Defender CS-820 is the profile of the CDNS Defence Platform: a removable operator that takes the seat of an excavator, dozer, loader, grader or wheeled vehicle already on your ground, works that machine's own controls, and lifts back out. Earthworks, clearance, remote handling and driving are examples, not a limit. It never operates a weapon and never fires anything.
On a work site under threat the most exposed place is the operator's seat. The profile puts a machine on that ground with the seat empty, on plant a defence unit already has.
Defender CS-820 is a self-contained unit that sits in the operator's seat of a machine a defence unit already owns and works that machine's own joysticks, levers, pedals and switches with its own actuators. A camera reads the dash. It never connects to the machine's CAN bus, ECU or firmware; the only wire between the two is a fused feed from the accessory point. When the job is done it lifts out, and the machine is back with a crew in minutes, standard again.
It is an operator, not a vehicle. Defender is a case and a fit kit, not a machine built from the frame up: nothing to procure, ship, park, fuel or train a crew on, for plant already in theatre or already in the yard. Older iron counts the same as new, because the interface is the human interface: if a person can work the controls, Defender can.
Responder CS-810 carries the emergency-services profile on the same dock, actuator modules and authority model; the rule set is what separates the two. The CDNS Autonomy page carries the line as a whole; the Responder page carries the sister profile. Defender is the profile of the CDNS Defence Platform: one removable operator, seven machine families, and one way a force engages.
Every task is scored the same way before the first job: whether the seat is the exposure, whether the task is fixed, whether the ground is closed, and how much the machine would work.
Earthworks on closed ground is where a defence unit starts: the task is fixed, the ground is controlled, and utilization is the highest of the five engineering tasks. Driving and protected support driving are scored on the same four columns, each in a section below. A route open to traffic is refused; operating a weapon or firing anything is refused without exception.
Protective earthworks shaped with nobody on the ground doing it: berms, cuts, revetments and fortification. The task is fixed and the ground is closed.
Clearing what closes a route or a site, on ground a machine is already built to work. Low utilization, high exposure: worth it to get a person out of the seat.
Damaged-infrastructure and debris removal, route and airfield support. Assessed job by job, and only with the route closed to traffic.
Moving and placing material or equipment from a machine's own seat with nobody in it, remote or contaminated handling included. Never with a suspended load.
Recovering a stuck or damaged asset and repairing the ground or route around it, with site remediation. Not a fixed task, so it is assessed on your own ground first.
| Task | Fixed task | Closed ground | No public traffic | Utilization | Verdict |
|---|---|---|---|---|---|
| Earthworks, berms and revetments | Yes | Yes | Yes | Moderate | Where we start |
| Obstacle reduction | Partly | Yes | Yes | Low | Worth it to get a person out |
| Route and rubble clearance | Partly | Mostly | Mostly | Low | Assess: only with the route closed |
| Remote handling | Partly | Yes | Yes | Low | Assess: no suspended load |
| Recovery and route repair | No | Mostly | Mostly | Low | Assess |
| Driving on a route closed to traffic | Partly | Yes | Yes | Moderate | Assess: the route closed end to end |
| Protected support driving | Partly | Yes | Yes | Moderate | Assess: the vehicle drives, the weapon is never operated |
| A route open to traffic | No | No | No | Low | Refused |
| Operating a weapon or firing anything | No | No | No | Low | Refused |
Every row starts from the same premise: the seat is the exposure.
Defender CS-820 takes the seat for earthworks, berms and revetments, obstacle reduction, route and rubble clearance, remote handling and driving, on the ground and the machines defence engineering already runs, military-pattern vehicles included — each surveyed, fitted, calibrated and recorded like any other machine. One thing sits outside it, and it is not a configuration a customer can request.
Defender CS-820 is an operator for the machine and for the bucket, blade or forks already on it. Human safety comes first, on every line. It never operates a weapon and never fires anything, on every machine, under every guidance tier.
The same line runs across the fleet: Canadian Shield designs carriers, not munitions, with no warhead, no fuze, no energetic material and nothing that operates a weapon. Also outside the line's scope on every profile: permanent unattended fitment, public-traffic work, and a guaranteed production rate or response time.
