The CDNS Defence Platform is the defence side of CDNS Autonomy. The operator is removable, the machines and vehicles are the ones a force already fields, and the controls it works are the ones their manufacturers fitted. Human safety comes first, on every line. It never operates a weapon and never fires anything.
The platform is not a vehicle to procure and not a system to install. It is an operator for the iron a force already has, and a rule set for defence work.
The seat is the exposure. On a route being opened or a resupply run down an uncleared track, the machine can be replaced and the person in it cannot. The platform takes that seat: a unit on the operator's seat under the machine's own lap belt, working the joysticks, levers, pedals, wheel and switches the manufacturer fitted and reading the dash with a camera. It never connects to the CAN bus, the ECU or the firmware; one fused accessory feed is the only wire, and it lifts out in minutes.
The fleet a force already owns is the fleet the platform runs. Nothing is procured, freighted, parked or fuelled: what arrives is a survey, a fit kit, a dock and a unit. Older iron counts the same as new, because the interface is the human one.
One profile carries the defence work. Defender CS-820 is the rule set: the tasks it may run, the movement space it may use, and the safe state it goes to when something falls outside them. Seven machine families describe the iron. Defender CS-820 carries the profile; Machines and families carries all seven in full.
A case and a fit kit for plant and vehicles already in service. The same iron takes a crew again the moment the unit lifts out.
Human safety comes first, on every line. CDNS Autonomy is a carrier and an operator, never a strike platform: it never operates a weapon and never fires anything. That is the line's one refusal.
No radio and no GPS sits in any Canadian Shield design. A task is preset at the dock, run on an optical fibre, or planned onboard inside sealed rules.
The architecture above the cab does not change from machine to machine. What changes is the survey, the kit, the calibration and the safety case for that configuration.
| Common to every family | Set for that one machine at the survey |
|---|---|
| The unit: its body in a cradle on the seat pan, under the machine's own lap belt | Mounts, couplers and an adapter plate cut for that steering wheel |
| The authority order, ranked, with a limit written into every layer | The operating envelope the machine's own limits allow |
| An independent safety energy path, separated from the task software | Stroke, force and travel limits, established control by control |
| A wired stop with no software in the path, and a manual release on every actuator | The daily calibration sweep, and which controls it walks |
| One chained record, with nothing deleted | The Machine Configuration Record for that machine |
| Sealed rules and a leased authorization, signed and time-limited | The safety case, per machine, per task, per configuration |
| Thirteen actuator modules and six interface families at 24 VDC | Which of the six the cab carries, and a conversion for a 12 V machine |
The core is engineered once; the kit is engineered per machine, and that work is what a machine engineering fee covers.
That split is what keeps a mixed fleet from becoming a separate development for every vehicle in it. A tracked excavator, a heavy truck and a protected vehicle present different controls in different geometry, and all resolve into the same six interface families: dual-axis hand control, rotary control, linear foot control, discrete control, instrument observation and dynamic-state sensing.
Until a machine has been surveyed, fitted, calibrated and recorded, the unit has no authority to move anything in it, and the supported list grows one configuration at a time. How it works carries the mechanism in the cab.
The public unit is the family, never a machine model. Behind each family sits a controlled list of the exact machines surveyed, fitted, calibrated every day they work, and recorded.
| Code | Family | Machines | The work |
|---|---|---|---|
| DFC-E | Engineering plant | Excavators, dozers, loaders, graders and related equipment | Hazardous earthworks, debris and rubble, fortification, route and airfield support |
| DFC-L | Logistics and handling | Forklifts, telehandlers, material handlers and yard equipment | Remote depots, hazardous and contaminated handling, resilient yard logistics |
| DFC-T | Terrain and base support | Tractors and implement carriers where a defence need exists | Firebreaks, snow and ice, terrain maintenance, base construction and support |
| DFC-V | Tactical and utility vehicles | Light and medium wheeled vehicles with a driver's seat | Driving on closed ground and closed routes; resupply and convoy; recovery and route support |
| DFC-H | Heavy logistics trucks | Heavy wheeled logistics and material-movement trucks with air brakes | Resupply and material movement on closed routes; depot, airfield and route support; recovery |
| DFC-P | Protected mobility | Protected wheeled vehicles and their support variants | Protected support driving: engineering support, route and resupply, casualty and recovery support |
| DFC-S | Specialty support | Machine families a customer defines | A specific conversion after an engineering survey and qualification |
Machine and vehicle classes, not models. What sits behind a family is a controlled list that grows one qualified configuration at a time.
A family is the answer to a narrower question than autonomy: whether the line will take the seat of the excavator on the berm, or of the truck on the resupply leg. The platform answers machine by machine and offers the answer by family, because what accumulates behind a family is machine-specific and does not travel: interfaces, geometry surveys, calibrations, safety cases, perception configurations, machine dynamics, operator data and skill packages.
Light and medium wheeled vehicles with a driver's seat. The unit drives them from the controls a driver uses, on ground and routes closed to traffic.
