CDNS Autonomy converts a machine you already own by putting a removable operator in its seat. The unit belts in on the machine's own lap belt, works the joysticks, levers, pedals and switches the manufacturer fitted, and reads the dash with a camera. One fused accessory feed is the only wire that crosses into the machine.
The unit is restrained by equipment the manufacturer already fitted. Nothing new stands at the operator station, because there is no room for it.
The unit's body sits on the operator's seat. A cradle rests on the OEM seat pan and the machine's own lap belt threads through a closed tunnel between the cradle's rails. The belt runs fore and aft rather than across, because nothing fits across.
The console side is carried separately. Four legs stand in pinned receiver pockets on anchor blocks that land in threads the machine already has, and the legs take 3/8 in pins with ball-lock retainers. A bridge across the legs carries the pod head, which slides for height and is set with a two-piece M8 clamp collar. The height that suits a given cab is recorded in that machine's own profile.
The whole installation is mechanical. Nothing is welded and nothing is drilled, and every part of it is built to come off again and move to the next machine. The families it has been engineered for are set out on Machines and families.
Every actuator pins to a control the machine already has. The families cover what a hand and a boot reach for, and the survey of the cab decides which it needs.
The modules are one set of families adapted to a machine's configuration by slide-and-set and calibration, rather than by keying a part to a position. Detented levers take the gate module, continuous-arc levers take the tiller module, and the fit survey decides which, machine by machine.
Steering is driven from the centre of the machine's own wheel through an adapter plate cut for that wheel. The wheel is not drilled and the rim stays free for a pair of hands. The drive is back-driveable through a mechanical torque limiter, wheel position is sensed independently, and the adapter engages the wheel rather than the column.
Two controls are handled differently on purpose. Key rotation is excluded from the actuator set, because a key is a human's authority token and not a step for a machine to take. The parking-brake control may be applied and released through a higher-integrity module, under a completed safety case for that machine and with independent confirmation of the brake's state. Defeating it, or using it as the unit's stop path, is not done.
| Interface family | What it works on the machine |
|---|---|
| Dual-axis hand control | Joysticks and tillers |
| Rotary control | The steering wheel and rotary selectors |
| Linear foot control | Brake, throttle and travel pedals |
| Discrete control | Buttons, switches and selectors |
| Instrument observation | The dash, the displays and the indicators |
| Dynamic-state sensing | Inertial state, external perception and linkage position |
The six interface families the kit is engineered around. Thirteen actuator modules cover them across the fleet.
The unit brings its own sensing and reads the instrument cluster the way an operator reads it. Nothing taps the dash and nothing rides the machine's bus.
A camera is aimed at the dashboard. Gauges, warning lights and displays are read optically, so the instrument cluster is observed rather than depended on. A machine that publishes nothing on a bus is as readable as one that publishes everything.
Perception is onboard and passive. The unit carries its own cameras and its own proximity sensing and never borrows the machine's sensors. There are no radios and no satellite receivers aboard, so what guides a task is what the unit can see for itself.
Attitude is measured on the unit's own instruments. A passive reflective band on the carbody, read by one camera looking down at it, gives the angle between the house and the tracks optically, so nothing touches the machine's own swing electronics. On a machine that rotates, upperstructure attitude is never quietly substituted for chassis attitude, and the band is what keeps the two apart.
Sensing has one job and one direction. External sensing may remove authority, and it never creates it. What the perception stack is allowed to propose, and how a skill is bounded before it runs, is set out on Autonomy and machine skills.
Instrument observation replaces bus dependence. The unit takes what an operator takes, through a lens.
The whole electrical boundary between the unit and the machine is a single fused accessory feed. Everything else the unit does, it does on wiring of its own.
The unit never connects to the machine's CAN bus, its ECU or its firmware. Its actuators, its controllers, its stop network and its sensing run on a harness of their own, and none of that harness lands on the machine's. The fused feed from the accessory point is the only conductor that crosses between the two.
Inside the unit, modules talk over CAN 2.0 and Ethernet, wired only. Wireless never carries the safety loop or a motion command, and it holds as a rule of the line rather than a setting somebody can change. Supply is 24 VDC across the family, and a 12 V machine takes its conversion inside the fit kit.
The consequence follows directly. A machine with no CAN bus, no ECU and no firmware is worked exactly like new iron, because the unit only operates what a person operates. There is no integration work to buy and no new fault codes waiting in the shop.
Networks are kept apart on the unit's own side as well. Machine-control and safety networks stay segregated from service and mission networks, and the loss or compromise of an external link cannot create actuator authority. A link can ask for less, and never for more.
The dock is the belt anchors and the pins. It stays with the machine when the unit lifts out, and the cab is a cab again.
