CDNS Autonomy converts selected machines a customer already owns into optionally uncrewed ones, and the CDNS Defence Platform is the line's defence side. Seven machine families carry that work rather than a catalogue of models, and every machine joining the supported list is surveyed, fitted with its own kit, calibrated every day it works, and recorded.
The public unit is the machine family. Behind each family sits a controlled list of the exact machines that have been surveyed, fitted and recorded, and that list grows one qualified configuration at a time.
A fleet manager does not buy autonomy in the abstract. The question is whether the line will work the excavator already standing in the yard, the loader that feeds the pit, the telehandler that runs the depot. CDNS Autonomy answers that machine by machine and offers the answer by family, because the product is built around machine families and a reusable core.
What accumulates behind a family is machine-specific: control interfaces, geometry surveys, actuator calibrations, safety cases, perception configurations, machine dynamics, operator data, skill packages and field-service procedures. That body of work is what makes a family offerable.
Three of the seven families are wheeled vehicles, driven from the driver's seat, and the difference stops there. The unit reaches the same six interface families in that cab and joins the supported list one qualified configuration at a time. Those three sit inside the CDNS Defence Platform, the defence side of the line, beside the plant Defender CS-820 already works.
Excavators, dozers, loaders, graders and related equipment. The family carries hazardous earthworks, debris and rubble, fortification, and route and airfield support.
Forklifts, telehandlers, material handlers and yard equipment. The family carries remote depots, hazardous and contaminated handling, and resilient logistics, on plant that is already on the ground.
Tractors and implement carriers where a defence need exists. The family carries firebreaks, snow and ice, terrain maintenance, base construction and support.
Machine families a customer defines. A specific conversion follows an engineering survey and qualification, and it joins the supported list on the same terms as everything already on it.
Light and medium wheeled vehicles with a driver's seat. The unit takes that seat for driving on closed ground and on routes closed to traffic, for convoy and resupply, and for recovery and route support.
Heavy wheeled logistics and material-movement trucks with air brakes. Resupply and material movement on closed routes, depot, airfield and route support, and recovery, from the seat of a truck already in service.
Protected wheeled vehicles and their support variants, driven from the driver's station. Engineering support, route and resupply, and casualty and recovery support, on ground where the seat is the exposure.
Excavators, dozers, loaders, graders and related equipment: hazardous earthworks, debris and rubble, fortification, and route and airfield support.
The seat on an excavator working under a highwall, on contaminated ground, or on a route nobody has cleared is the most exposed place on the machine. It is the seat the unit takes.
In a tracked excavator the unit works two joysticks, two travel controls, the throttle dial and the machine's own pilot lockout lever. In a dozer it works the steering, forward-neutral-reverse, the gear selector, the blade and the ripper. In a wheel loader it works the wheel steering, the pedals and the implement joystick. Every one of those is a control the manufacturer fitted for a person to use.
The parking brake is treated as its own case. The unit may apply and release a machine's parking-brake control through a higher-integrity module, under a completed machine-specific safety case with independent state confirmation. Defeating the park brake, or using it as the unit's stop path, stays banned on every machine in every family.
Forklifts, telehandlers, material handlers and yard equipment: remote depots, hazardous handling and resilient logistics, on plant that is already on the ground.
Handling work puts people exactly where the hazard is: at the load, at the face of the stack, at the door of the store. A forklift or a telehandler with nobody in the seat moves the same pallet off the same rack while the crew stands outside the exposure. Remote or contaminated material handling and remote depot work are what this family is bought for.
Wheeled machines are driven from the centre of the machine's own steering wheel through a machine-specific adapter plate sized to that wheel. The wheel is not drilled and the rim stays free for a person's hands.
Tractors and implement carriers where a defence need exists: firebreaks, snow and ice, terrain maintenance, base construction and support.