Driving is the seat again. A route closed to traffic, a vehicle a force already runs, and the wheel, the pedals and the selectors worked by the same unit that works a bucket.
The controls are the ones a driver uses. The unit works the steering wheel from its centre, through a machine-specific adapter plate that leaves the wheel undrilled and the rim free, and it works the accelerator and the service brake, the transmission selector, the parking brake, the range or transfer selector where one is fitted, and the switches a person reaches. Nothing is wired into the vehicle; the fused accessory feed is the only conductor that crosses.
The work is convoy and resupply on routes closed to traffic, route support, and recovery. The case is the one the bucket already makes: the seat is the exposure, and a road that has to be driven before anyone knows what is on it is a seat nobody should sit in. A route open to public traffic is refused, because a member of the public cannot consent to the risk. Neither a production rate nor a response time is guaranteed here.
A vehicle under way carries its safe state the way a working machine does, decided before the job.
A defence unit is guided one of three ways, none of them over the air. Nothing on the unit transmits, and nothing guides on a satellite.
The task program is loaded when the unit is set into the dock and runs with no link of any kind. Nothing is emitted, so there is nothing to jam and nothing to geolocate.
An optical fibre back to a person at a stand-off station: a link that cannot be jammed, by construction, and a human authorizing every decision that matters.
Perception and planning on the unit, inside the sealed rule set. No emissions, no link, no GPS. The planner proposes, the rules bound it, a person authorized the task, safety keeps its veto.
| Path | How it travels | Over the air |
|---|---|---|
| Motion commands | CAN 2.0 and Ethernet, wired | Never |
| Safety loop | Its own wired loop | Never |
| Authorization lease | By wire, or loaded at the dock | Never |
| Tier 2 command guidance | Optical fibre to a stand-off station | Never |
| Position | No GNSS aboard; onboard, local localization | None |
| Power into the machine | One fused feed from the accessory point | The only wire that crosses in |
| Radios aboard | 0 | — |
Wireless never carries the safety loop or a motion command.
There is no fourth tier and no radio option. Machine-control and safety networks stay segregated from service and mission networks. An external link that is lost or compromised cannot create actuator authority, and loss of a remote operator link ends in a defined stop or degrade, never in uncontrolled continuation. Mission runtime and safety functions execute on the unit: a bounded task continues without GNSS, a wide-area link, a cloud or an external map. The rule is fleet-wide, and no Canadian Shield design carries a radio or a GPS receiver; the autonomy page carries the layer model beneath it.
The unit does what its rule set allows and nothing else. The rules arrive sealed, and the authority to run under them is issued for a period and can be withdrawn.
Rule sets and firmware are signed; a hardware root of trust runs nothing unsigned; there is no debug access on a shipped unit. Tamper detection ends in a safe stop and a retained log, and the keys are held in Canada.
Authorization is time-limited and signed, issued and withdrawable by Canadian Shield, delivered by wire or at the dock, never by radio. Withdrawal or expiry ends in a safe stop at the next safe point, then the minimum-risk condition; the unit stays installed and will not run until re-authorized.
Each unit is configured for one machine and checks that it is on it; on any other machine it has no authority to move anything until Canadian Shield sets it up again. Wrong-side or wrong-configuration seating is blocked electronically at the armed state.
A stop wired straight into the unit's own safety controller, with no software in the path, and a manual release on every actuator: one hand, no tool. Neither is part of the lease, whatever mode is selected.
Ownership follows the same split. The customer owns the machine and the hardware; the configuration and application that turn it into Defender CS-820 are Canadian Shield's, licensed and revocable. That makes the limits a property of the thing, not a clause in a contract: Canadian Shield can withdraw the operator, and the machine under it stays yours and untouched.
On a civil site, a situation the rules do not cover means stop and wait for a person. On some ground, stopping where it stands is the harm, so the rule set does not make stopping the only answer.
Each task in the Defender CS-820 rule set carries its own defined safe state, decided with you before the job and never improvised during it: withdraw along the tether, ground the implement and hold, or complete to a defined stop line. A vehicle under way carries the same three states, chosen for the route rather than for the cut. A crossed limit is the wrong moment to decide what safe means.
