The CDNS Defence Platform puts a removable operator in the seat of the plant and vehicles a force already fields. Canada is where the evidence is made. The Alliance of 32 members is where that evidence is reused, force by force and family by family.
The market of this line is Canada first, then the Alliance. The customer class is an Allied force's engineering, logistics and protected-support fleets, and what the line sells is the conversion of machines that force already fields.
Canada is the anchor. The ground, the iron, the survey, the safety case and the record are all here, under Canadian design authority, and the first configuration package is made at home, on the group's own machines. What comes out of it is an evidence package about one machine and one control set, and the evidence package is what travels.
The Alliance is thirty-two member countries, called Allies. They are not thirty-two sales territories. Thirty-two forces present far fewer than thirty-two problems, because the same classes of machine recur across them: excavators, dozers, loaders and graders in the engineer units; forklifts, telehandlers and material handlers in the depots; wheeled utility vehicles, heavy logistics trucks and protected wheeled vehicles on the routes between them. A driver's station repeats. A control set repeats. That is what makes one qualified configuration worth more than one machine.
Everything on this page runs through a screened enquiry first, because export control requires it.
Home ground, home iron, home safety case, Canadian design authority. The first configuration package is made here, on the group's own machines, and it is the document an Allied ministry reads later.
Engineer regiments and logistics commands, the ministries and capability desks above them, and the primes acting for either. The seat this line empties belongs to them.
Nothing is procured, freighted, parked or fuelled for the capability. What arrives is a survey, a fit kit, a dock and a unit, for machines and vehicles a force already owns.
A force fields what it has bought over a long time, not what a catalogue sells this year. The interface this line uses is the human one, so a mixed fleet is one job of engineering repeated, not one program per make and year.
The unit sits in the operator's seat under the machine's own lap belt, works the joysticks, levers, pedals, wheel and switches the manufacturer fitted, and reads the dash with a camera. It never connects to the machine's CAN bus, its ECU or its firmware; one fused feed from the accessory point is the only wire between the two. It lifts out in minutes, and the machine it leaves behind is the machine the manufacturer built.
The Alliance released the first public version of its innovation demand signal in July 2026. Among the areas it names is “efficient, reliable and adaptable logistics to sustain military operations”.
The same month, the Alliance's industry strategy set out what it wants from suppliers across the whole life of a capability: earlier consultation with industry, interoperability pursued as a continuous requirement, the adoption of modularity and open architectures, and production that can be scaled and sustained. Those are the terms this line is read against here.
Sustaining an operation means the load moves and the route opens while the cab is the most exposed thing on the vehicle. The unit takes that seat, and the person who authorizes and watches the job sits at a stand-off station on an optical fibre, clear of the work.
Every act lands on one record and nothing on it is deleted: the authorization, the configuration it was checked against, the task, the motion and the stop. A ministry can show exactly what it has fielded, years after it fielded it.
The unit of behaviour is a skill package with its own entry conditions, envelope and abort logic, frozen against one machine and its hardware, software and calibration, and promoted only by signed release.
Operator, maintainer, depot and engineering support are trained roles with controlled publications behind them, so the crew that runs the machine also services and recovers the system.
Modularity and open architectures are read here as the boundary a prime integrates against, and production that scales as a requirement on the hardware itself: a module is serialized, testable off the machine, and built from revision-controlled build packages that a second source could work from. The CDNS Defence Platform carries the architecture behind both.
The Alliance publishes the ways industry reaches it, and a Canadian supplier uses the ones open to it. A route is a door. Walking through one is something a supplier does; a door decides nothing and confers nothing.
Two Alliance texts of July 2026, and the news of their launch at that month's Summit Defence Industry Forum, set the doors out. They are worked as one funnel, and most of what each one asks for is engineering work done here.
Launched in July 2026 as a single, simplified point of access to procurement opportunities, innovation events and engagement channels, with an engagement calendar behind it. What it asks of a supplier is registration, and a calendar read as market intelligence.
The strategy urges industry to make use of the Innovation Ranges, which offer test and experimentation facilities in representative environments, and of DIANA, its dual-use innovation accelerator. Both are entered with a portable safety case and evidence schema already in hand.
A catalogue of available and scalable products mapped against capability targets, so procurement staff can do market research. It is a later door: it follows evidence rather than producing any.
