a blind disc at the centre of rotation and says so. That disc is why the near band exists: nothing may be in it when the unit is armed, and the rule, not the camera, keeps it clear.

Every camera reads its whole frame at once, because a camera that reads line by line bends a straight post into a lean when the cab shakes, and that shear corrupts calibration. Each window reports whether it is blocked on every frame, because a camera looking at mud still produces a picture: a confident picture of nothing.

The dash, read optically. One camera in the cab reads the instrument cluster: engine running, temperature, fuel, the fault lamps. No wire enters the machine to ask. A fixed set of lamps with fixed meanings is easier to read correctly than a printed number. It can stop the unit. On Responder and civil work it can never start the machine.

It is required to know when it cannot see. A frozen window is treated as worse than a lost one. Each sensor is read alone and combined late, so that when one fails the unit can say which. When the cameras disagree or the weather takes them, perception does the one thing it may do with doubt: it takes authority away.

Radios and GNSS receivers aboard: 0. The one link that can leave the unit is an optical fibre, and only under the tether tier. Nothing is emitted, so there is nothing to jam and nothing to geolocate.

The state it keeps

Which Way Is Up, Which Way It Points,
Where the Tool Is.

A machine on a slope, swinging a load, is not the machine it was on the flat. Heavy-equipment autonomy needs a state estimate closer to what an experienced operator perceives, and the unit keeps one.

Two inertial units, not one: one in the cab, one on the chassis. On an excavator they differ by the swing and the cab's mount, and treating them as one puts the bucket's edge badly out. The swing angle and each cylinder's length are measured directly. Upperstructure attitude is never silently substituted for chassis attitude. Localization is onboard and local, with no satellite fix anywhere in the solution, and a value is used only if its age is known.

Unknown state is a valid state. The unit is allowed not to know, and when the quality of its state falls below the threshold set for a skill, the task system slows, stops, asks a person to look, or refuses the skill. A machine can be locally collision-free and still be unsafe: slope, slip, load, hydraulic response, swing inertia, tool contact, ground failure or an uncertain chassis orientation each make it so, and none shows in a picture of clear ground.

The space around the machine is read as bands.

None is a stop by itself: each band raises a request, the safety side answers it and keeps the veto, and each band's reach is set per machine from its survey. The exclusion zone drawn on the ground stays what protects a person on foot; the plan is the gates, the spotters and the barriers, never the sensing.

Three tiers, no radio

Preset. Fibre-Tethered.
Optical-AI.

The line runs the fleet's three no-radio guidance tiers from inside the cab: preset at the dock, fibre-tethered with a person in the loop, or planned onboard inside sealed rules. There is no fourth tier and no radio option.

TIER 1

Preset at the dock

The task program is loaded when the unit is set into the dock, the machine's own belt anchors and pins, and it runs with no link of any kind. Nothing is emitted or received while it works.

TIER 2

Fibre-tethered, a person in the loop

An optical fibre back to a person at a stand-off station: command guidance that cannot be jammed, by construction, with a person authorizing every decision that matters from outside the seat.

TIER 3

Optical-AI, sealed

Onboard passive perception and planning inside the sealed rule set. No emissions, no link, no GPS. The planner proposes, the rules govern, a person has authorized the task, and safety keeps its veto.

The order of authority does not change between tiers. Under the tether, a lost link causes a defined stop or degrade, never uncontrolled continuation, and a lost or compromised link cannot create actuator authority. The machine-control and safety networks are segregated from anything external: an external system requests tasks, areas, priorities or supervisory actions through a mission gateway that passes only permitted request types. Nothing at the far end of a fibre has a path to a valve. The Technology page sets out the fleet-wide architecture.

The CDNS Autonomy unit in the seat of a tactical wheeled vehicle, its actuators on the steering wheel, the pedals and the gear levers, the vehicle's own dash untouched.
Machine skills

Taught on Our Own Machines.
Shipped as a Package.

A machine skill is controlled learning from demonstration, never self-training: captured from qualified operators on the group's own machines, reviewed, frozen against an exact configuration, and shipped as a signed package with a revision.