The unit retires the way it came, along the fibre toward the stand-off station, and holds there.
The bucket or the blade goes to the ground and the machine holds where it stands.
Where stopping in place is the harm, the task runs on to a stop line set before the job and stops there.
Whatever the state, what follows is fixed: the minimum-risk condition, then a person is called. Where authorization was withdrawn or has expired, the unit stays installed and will not run until it is re-authorized. The physical stop and the manual release on every actuator sit outside that logic entirely. Seven authority modes, with maintenance held apart from the working chain, and five mechanical states, from standard with nothing fitted to fault-or-safe, carry every job; the safety architecture page carries each in full.
The line is engineered around seven machine families, and engineering plant comes first: the excavators, dozers, loaders and graders that dig, push, lift and grade.
The public unit is the family, not a catalogue of models. Behind each family sits a controlled list of the exact machines surveyed, fitted with their own kit, calibrated and recorded, and it grows one qualified configuration at a time. Defender CS-820 starts in engineering plant, and the first reference iron there is the group's own: the 290G excavator, the D6T dozer and the 930 wheel loader. The group's own rock truck stands behind the heavy logistics family.
| Family | Machines | What Defender does with them |
|---|---|---|
| DFC-E · Engineering plant | Excavators, dozers, loaders, graders and related equipment | Hazardous earthworks, debris and rubble, fortification, route and airfield support. Where Defender starts. |
| DFC-L · Logistics and handling | Forklifts, telehandlers, material handlers, yard equipment | Remote depots, hazardous and contaminated handling, resilient yard logistics. |
| DFC-T · Terrain and base support | Tractors and implement carriers, where a defence need exists | Firebreaks, snow and ice, terrain maintenance, base construction and support. |
| DFC-S · Specialty support | Machine families a customer defines | A specific conversion, subject to engineering survey and qualification. |
| DFC-V · Tactical and utility vehicles | Light and medium wheeled vehicles with a driver's seat: utility and tactical trucks | Driving on closed ground and on routes closed to traffic. Resupply and convoy, recovery and route support. |
| DFC-H · Heavy logistics trucks | Heavy wheeled logistics and material-movement trucks with air brakes | Resupply and material movement on closed routes. Depot, airfield and route support, and recovery. |
| DFC-P · Protected mobility | Protected wheeled vehicles and their support variants | Protected support driving: engineering support, route and resupply, casualty and recovery support. |
The seven machine families, and the work Defender does with each.
In the cab, thirteen actuator modules cover what a person's hands and feet reach, the steering wheel included, driven from its centre through a machine-specific adapter plate that leaves the wheel undrilled and the rim free. The modules run on 24 VDC family-wide; a 12 V machine gets its conversion in the fit kit. Key rotation is left out: a key is a human's authority token. A person starts the machine on Responder and civil work, every session. On Defender the machine may be started on a remote command from the stand-off station, over the tether, on ground closed to everyone the job does not need and with nobody at the machine; the authorization, the wired stop and the manual release are unchanged by it. The machines page carries every family and what the unit works in each cab, and the CDNS Defence Platform carries the platform whole.
DFC-P is a protected wheeled vehicle and its support variants, driven from the driver's station. The cab is restricted, and what the unit does in it is drive.
A protected vehicle is driven the way any wheeled machine is driven: from the driver's seat, on the controls as fitted. What is different is the room. A restricted cab governs where a module can sit and how a coupler reaches its control, so the packaging of the fit kit in that cab is settled at the survey. The support variants are surveyed the same way, one driver's station at a time.
Where the vehicle carries a weapon, the unit drives the vehicle and never operates the weapon. It never fires anything. The line's one refusal holds on every vehicle in this family exactly as it holds on a bucket.
The unit removes the crew from the seat, not from the work. A named person authorizes each job, a person supervises it, and a person at the machine can take authority away at any moment.
Onto the machine's own seat-belt anchors and pins, once, ahead of any job. Until then the machine works as it always has.
A cradle on the seat pan, the machine's own lap belt through a closed tunnel between its rails. Couplers land on the controls already there; the camera is aimed at the dash.