A network putting factories that hold flexible capacity together with companies that need them, on a contractor- or factory-for-hire model, launched in July 2026 with a pilot managed by the NATO Support and Procurement Agency. Arrangements are business to business, and export-licence compliance stays with the companies making them.
The strategy also commits the Alliance to earlier consultation with industry, including through the NATO Industrial Advisory Group, and carries standardization and interoperability work under its own committee and standardization office. The Support and Procurement Agency is the Alliance's lead organization for multinational acquisition, support and sustainment, and registered suppliers can bid on its contracts; registration is a supplier's own act.
All of it is a route into a market, and a place a force can meet a supplier. The verdict on this line belongs to a customer, at the end of a screened enquiry, on ground that customer owns.
One sequence, and it runs the same way for a Canadian ministry and an Allied one, and the same way whether the enquiry names an excavator, a truck or a protected vehicle. Nothing on this page is an offer.
Every enquiry on this line is screened before any discussion, because export control requires it.
Cleared, it moves to the Defender CS-820 program brief and the sanitised interface descriptions behind it.
The survey: the station, the controls, the forces and travel, the mounting, the power, the machine's own safeguards.
The dock goes on the machine's own belt anchors and pins, modules pin to the controls already there, and the configuration is sealed.
One job scored on the customer's own ground, against the four questions every task is scored on.
Bounded, time-limited, with support. A commercial arrangement, not the authorization a machine's motion runs under.
Configurations are added one at a time, each surveyed, fitted, calibrated and recorded.
Operator and maintainer training, spares by family, and depot repair and secure re-image in Canada and selected allies.
Seven lines, and no price appears anywhere on this site. A quote follows scope, and no order exists until a contract does.
What recurs is the supported configuration: signed updates, diagnostics, configuration management, the evidence and the machine skills. It is never a link, never a service in a data centre and never permission to keep a machine working, because nothing on this line transmits by radio and the mission runtime and the safety functions execute on the unit itself. The customer owns the machine and owns the hardware; the configuration and the application that make it Defender CS-820 are Canadian Shield's, licensed and revocable.
What is public is the family and the class of machine, never a model, a program or any force's fleet. A family is the controls the unit works, and the work that follows from them.
| Code | Family | The controls the unit works | The work |
|---|---|---|---|
| DFC-E | Engineering plant | Two joysticks, two travel controls, the throttle dial and the machine's own pilot lockout on a tracked excavator; steering, forward-neutral-reverse, the gear selector, the parking brake, the blade and the ripper on a dozer; wheel steering, the pedals and the implement joystick on a loader | Hazardous earthworks, debris and rubble, fortification, route and airfield support |
| DFC-L | Logistics and handling | Steering, directional control, throttle and brake and the mast levers on a forklift; steering, travel, the boom and the attachment controls on a telehandler | Remote depots, hazardous and contaminated handling, resilient yard logistics |
| DFC-T | Terrain and base support | Steering, pedals, implement controls, the hydraulic valve bank and the power take-off | Firebreaks, snow and ice, terrain maintenance, base construction and support |
| DFC-V | Tactical and utility vehicles | The steering wheel from its centre, the accelerator and service-brake pedals, the transmission selector, the parking brake under its own safety case, the range or transfer selector, and the switches a person reaches | Driving on closed ground and closed routes; resupply and convoy; recovery and route support |
| DFC-H | Heavy logistics trucks | The tactical and utility set, plus the push-pull air-brake controls for park and trailer and the axle, tire-pressure and power-take-off selectors where they are fitted | Resupply and material movement on closed routes; depot, airfield and route support; recovery |
| DFC-P | Protected mobility | The driver's controls as fitted, in a restricted cab; how the modules sit around them is a finding of the survey | Protected support driving: engineering support, route and resupply, casualty and recovery support |
| DFC-S | Specialty support | Established by survey against the six interface families | A specific conversion after an engineering survey and qualification |
Classes of machine, not models. In every family the instruments are read by camera and the machine's dynamic state is sensed on the unit's own wiring. What sits behind a family is a controlled list that grows one qualified configuration at a time.
The answer is offered by family and the engineering is done machine by machine, and the second machine in a family should cost less to integrate than the first. Qualification is a property of a configuration: the host machine, the physical interface, the energy, the compute, the sensors, the software, the calibration, the skill, the safety configuration and the operating envelope freeze together, and change one and it is a different configuration. A skill loads against the configuration it was frozen for, or it does not load. Machines and families carries all seven, cab by cab.