A driver's station resolves into the same six interface families as a cab on a tracked machine: the wheel a rotary control, the pedals linear foot controls, the selectors and switches discrete controls, the instruments read by looking. The wheel is driven from its centre through an adapter plate cut for it, back-driveable through a mechanical torque limiter, with wheel position sensed independently.
Every task in this family runs on closed ground or a route closed to traffic. A route open to public traffic is refused, because a member of the public cannot consent to the risk.
Heavy wheeled logistics and material-movement trucks with air brakes. Everything the tactical and utility family works, plus the controls a heavy truck adds.
A heavy truck adds controls a light vehicle does not have, and every one is still a control the manufacturer fitted for a person to reach. Heavier steering and pedal loads are a finding of the survey, established before a kit is cut.
The work is resupply and material movement on closed routes, depot, airfield and route support, and recovery: the mission where the load is worth moving and the cab is exposed while it moves. The group's own rock truck is the reference machine for this family, and every truck that follows it is surveyed, fitted, calibrated and recorded on the same path.
Protected wheeled vehicles and their support variants, driven from the driver's station. The work is protected support driving on ground where the seat is the exposure.
A protected cab is a packaging problem before it is a controls problem. The driver's controls are the ones the unit works, as fitted, and how the modules sit around them in a restricted station is a finding of the survey: reach, clearance, and the space a mount can occupy.
The work is protected support driving: engineering support to a working party, route and resupply legs, casualty support and recovery support, on ground where the seat is what a threat reaches first. Those tasks run closed to traffic and closed to everyone the job does not need.
Where a protected vehicle carries a weapon, the unit drives the vehicle and never operates the weapon, and it never fires anything. Weaponization is not a product decision.
Three families carry the plant defence engineering already runs, and the first reference iron behind them is the group's own.
Excavators, dozers, loaders and graders, for hazardous earthworks, debris and rubble, fortification, and route and airfield support. The first reference iron is the group's own 290G excavator, D6T dozer and 930 wheel loader.
Forklifts, telehandlers, material handlers and yard equipment, for remote depots, hazardous handling and resilient yard logistics. The group's own forklift stands as the wheeled-steering survey machine.
Tractors and implement carriers where a defence need exists, for firebreaks, snow and ice, terrain maintenance and base construction. The controls that matter run the implement: the hydraulic valve bank and the power take-off.
The specialty family exists so a customer is never told its machine sits outside the conversation. A family a customer defines is approached through its controls: the survey establishes which of the six interface families are present, how each is driven, and what the fit kit carries. Machines and families carries these three cab by cab.
Defence engineering, driving, material movement, protected support, and terrain and base support. Each is scored before any job, on ground closed to everyone the job does not need.
The five Defender tasks: earthworks, berms and revetments; obstacle reduction; route and rubble clearance; remote handling; recovery and route repair.
Convoy and resupply on routes closed to traffic, route support and recovery, on the tactical, heavy and protected families.
Depot, airfield and yard handling on logistics plant, remote and contaminated handling included, with the crew outside the exposure.
Protected support driving: engineering support, route and resupply legs, casualty and recovery support, from the driver's station.
Terrain and base support sits beside those four: firebreaks cut ahead of a fire, snow and ice cleared off a working surface, base construction supported. Repetitive work, on ground about to become dangerous, under a clock.
The scoring is the same for all five: whether the seat is the exposure, whether the task is fixed, whether the ground is closed, and how much of the year the machine would work. A route open to public traffic is refused on every family, and neither a production rate nor a response time is guaranteed.
Driving is new work for this line and old work for the seat. The exposure is the person behind the wheel, and the route puts them there.
A convoy leg, a resupply run, a recovery and a route-support move share one shape: a known start, a known finish, a route agreed in advance, and a cab that is the most exposed thing on the vehicle for the whole of it. The unit drives that leg from the driver's controls, on a route closed to traffic, under authority granted in advance by a named person and withdrawable at any moment. What a moving vehicle needs that a static machine does not is a safe state that holds while it is rolling, decided before the job.
The vehicle comes to rest on the route and holds where it stands, where stopping in place is safe.
Where stopping in place is itself the harm, the leg runs on to a stop line agreed before the job and no further.
Where a fibre tether is in use, the vehicle retires the way it came, toward the stand-off station, and holds at the end of it.
Whatever the state, what follows is fixed: the minimum-risk condition, then a person is called. Uncertainty changes permissible behaviour, so a leg run in falling visibility runs under a narrower envelope or not at all, and loss of an authorized link ends in a defined stop or degrade. Safety carries the architecture behind it.
A conversion starts at one operator station, not at a fleet. The survey settles the kit, the limits, and whether that machine belongs on the supported list.
What is measured.
What is decided.
Commissioning closes the survey rather than following it: control zero, travel, force and rate maps and neutral proof; static diagnostics and fault injection; then bounded motion under supervision before an envelope is accepted. The configuration is then signed and sealed.
The Machine Configuration Record then covers thirteen domains: host platform, human controls, machine kit, energy, compute, sensors, harness, software, calibration, skills, safety, maintenance and release. A customer can show exactly what is fielded. Operations and training carries the shift that follows.