The group's own 290G, D6T and 930 are the first reference iron, and a skill starts there, with an operator in the seat and the unit out of it. A standalone recording instrument with its own sensors, logger and power takes down what the operator's hands did and what the machine did back. It is wired to nothing on the machine and nothing of the unit's, and nothing it produces reaches any control path.

A dash camera records the display and the operator's hands, hashed into the session chain with the data. Every session carries the operator's authorization and usage rights, with the machine configuration and data provenance recorded.

Step 1

Capture

Several qualified operators perform one narrowly defined task on a controlled configuration; control inputs, actuator and instrument state, pose, hazard context, task phase, corrections and aborted attempts are recorded.

Step 2

Segment and extract

Each demonstration is cut into task phases and machine-state transitions, and the features of technique come out: approach geometry, sequencing, control timing, rate shaping, dwell and recovery.

Step 3

Compare and reject

Operators are compared for the common successful structure, the legitimate variation and the bad habits. Any behaviour that violates an engineering or safety constraint is rejected, even from an experienced hand.

Step 4

Package

The reviewed technique becomes a machine skill package with its entry conditions, limits, abort conditions, required perception confidence and expected outputs written in.

Step 5

Prove

Replay and simulation where useful, then bench and static-machine runs, then bounded field runs under a qualified person with independent safety authority present.

Step 6

Freeze and sign

Frozen against the exact machine, hardware, software and calibration configuration, and promoted only by signed release. Runtime learning gathers evidence for the next revision; it cannot promote itself.

A skill is versioned and licensed. Each package carries an identity and revision, its long-term support branch, and the configurations it applies to and is excluded from. The hardware is the customer's; the configuration and application are Canadian Shield's, licensed and revocable. The Operations page carries the licensing model and the training.

How a skill is bounded

A Task, a Movement Space,
and a Safe State.

One hardware family, programmed apart. What separates the profiles is the rule set: the tasks each may run, the movement space it may use, and the safe state it goes to when something falls outside the rules.

An earthmoving machine has no route. Its operating domain says what must not happen, and anything it does not name is excluded, because a domain that includes what it forgot permits anything nobody thought of. Site hazards are declared rather than sensed, and a declaration expires.

Field of the packageWhat it fixes
IdentityThe skill's name and revision
ApplicabilityThe configurations it may run on, and the ones it is excluded from
Hardware and software baselineThe exact kit and release it was frozen against
CalibrationThe calibration state the skill assumes
Entry conditionsWhat must be true before the first action is admitted
Operating envelopeSpeed, slope, visibility, confidence, force and rate, distance
BehaviourThe reviewed technique the planner may select from
Degrade and abortWhat it does when state quality falls, and the safe state it goes to
EvidenceThe demonstrations and checks each element traces to
IntegrityA signed manifest and hash, checked for compatibility at deployment

Every machine skill package. The manifest is checked against the machine's configuration record when the skill loads; what runs is what was signed.

Each task carries its own safe state. On Defender CS-820: withdraw along the tether, ground the implement and hold, or complete to a defined stop line. On Responder CS-810: withdraw to the dock line, ground the implement and hold, or run to the tether end, because in a burning structure stopping and waiting for a person can itself be the harm. Which applies is set by the task, never in the moment. Every package contains abort and degraded-state logic, and the safe state is proved by measured neutral, pressure and position, not by the command that asked for it.

Seven authority modes, from OFF to AUTONOMOUS with MAINTENANCE held apart, and five mechanical states, from OEM to FAULT/SAFE, are set against each other as a grid: every square is allowed or forbidden, and each forbidden square is a check the machine must be shown to fail. Outside the line's scope on every profile: permanent unattended fitment, public-traffic work, and a guaranteed production rate or response time.

Local compute

No Cloud. No Radio. No GPS.
Nothing Leaves the Machine.

Mission runtime and the safety functions execute on the unit. A supported release operates and recovers without any network, any foreign service or any external map.