Each coupled control is walked through neutral, its limits and its return when released, before the first task of the day. Controls wear and no two machines are alike.
The lease arrives by wire or at the dock. A named person authorizes the job, the guidance tier is set, and the task's safe state is already in the rule set.
Until the task is done, authorization is withdrawn, or a limit is crossed. The supervising person sees the mode and authority chain, the approval envelope, the safety status, and the next planned action; under Tier 2 that person is at the stand-off station on the far end of the fibre.
The unit unbuckles and lifts out. Nothing was cut, wired or reprogrammed, and the job's record stays with the unit and reads back by wire.
Every act is on one chained record, nothing deleted: who authorized the job, what the unit was set up to do, what it did and where it stopped. Procedures, training, exclusion zones, recovery and maintenance are part of the safety system, so the site role is part of the fit: a defined work area, a person present to authorize and watch, and a person who can reach the stop. The actuator family is designed to ISO 12100, ISO 13849, ISO 17757 and ISO 19014.
Your operators teach it. Every unit arrives knowing the common machines. To teach it yours, a standalone capture instrument goes in the cab while your own best operator drives, with nothing of the unit's connected during a capture, and what it records of your machine, your ground and your way of working belongs to your unit. A behaviour that breaks an engineering or safety constraint is rejected even when an experienced person performed it, and a new skill reaches a machine only by signed release; the autonomy page carries how.
Sovereignty on this line is control and recoverability: who holds the design, who signs the software, who holds the keys, who owns the data, and who can repair and recover a unit.
Canadian Shield develops Canadian-controlled systems designed for allied integration and local sustainment. For a Defender CS-820 fitted to an ally's plant, the design authority, the signing and the keys stay in Canada, operation is local, and depot repair and secure re-image sit in Canada and in selected allies. The sovereignty page carries all ten dimensions.
Defence enquiries are screened before any discussion, because export control requires it. The screening is where the conversation starts.
Every enquiry on this line is screened. Supply is subject to Canadian export permits issued per shipment, and export posture is counsel-first. Controlled Goods Program status is disclosed to qualified enquiries.
What you send is used only to work out what may lawfully be discussed and supplied. What you tell us is stated by you, and Canadian Shield may decline any enquiry without giving a reason.
Cleared, access escalates in steps: program briefs, then an evaluation with its configuration records and integration requirements, then controlled technical data under NDA, export and security controls. The government and ministries page carries that path. Nothing on this page is an offer, a commitment or a representation to any government body.
One sequence runs from the first letter to sustainment. Each step is one a force can stop at, and none of them is an offer.
Screened before anything is discussed, because export control requires it.
Cleared, the Defender CS-820 program brief opens, with sanitised interface descriptions behind it.
One driver station at a time: the controls, the forces and travel, the mounting, the power, the machine's own safeguards.
The kit is adapted to that machine, calibrated against it, and recorded as its own configuration.
One job, scored on the customer's own ground, before anything further is discussed.
Bounded and time-limited, with support. Authorization stays a lease throughout.
The supported list grows one qualified configuration at a time, offered by family.
Operator and maintainer training, spares by family, depot repair and secure re-image in Canada and selected allies.
No price appears anywhere on this site, and a quote follows scope. How access escalates behind the screening is set out on the government and ministries page; this page carries the profile in full.
What is on the table is screening, then a fit assessed machine by machine, then one job scored on your own ground. What is not on the table is in the right-hand column.
Send the machines you run and the ground you cannot put a person on. The reply says which of them can go uncrewed with nothing cut, tapped or flashed in the host.
It starts with a screened enquiry. Cleared, it moves to the Defender CS-820 program brief, then to a fit assessed machine by machine, then to a first job scored on your own ground. A bounded, time-limited evaluation lease with support follows only after that. There is no checkout on this site, and nothing on this page is an offer.
Patent pending. Export-controlled: international transfer is subject to Canadian government permits. Designations and profile names are current as issued and are subject to change without notice. Nothing on this page is an offer, a commitment or a representation to any government body. Machine models are named only to say which machines the line works.