A tractor is a carrier for whatever is on the back of it, so the controls that matter here are the ones that run the implement: the hydraulic valves and the power take-off, alongside the steering and the pedals.
Firebreaks are the clearest case in the family. Cutting a break ahead of a wildfire is repetitive work, on ground that is about to burn, under a clock. Snow and ice management, terrain maintenance and base construction sit here for the same reason: a defence need exists and the machine's controls are the ones this family already works.
Light and medium wheeled vehicles with a driver's seat: driving on closed ground and on routes closed to traffic, convoy and resupply where the seat is the exposure, and recovery and route support.
A driver's station is a seat with a wheel in front of it, pedals under it and selectors beside it. The unit works the wheel from its centre, through a machine-specific adapter plate sized to that wheel: the wheel is not drilled and the rim stays free for a person's hands. The accelerator and the service brake are worked through the travel each pedal has and released the way its own return intends.
The transmission selector, the range or transfer selector and the switches a person reaches are discrete controls, taken one position at a time. The parking brake carries the same case here as it does on plant: applied and released through a higher-integrity module, under a completed machine-specific safety case with independent state confirmation, and never the unit's stop path.
A route open to public traffic is refused, because a member of the public cannot consent to the risk. What the family works is the ground where the seat is the exposure and the vehicle itself can stay.
| The driver's control | The interface family it falls into |
|---|---|
| The steering wheel | Rotary control, driven from the centre through the adapter plate |
| The accelerator and service-brake pedals | Linear foot control |
| The transmission selector, and the range or transfer selector | Discrete control |
| The parking brake | Discrete control, under its own machine-specific safety case |
| The push-pull air-brake controls, park and trailer | Discrete control, where fitted |
| The axle, tire-pressure and power-take-off selectors | Discrete control, where fitted |
| The switches a person reaches | Discrete control |
| The dash, the telltales and the indicators | Instrument observation, read by camera |
| A lever or a hand control where one is fitted | Dual-axis hand control |
| Attitude, motion and linkage state | Dynamic-state sensing, carried on the unit |
The driver's station across the three wheeled families. Which of these a vehicle carries, and how each is driven, is established at the survey.
Heavy wheeled logistics and material-movement trucks with air brakes: resupply and material movement on closed routes, depot, airfield and route support, and recovery.
A heavy truck adds controls rather than a new kind of control. Everything the tactical and utility family works is here, and beside it the push-pull air-brake controls for the park and the trailer, and the axle, tire-pressure and power-take-off selectors on a vehicle fitted with them. Each of those is a discrete control, taken one position at a time.
What the steering and the pedals ask of the unit is heavier on a truck of this size than on plant, and what they ask on a given vehicle is a survey finding rather than a class figure. The daily routine does not change: every coupled control is worked through neutral, through its limits, and through how it comes back when it is released, before the first task of the day.
The reference machine for the family is the group's own rock truck, and every truck that follows it is surveyed, fitted, calibrated and recorded on the same path.
Protected wheeled vehicles and their support variants, driven from the driver's station: engineering support, route and resupply, and casualty and recovery support, on ground where the seat is the exposure.
The controls are the driver's controls as the vehicle carries them. What separates this family is the room around them. A protected cab is a restricted one, and the seat, the console, the reach and travel of every control and the space a mount can occupy are what the survey settles before a vehicle joins the supported list. How the kit packages into that station is a finding of the survey, vehicle by vehicle.
The route rule does not change for a protected vehicle: the work sits on closed ground, and a route open to public traffic is refused.
Where a protected vehicle carries a weapon, the unit drives that vehicle and works the driver's own controls. It never operates the weapon and never fires anything, under every guidance tier, on every machine and vehicle it is fitted to. That is the line's one refusal, and human safety comes first, on every line.
Machine families a customer defines. A specific conversion follows an engineering survey and qualification, and it enters the supported list on the same terms as everything already on it.