One sequence, and it runs the same way whether the enquiry names an excavator, a truck or a protected vehicle. Nothing on this page is an offer.
Every enquiry on this line is screened before any discussion, because export control requires it.
Cleared, it moves to the Defender CS-820 program brief and the sanitised interface descriptions behind it.
The survey: the station, the controls, the forces and travel, the mounting, the power, the machine's own safeguards.
The dock goes on the machine's own belt anchors and pins, modules pin to the controls already there, and the configuration is sealed.
One job scored on the customer's own ground, against the four questions every task is scored on.
Bounded, time-limited, with support. A commercial arrangement, not the authorization a machine's motion runs under.
Configurations are added one at a time, each surveyed, fitted, calibrated and recorded.
Operator and maintainer training, spares by family, and depot repair and secure re-image in Canada and selected allies.
No price appears anywhere on this site. Access escalates in steps: capability, sanitised architecture and manufacturing posture here; program briefs after screening; configuration records and integration requirements under agreement; drawings, bills of materials and restricted technical data under NDA, export and security controls. Government and ministries sets out that path, and the Defender page carries the profile in full.
The market of this line is Canada first, then the Alliance of 32 members. Canada is where the evidence is made. The Alliance is where one qualified configuration is reused, force by force and family by family.
Canada is the anchor. The ground, the machines, the survey, the safety case and the record are all here, under Canadian design authority, and the first configuration package is made on the group's own iron. What comes out of it is an evidence package about one machine and one control set, and that package is what travels. The Alliance is thirty-two forces with the same classes of machine in their engineer units, their depots and their convoys, so a driver's station proven once is worth more than one machine.
The customer class is an Allied force's engineering, logistics and protected-support fleets: the engineer regiments and logistics commands whose seats this line empties, the ministries and capability desks above them, and the primes and national integrators acting for either. The routes in are the ones the Alliance publishes for industry and a Canadian supplier uses: the NATO Front Door for Industry, the Innovation Ranges and DIANA, the Innovative Solutions Catalogue, the NATO Engine and supplier registration with the NATO Support and Procurement Agency, and consultation through the NATO Industrial Advisory Group. Each is a route open to a Canadian supplier and a place a force meets industry, and the verdict on this line belongs to a customer, on ground that customer owns.
NATO and Allied forces carries the market at full depth: why an Alliance fleet fits this line, what the Alliance asked for in July 2026, the routes, the eight steps a ministry walks, the seven families by class and the standards taken interface by interface. Government and ministries is the door itself, for a Canadian ministry and an Allied one alike, and every route into it starts with a screened enquiry.
A prime integrates the autonomy behind one controlled interface and keeps isolated machine authority. An OEM takes the architecture under licence, in co-development, or built into its own product.
A prime's own command-and-control system reaches a mission gateway over a wired or at-the-dock interface, in a fixed high-level vocabulary of mission objects, status, health and events. Nothing else crosses. External systems never get actuator authority, and there is no direct network path to motion or safety.
Integrated into the prime's own platform behind the controlled external interface, or taken on as a subcontracted capability inside the prime's own program.
The architecture, or a defined subsystem of it, under field-of-use and IP terms. Hardware stays the customer's; the configuration and application remain Canadian Shield's, sealed and revocable.
Its terms sit in the licence itself. No informal cross-use of source, models or drawings outside it, and every integration carries an engineering and a legal review.
A controlled external interface document covering mission objects, status, health and events opens after screening, and none is released without an export-control assessment and a publication decision. Offline-first operation does not eliminate cyber risk, so the interface sits inside a wider program: signed firmware, software, model and calibration packages, role-based service access, and offline updates with rollback checks. Primes and OEMs carries the three routes in full.
Sovereignty on this line is control and recoverability rather than the nationality of every component, and it is answered against ten named dimensions.
The ten are design authority, software authority, data authority, manufacturing, supply chain, service, cloud and network, crypto and update authority, training, and configuration. They hold together or not at all: design authority without software authority leaves a system drawn here and changed elsewhere. Critical dependencies are registered with substitution plans, and named assemblies are built, integrated and tested in Canada.
Export posture is counsel-first. Controlled goods leave Canada only under permits issued per shipment by Global Affairs Canada under the Export and Import Permits Act, and a permit cannot be pre-committed. Controlled Goods Program status is disclosed to qualified enquiries. Designs on this line are patent pending, and nothing here is an offer or a commitment to any government body. Sovereignty carries all ten dimensions.
Both halves matter to a capability desk: the forces and the iron this is built for, and the one refusal that no configuration and no contract can change.
The first letter names three things: the machines and vehicles already in service, the work that has to be done on them, and the ground you would rather nobody sat on. Screening comes before any of it is discussed.
Cleared, it moves to the Defender CS-820 program brief, then to a fit assessed machine by machine, then to a first job scored on your own ground against the same four questions every task on this line is scored on. A bounded, time-limited evaluation lease with support follows only after that, and the fleet follows family by family.
A reply names the family each machine belongs to, what the unit would work at that station, and what fitting it involves.