The dock goes in once, mechanically, into points the manufacturer already provided. It is two things at once: the lap-belt anchors that capture the cradle on the seat pan, and the pinned receiver pockets that take the controller platform's legs. Nothing stands at the operator station between jobs, and the machine works as it always has.
The controls, their travel and the geometry between the seat and the console are measured. The result is that machine's own profile.
Anchor blocks go into existing threads, the receiver pockets are set and the belt anchors are made ready, ahead of any call rather than on the day.
The unit sets into the dock, the machine's belt threads the cradle tunnel, the couplers land on the machine's own controls, and the camera comes up on the dash.
The rule set for the task and the guidance tier load before anything moves. Authorization arrives by wire or at the dock.
The unit lifts out, and the operator station is returned to baseline and inspected for damage or interference. The machine returns to a crew in minutes and is standard again.
Install the dock once, deploy the unit when it is required, and remove it when it is not. One dock belongs to each machine and the unit travels to the work, so the capability arrives as a case and a fit kit rather than as another vehicle to ship, park and fuel. The same machines serve crewed and uncrewed work.
Guidance is preset at the dock, carried down a fibre with a person in the loop, or planned onboard inside a sealed rule set. There is no fourth tier and no radio option.
The task program is loaded when the unit is set into the dock. While it runs, nothing is emitted and nothing is received, so there is no link to deny and no emission to find.
A trailed optical fibre runs back to an operator at a stand-off station. Guidance travels down the glass rather than through the air, and a person authorizes every decision that matters from outside the cab.
Perception and planning run on the unit, inside a sealed rule set, with no emissions and no link. The planner proposes, the rules govern, a person authorizes the task, and safety keeps its veto.
There are no radios and no satellite receivers on this line, so there is nothing aboard to jam and no satellite fix to spoof. Authorization is delivered by wire or at the dock, never over a radio link. An authorization that cannot be jammed is worth more than one that is convenient.
The tier is chosen for the task rather than for the customer. Responder CS-810 runs the same three tiers on a fire ground that Defender CS-820 runs on a route. What separates the two profiles is the rule set: the tasks each may run, the movement space it may use, and the safe state it goes to when something falls outside the rules. Both are set out on the Responder and Defender pages.
Authority runs one way on this line. Every layer has something it is built not to do, and none can grant itself what the layer below it withholds.
The planner proposes, the rules bound what may be proposed, a named person authorizes each job, and independent safety can only remove authority. Every act lands on one chained record.
| Layer | What it does | What it cannot do |
|---|---|---|
| Independent safety | Removes motion energy, controls the dump and enable path, proves the safe state, holds the veto | Depend on the general-purpose computer or the planner for a core safety action |
| The qualified person | Approves the bounded operating envelope, the task and the intervention rules | Bypass an independent safety condition |
| The motion controller | Validates and executes approved motion primitives inside the machine's limits | Invent mission intent, or widen the approved envelope |
| Task intelligence | Proposes and sequences tasks, evaluates perception and task progress | Energize an actuator directly, or grant itself safety authority |
| Runtime learning | Captures evidence, drift and operator demonstrations | Promote a new behaviour into service by itself |
Control authority in order: independent safety, the qualified human, deterministic motion, task intelligence, and runtime learning last.
External sensing may remove authority and never creates it. Prepared, installed and authorized are three different states, and a unit can be all three and still be holding.
Authorization itself is a lease. It is time-limited and signed, issued and withdrawn by wire or at the dock, never by radio. Withdrawal or expiry ends in a safe stop and then the minimum-risk condition. The unit stays installed and will not run until it is re-authorized, and the host machine is never touched.
The rules ship sealed. Rule sets and firmware are signed, a hardware root of trust runs nothing unsigned, shipped units carry no debug access, and tamper detection ends in a safe stop and a retained log, with the keys held in Canada. Interfering with a unit is designed to be expensive, slow, obvious and self-defeating.
One case is designed against the default. Stopping and waiting for a person is the right answer on a work site and the wrong one inside a burning structure, so each task carries its own defined safe state: withdraw to the dock line, ground the implement and hold, or run to the tether end. It is set per task, in advance, never in the moment. The full treatment sits on Safety.
The physical stop and the manual release on every actuator are never part of the authorization. The lock is on the logic, never on safety.
Energy authority sits in an independent safety controller, on its own hardware, and there is no path to it from the planner or from the general-purpose computer. A wired stop network and a pull lanyard sit on the unit's side of the line. Under both of them the release is mechanical: one hand, no tool, and it works with the unit unpowered.
The machine's own safeguards are left in place and keep working. The pilot lockout lever still cuts pilot pressure the way it did before the unit arrived. Losing the high-level computer is never treated as permission to keep moving, and evidence that a control is actually back at neutral outranks a command saying it should be.
None of it can be optioned out. A spine that can be removed to suit a budget is not a spine.