0
radios or GNSS receivers aboard
1
wire to the machine: a fused accessory feed
4
yeses before any move
10
layers, veto to release
Dependency removedWhat continues
GNSSA bounded local task continues on onboard localization
Wide-area radioThe local machine task runs without a continuous command link
CloudMission runtime and safety functions execute on the unit
An external mapLocal perception builds the task-relevant representation itself
A foreign serviceA supported release operates and recovers locally
The remote operator linkLoss causes a defined stop or degrade, never uncontrolled continuation

Specific functions continue without specific dependencies; the first two rows name things the unit never carried.

The safety wiring is not on a network at all, so a safety function cannot inherit a network's failures. Between the unit's own modules, communication is CAN 2.0 or Ethernet, wired only; wireless never carries the safety loop or a motion command. One link leaves the machine and stops at the data side: a stop never travels over it, a grant of motion never crosses it, an approval crosses only signed, and a configuration change only logged.

Running offline is not a cyber posture on its own, so the unit carries one: secure and measured boot where the hardware supports it; signed firmware, software, model and calibration packages; time-bounded service access through a connector that is dead while the machine can move; offline update with authenticity, compatibility and rollback checks; protected event and maintenance logs; key provisioning and rotation; and a controlled recovery image. Model weights, calibration assets, skill manifests and maps are controlled configuration items, the same as firmware. Signed images, dependency mirrors and recovery media are kept for every supported field version.

The record

A Later Entry Can Add.
It Cannot Rewrite.

Every act on one chained record: approvals, admissions and refusals, interventions, calibrations and releases, hashed and linked, on the machine and off it.

The record is what turns humans authorize from a sentence into a procedure. Every approval goes in with the fingerprint of the plan it was bound to and the moment it ends. Every intervention goes in, the authorized ones as well as the rest, because what has to be provable afterwards is that the machine still conforms after a change made by the people who built it. Nothing is deleted; a later entry can add to the record and cannot rewrite it.

Safety-relevant sequences are counted in beats of the controller and in no other clock. A beat count cannot be adjusted or reached from outside the machine, while a timeout on a wall clock can be defeated by moving the clock. The record carries both clocks and says which it is using. The record of who authorized what is kept where the day-to-day log cannot overwrite it, and it verifies with a public key alone, off the machine.

Tamper detection ends in a safe stop and a retained log. A capture session is hashed into its own chain. The record of a task stays with Canadian Shield rather than with the machine, and who owns machine data, operator data, derived skills and logs is defined in the terms.

Behind it sits the machine's configuration record, in thirteen domains: host platform, human controls, machine kit, energy, the computer, sensors, harness, software, calibration, skills, safety, maintenance and release. It is how a customer proves exactly what is fielded on a given machine.

What autonomy is not

Never an Engagement.
Never a Weapon.

The line drives and works the machine it is fitted to, on any ground the customer needs it: earthworks, obstacle reduction, route and rubble clearance, remote handling, and the civil seats agencies should not fill. There is no strike branch in the planner.

Defender CS-820 and Responder CS-810 are carriers and operators, never munitions. Human safety comes first, on every line. The unit never operates a weapon and never fires anything. Weaponization is not a product decision: the task vocabulary has no engagement in it, and the rules admit nothing the domain does not name. The Defender page and the Responder page carry each profile's scope in full.

What the intelligence may never decide, because the system gives the models no way of expressing it:

A site can be put into a human-only mode in which no unit holds authority. Lift the unit out and the machine is standard again, in minutes.

Update authority

Signed Releases.
Keys Held in Canada.

Nothing unsigned runs on a machine that can move. Learning happens off the machine, is reviewed by a named person, and reaches a unit only as a signed release, by wire or at the dock.

The key that signs a release lives offline and is used at release only, so getting into a machine cannot produce signed software. Development, test and production signing are separate; source, builds, signing and field versions are under Canadian control; the authority that can approve a field software or model change is named; the keys are held in Canada. A new perception or planning model earns its seat through four gates.

Step 1

Signed

The model, its weights, its training origin and its interface are signed, and the signature is checked before the file is mapped into memory. Unsigned software loads only in MAINTENANCE, with the actuators released.