A machine the line has not met before is approached through its controls, because the controls are what the unit operates. Every operator station resolves into six interface families, and the survey establishes which of them are present in that cab, how each one is driven, and what the fit kit has to carry.
A customer-defined family takes the same route onto the list as the other six: surveyed, fitted with its own kit, calibrated, and recorded against an exact configuration.
Find the family, then the row. Every item in the right-hand column is a control the machine's manufacturer already fitted for a person to use.
| Family | Machines | What the unit works |
|---|---|---|
| DFC-E | Tracked excavators | Two joysticks, two travel controls, the throttle dial and the machine's own pilot lockout lever |
| DFC-E | Dozers | Steering, forward-neutral-reverse, the gear selector, the parking brake, the blade and the ripper |
| DFC-E | Wheel loaders | Wheel steering, the pedals and the implement joystick |
| DFC-E | Compact track and skid steers | Joysticks and auxiliary functions in a compact cab |
| DFC-E | Backhoes | Driving controls at the front, hoe controls at the rear |
| DFC-L | Forklifts | Steering, directional control, throttle and brake, and the mast levers |
| DFC-L | Telehandlers | Steering, travel, the boom and the attachment controls |
| DFC-T | Tractors and implement carriers | Steering, pedals, implement controls, hydraulic valves and the power take-off |
| DFC-V | Light and medium wheeled vehicles | The steering wheel from its centre, the accelerator and service-brake pedals, the transmission selector, the parking brake, the range or transfer selector, the switches a person reaches |
| DFC-H | Heavy logistics trucks with air brakes | The DFC-V set plus the push-pull air-brake controls for park and trailer, and the axle, tire-pressure and power-take-off selectors where fitted |
| DFC-P | Protected wheeled vehicles and support variants | The driver's controls as fitted, in a restricted cab |
| DFC-S | Customer-defined | Established by survey against the six interface families |
Graders and other related equipment are surveyed the same way; which controls are worked is decided per machine at the survey.
Older iron counts. A machine with no CAN bus, no ECU and no firmware is worked exactly like new iron, because the unit only operates what a person operates. If a person can work the controls, the unit can work them. Older machines are often the ones with the seat problem in the first place.
Key rotation is left out of the actuator set on purpose. A key is a human's authority token. A person starts the machine on Responder and civil work, every session. On Defender the machine may be started on a remote command from the stand-off station, over the tether, on ground closed to everyone the job does not need and with nobody at the machine; the authorization, the wired stop and the manual release are unchanged by it.
The seven families describe the iron. The two profiles describe the rules: the tasks each may run, the movement space it may use, and the safe state it goes to when something falls outside them.
The emergency-services profile: fire ground, structural collapse, hazmat, flood and wildfire earthworks, and rubble and route clearance for civil agencies. In a burning structure, stopping and waiting for a person can itself be the harm, so each task in the rule set carries its own minimum-risk condition.
The defence-engineering profile. Defender takes the seat for earthworks, berms and revetments, obstacle reduction, route and rubble clearance, remote handling and driving, on the ground and the machines defence engineering already runs, military-pattern vehicles included — each surveyed, fitted, calibrated and recorded like any other machine. Never operates a weapon. Never fires anything.
The hardware does not change between them. CS-810 Responder and CS-820 Defender share the dock, the actuator modules and the authority model, and the rule set is what separates them. What that rule set allows is decided per task, in advance, never in the moment. The Responder and Defender pages carry each profile in full.
Both run without a radio. No radio and no GNSS sits anywhere on the line: a task is preset at the dock, run on an optical fibre with a person in the loop at a stand-off station, or planned onboard inside a sealed rule set. There is no fourth tier and no radio option on any family.
On a machine in your yard that reads as four plain facts. The planner proposes inside the rule set written for the task. The rules bound what may even be proposed. A named person authorizes the job before anything moves. The physical stop and the manual release on every actuator stay where a person at the machine can reach them.