Controls wear, and no two machines are alike. Every coupled control is worked through a routine before the first task of the day rather than trusted from the day before.
The routine finds where neutral sits, where the limits are, how much travel a control takes before the machine answers, and how it comes back when it is released. The machine type is set in the software first, and from then on the unit never puts more force on a control than that kind of machine should see.
Worn, sloppy controls are the normal condition on older iron. Calibrating every day it works, rather than once at commissioning, is what makes that iron workable.
Each coupled control is driven to its own zero, and the neutral position is proved rather than assumed.
Sensors are calibrated and time-synchronized, and faults are injected deliberately, so the response is known before the machine can move.
Motion commissioning is bounded and supervised by a qualified person before any task authority is granted for the day.
Commissioning is a safety act rather than an install, and it is repeatable on purpose. A unit that cannot complete the routine does not get the day's authority, and the seat goes back to a person.
The conversion happens on the unit's side of the line. What the machine's builder put in it is still there, still doing its job, when the unit comes off.
No harness is tapped, no controller is flashed and no manufacturer software is touched. The steering wheel is not drilled. The travel levers take a split clamp with a compliant insert, so there is no adhesive and no permanent change to the lever.
On removal the operator station is returned to baseline and inspected for damage or interference, and the record of the task stays with Canadian Shield rather than on the machine. The machine goes back to a crew in minutes.
| Mechanical state | What is fitted | What the machine is |
|---|---|---|
| 0 · OEM | No unit | Exactly what the manufacturer built. |
| 1 · Installed, disengaged | Unit in the dock and belted in; couplers parked on the controls, force-free | A person can sit down and drive. |
| 2 · Armed | Authorized and calibrated, holding | Held. Wrong-side and wrong-configuration seating is blocked electronically here. |
| 3 · Autonomous control | Running the authorized task | Working inside the defined movement space, under the tier in force. |
| 4 · Fault or safe | Outside the rules, tampered with, or de-authorized | At that task's own defined safe state, then the minimum-risk condition, and a person is called. |
Five mechanical states, tracked independently of the seven authority modes.
Mass, reach and endurance belong to the host machine. This line is defined by what it fits and by what its rule set allows.
| Item | Figure |
|---|---|
| Mounting | Body in a cradle on the OEM seat pan, in the operator's own seat |
| Restraint | The machine's own lap belt, through a closed tunnel between the cradle rails |
| Dock | The machine's own belt anchors and pins. It stays with the machine |
| Host machines | Excavator, dozer, loader, grader, tractor. The customer's own, unmodified |
| Actuator modules | 13 |
| Interface families | 6 |
| Steering | From the centre of the machine's own wheel, through a machine-specific adapter plate |
| Key rotation | Excluded from the actuator set. Keys are human authority tokens |
| Host bus connection | None. One fused feed from the accessory point is the only wire |
| Electrical | 24 VDC family-wide. 12 V machines convert in the fit kit |
| Comms | CAN 2.0 and Ethernet, wired only. Wireless carries no safety loop and no motion command |
| Guidance tiers | 3. Preset at the dock, fibre-tethered, onboard optical-AI |
| Radios and satellite receivers aboard | 0 |
| Authority modes | 7. Off, manual, assist, approach, teleoperation, autonomous, maintenance |
| Mechanical states | 5. OEM, installed and disengaged, armed, autonomous control, fault or safe |
| Calibration | Every coupled control, every day it works |
| Physical release | A wired stop and a manual release on every actuator, always mechanical |
| Authorization | A lease. Time-limited and signed, delivered by wire or at the dock |
| Keys | Held in Canada |
| Design standards named | ISO 12100, ISO 13849, ISO 17757, ISO 19014 |
| Ownership | The customer owns the machine and the hardware. The configuration and application are Canadian Shield's, licensed and revocable |
| Weapon scope | Never operates a weapon. Never fires anything |
| Patent status | Patent pending |
| Export control | International transfer is subject to Canadian government permits |
Each machine is surveyed, fitted with its own kit, calibrated and recorded. The supported list grows one qualified configuration at a time.
The line is built for seats that are hard to fill safely, on machines that are already on the ground.
Every conversation starts the same way: which machines you run, what they do all day, and which seat you want to empty.
Send the make, model and year, and the cab trim if you know it. Say what the operator station carries: the seat, both consoles, the floor, the pedals and each control. Say what the machine does all day and where, whether it is holding up the job, and whether the public ever comes within reach of it.
The answer names the family your machine belongs to, what the unit would work in that cab, and what fitting it involves. Every enquiry is screened. Supply is subject to Canadian export permits issued per shipment, and Controlled Goods Program status is disclosed to qualified enquiries.
Patent pending. Export-controlled: international transfer is subject to Canadian government permits. Designations and profile names are current as issued and subject to change without notice. Nothing on this page is an offer, a commitment or a representation to any government body.