Step 2

Fits, and can say stop

It must fit its interface, keep to its share of time and memory, give the same answer to the same input, and be able to say stop; a model whose only output is a trajectory is ruled out on that point.

Step 3

Shadowed

It runs beside the model it would replace, with no authority, its outputs recorded and thrown away, until it has agreed with the incumbent for long enough to trust.

Step 4

Swapped at a beat

Both models stay loaded and the swap happens at one beat of the controller, so no frame is handled by both; the swap drops the approval, and a person signs again.

Nothing learns on the machine and no weight changes itself in the field. Runtime learning gathers evidence, drift and operator demonstrations for the next revision; it cannot promote a new behaviour. Updates arrive the way authorization does, by wire or at the dock, checked for authenticity, compatibility and rollback before they apply.

Who it is for

Three Readers, Three Questions.
And What the Line Is Not.

An integrator asks whether it can be wired to their own system, a policy adviser whether the authority chain can be explained, and a safety authority whether it stays inside its rules.

WHO IT IS FOR

Who this was written for

  • A prime's integrator who needs an autonomy subsystem with isolated machine authority: an external system talks to a mission gateway in task vocabulary and has no path to a control or safety network.
  • An engineering authority converting plant it already owns: excavators, dozers, loaders and graders; forklifts, telehandlers and material handlers; tractors and implement carriers; customer-defined families.
  • A policy adviser who needs an authority chain that can be explained: a named person per job, rules small enough to print, a planner that only proposes, a record that cannot be quietly changed.
  • A civil resilience agency with seats it should not fill, and a defence engineering unit with ground where a person should not sit: Responder and Defender.
WHAT IT IS NOT

What it is not, on any profile

  • Never operates a weapon and never fires anything. The line's one refusal.
  • Not a universal system. A machine-specific supported configuration, added one qualified machine at a time, each surveyed, fitted, calibrated daily and recorded.
  • Not a new vehicle and not a cloud service. It travels as a case and a fit kit, and everything it needs to run and recover is aboard.
  • Not left fitted and unattended, not for public-traffic work, and not sold with a guaranteed production rate or response time.
Short answers

For the Engineer, the Integrator,
and the People Who Can Say No.

The whole page in four short paragraphs, each written for a different desk.

THE EVALUATING ENGINEER

What runs, and where

A replaceable planner proposes into fixed rules; an independent safety side holds the veto. Eight cameras on a calculated ring, an optical read of the dash and two inertial units carry the state. No radio, no GNSS, no cloud; the one link is fibre, under the tether tier only.

THE PRIME'S INTEGRATOR

How it connects to yours

Through a mission gateway, in task vocabulary: tasks, areas, priorities and supervisory actions, with mission objects, status, health and events coming back. Your side has no path to the control or safety networks, and a lost or compromised link cannot create actuator authority. The external interface is a controlled document, released after screening.

THE POLICY ADVISER

Why it can be explained

Every job is authorized by a named person, the approval is bound to the plan by a fingerprint and expires, the rules that admit a command fit on a page, and the record of every act is chained and verifiable off the machine. Nothing in it aims, engages or strikes.

THE SAFETY AUTHORITY

Where the stop lives

Not on this page. The physical stop and the manual release on every actuator, the independent energy path, and the reasons a wireless stop is not offered are on the Safety page.

The conversation

The Rules Fit on One Page.
Bring the Ones You Have to Explain.

The conversation starts with which machines you already run, which tasks would take a person out of the seat, and which tier the ground allows.

Every enquiry is screened before any discussion, because export control requires it. Supply is subject to Canadian export permits issued per shipment, export posture is counsel-first, and Controlled Goods Program status is disclosed to qualified enquiries. Nothing on this page is an offer, a commitment or a representation to any government body. A screened enquiry opens the partner tier: the program briefs, the external interface and the supported-configuration conversation. The CDNS Autonomy hub carries the whole line.

Start a screened enquiry → Contact Canadian Shield The CDNS Autonomy hub

Patent pending. Export-controlled: international transfer is subject to Canadian government permits. Nothing on this page is an offer, a commitment or a representation to any government body.