A machine is supported because that machine was surveyed, fitted with its own kit, calibrated, and written into a record that says exactly what it is. The supported list grows one qualified configuration at a time.
Machine identity first, then the control geometry of that operator station. The survey establishes which of the six interface families are present, how each control is driven, and what the fit kit has to carry.
The dock is the machine's own seat-belt anchors and pins, and it stays with the machine. The unit's body sits in a cradle resting on the seat pan, with the machine's own lap belt threaded through a closed tunnel between the cradle rails. Actuator modules pin onto the controls that are already there, and a camera reads the dash.
Every coupled control is worked through neutral, through its limits, and through how it comes back when it is released. Controls wear and no two machines are alike, so that routine runs fresh every day the unit works rather than being trusted from the day before.
Commissioning ends with control zero and neutral proof, sensor calibration and time sync, and acceptance for the intended envelope. The configuration is then signed and sealed with a rollback package.
The machine's identity becomes a record rather than a label, and that record covers thirteen domains: host platform, human controls, machine kit, energy, compute, sensors, harness, software, calibration, skills, safety, maintenance and release. A machine skill is frozen against an exact machine, hardware, software and calibration configuration; a signed manifest and a deployment check confirm that the skill running on that machine is the skill released for it.
Nothing about the machine is cut, wired or reprogrammed to accept any of it. The unit never connects to the machine's CAN bus, ECU or firmware, and the only wire that crosses between them is a fused feed from the accessory point. On removal, the operator station is returned to its baseline and inspected, and the machine is standard again. How it works carries the mechanism in full.
The first reference machines for DFC-E are the group's own: a 290G LC excavator, a D6T LGP dozer and a 930 wheel loader.
The group's own tractor is a 9400, and a forklift stands as the wheeled-steering survey machine. For the heavy wheeled work of DFC-H, the reference machine is the group's own rock truck.
A reference machine is where a family's first configuration is worked out. The operator station is surveyed control by control, the fit kit is built for that cab, the daily calibration steps are set, and the configuration is recorded. Every machine that follows in the family is another qualified configuration rather than a fresh start, and the second machine in a family goes quicker than the first for that reason.
The three wheeled families take the same path. What a family covers is stated as a class of machine; which vehicles stand on the supported list is settled one at a time.
A conversion starts with a survey of one machine, not of a fleet. It measures the operator station, and it settles what the kit is, where the limits sit, and whether that machine belongs on the supported list.
What is measured.
What is decided.
The reply names the family the machine belongs to, what the unit would work in that cab, and what fitting it involves.
Three things sit outside the line's scope on every profile and every family, and one thing the line refuses outright. They are properties of how the system is built rather than settings a configuration can change.
The last item is a property of the line rather than of a profile. Human safety comes first, on every line. CDNS Autonomy is a carrier and an operator, never a strike platform: it never operates a weapon and never fires anything. Weaponization is not a product decision.
The physical stop and the manual release on every actuator are never part of the authorization. Authorization is a lease, time-limited and signed, delivered by wire or at the dock and never by radio; withdrawal or expiry ends in a safe stop and then the minimum-risk condition, the unit stays installed until it is re-authorized, and the machine itself is never touched. The lock is on the logic, and it is never on safety.
The conversation starts with the iron: the machines you run, the ground they work, and the cab a survey would measure first.
Every enquiry is screened before any discussion. Supply is subject to Canadian export permits issued per shipment, and the export posture is counsel-first. Controlled Goods Program status is disclosed to qualified enquiries. Nothing on this page is an offer, a commitment or a representation to any government body.
CDNS Autonomy carries the line in full, How it works carries the mechanism in the cab, and the Responder and Defender pages carry the two profiles and their rule sets.
Patent pending. Export-controlled: international transfer is subject to Canadian government permits. Designations and profile names are current as issued and subject to change without notice. Nothing on this page is an offer, a commitment or a representation to any government body.