Four standards are named at design, and the safety case is written per machine, per task and per configuration. What applies past that is decided one interface at a time, with the customer, the jurisdiction and an independent specialist in the room.
The safety functions are designed to the architecture of ISO 13849, with independent means of removing control. ISO 17757, the standard for autonomous earth-moving machinery, is the one this safety design is built toward. ISO 12100 and ISO 19014 are named at design beside them. An independent safety authority, a named function with the right to hold a release, stands apart from the program that builds the unit.
Safety carries the architecture at full depth.
No Canadian Shield design carries a radio or a satellite receiver. Nothing in the fleet transmits by radio and nothing guides on a link, so a force's own mission systems reach this line the way a person reaches it.
A task takes one of three forms, and there is no fourth.
The whole task is settled at the dock and sealed there. From the moment it starts, nothing goes out and nothing comes in, so there is no emission to find and no channel to interfere with.
An optical fibre runs back to a person at a stand-off station, out of the seat and authorizing every decision that matters. The tether is what a request travels down, after a person has read it and decided.
Perception and planning on the unit, inside the same sealed rule set. It works from what its own sensors take in. There is no fourth tier and no radio option.
So interoperability here is not a wire into the machine. A force's own command-and-control system reaches a mission gateway over a wired or at-the-dock interface, in a fixed high-level vocabulary of mission objects, status, health and events, and nothing else crosses. Machine-control and safety networks stay segregated from service and mission networks. An external system never gets actuator authority: a request becomes a job when a named person authorizes it, and it is that person the machine answers to. Losing a link produces a defined stop or a defined degrade, never a machine that carries on.
The line is designed, built and supported in Canada, and sovereignty on it is control and recoverability. Export is the law here, and the posture is counsel-first: counsel, then the permit, then the shipment.
An Allied ministry's route runs through the same gate as a Canadian one. Where local assembly or manufacture is strategically appropriate, an allied production partner path exists on those same terms, and the single authoritative record stays with the program: one configuration record, one skill register, one evidence system, one release authority. Sovereignty carries all ten dimensions.
Nobody in harm's way is the reason this line exists, and human safety comes first above any market it is offered into. The order is fixed, and it does not change with the customer, the country, the task or the profile.
Human safety comes first, on every line. The planner proposes; the rules bound what may even be proposed; a named person authorizes each job before it runs; independent safety can only remove authority, and never grant it.
On Defender CS-820 the machine may be started on a remote command from the stand-off station, over the tether, on ground closed to everyone the job does not need and with nobody at the machine; the authorization, the wired stop and the manual release are unchanged by it. On Responder and civil work a person starts the machine every session. A route open to public traffic is refused on every family and in every country, because a member of the public cannot consent to the risk.
The line refuses one thing, and it refuses it on every family, in every configuration and under every guidance tier. Driving is open. The trigger is not.
Where a protected vehicle or any other machine carries a weapon, the unit drives the vehicle and never operates the weapon, and it never fires anything. Weaponization is not a product decision. Everything else a defence force asks of a driven machine is open: fitting to military-pattern vehicles, and driving them. The fleet Canadian Shield builds carries the same rule from the other side, in every domain: no warhead, no fuze, no energetic material, and nothing that operates a weapon. Carriers, not munitions.
That is the whole of it, and it is a design rather than a setting a customer edits. Human safety comes first, on every line.
The line is narrow, and both halves of that are stated here: the ministries, commands and primes it is built for, and the one refusal it holds in every country.
Tell us the machines and vehicles the force already fields, the work that has to be done on them, and the ground you would rather nobody sat on. A screened enquiry starts it.
Cleared, it moves to the Defender CS-820 program brief, then to a fit assessed machine by machine, then to a first job scored on the customer's own ground: whether the seat is the exposure, whether the task is fixed, whether the ground is closed, and how much of the year the machine would work. A bounded, time-limited evaluation lease with support follows only after that, and the fleet follows family by family.
Send the machines by class and by what they do all day, and the ground they work on. The answer names the family each one belongs to, what the unit would work at that station, and what fitting it involves. No price appears anywhere on this site, and nothing here is a commitment or a representation to any government body.
