CDNS Autonomy is run in a crew, on machines the crew already owns. A named person clears each job and can end it. The unit calibrates itself to the cab every day it works. Your operators and maintainers are trained to run, service and recover the system themselves, and every act on every shift lands on one chained record.
Nothing on this line is run from a room at the far end of a radio link, because there is no radio. The work is done where the machine is, by the crew that already runs it, with the unit in the seat and the people outside the work area.
On a shift that reads: the planner proposes the next move, the sealed rule set bounds what may even be proposed, a named person on your crew authorizes the task before anything moves, and independent safety can only take authority away.
Before a machine moves, preparation, authority and control each sit in a place of their own. Preparation is the job-preparation console: one job, one site, up to twelve units, and six gates that each close on something a named person wrote down today. Authority is held by a person, for one machine and one piece of work, for a stated time. Control is the machine itself, worked by the unit through the machine's own controls. Prepared, installed and authorized are three different states, and none is reached from the one before it without a named person.
The console runs in a browser on an ordinary computer, as one self-contained file on a laptop in a truck, with no network. It never touches the machine and cannot start anything. Ready to ask for is as far as the console goes. A named person then asks another person for the machine.
Guidance follows the same shape. Preset at the dock, the task program runs with no link of any kind. Fibre-tethered, a person sits at a stand-off station on an optical line that cannot be jammed, by construction, out of the seat and authorizing every decision that matters. Onboard optical-AI plans and perceives inside a sealed rule set, with no emissions and no link. In every tier the person with authority is on the ground and the stop is at the machine.
Every job has a person behind it, by name. They clear the job before the machine is armed, choose whose way of working is in the seat, authorize the task and can take authority away at any moment. The unit can do none of those things for itself.
Authority on this line has three parts, and all three are written down: what the machine may do, who authorized it, and when the authorization ends.
Two authorizations stack. Canadian Shield issues the line's authorization as a lease: time-limited, signed, delivered by wire or at the dock, never by radio, and withdrawable. Your named person authorizes each task inside that lease. Either one ending has the same result: a safe stop at the next safe point, then the minimum-risk condition for that task. The unit stays installed and will not run until it is re-authorized, and the host machine is never touched.
Before every session the unit asks one thing first: whose way of working is in the seat today. The basic set it came with, the way your own operator taught it, or a specialist hired by name. There is no default and no last-used. Somebody chooses, and the record carries the name of whoever did.
A key is a human authority token, and key rotation is excluded from the unit's actuator set. A person starts the machine on Responder and civil work, every session. On Defender the machine may be started on a remote command from the stand-off station, over the tether, on ground closed to everyone the job does not need and with nobody at the machine; the authorization, the wired stop and the manual release are unchanged by it.
| The act | Who holds it | How it ends |
|---|---|---|
| The line's authorization | Canadian Shield, as a lease delivered by wire or at the dock | Expiry or withdrawal: a safe stop, then the minimum-risk condition. The unit stays installed and will not run. |
| The task | A named person on your crew, typed on the day | The end of the day, a material change to the job, or the person's own word |
| Whose way of working is in the seat | A person, before every session, with no default | The moment something else is chosen |
| Starting the machine | A person, with the key on Responder and civil work; on Defender, a remote command from the stand-off station | The unit never turns a key; on Defender the start is commanded from the stand-off station |
| The stop | Anyone at the machine, by hand | Never. The physical stop and the manual release on every actuator always remain. |
One shift, walked end to end. The dock was fitted once, ahead of the day. Everything else happens every day the unit works, in this order, and the machine is standard again at the end of it.
The machine's own state tracks the day. 0 is the machine as built, with no unit fitted; 1, installed and disengaged, is the unit belted in with its couplers parked force-free; 2, armed, is authorized and calibrated, holding; 3 is the authorized task under the tier in force. State 4 is anywhere outside the rules: the task's own safe state, then the minimum-risk condition, then a person.
The unit sets into the dock that stays with the machine: the seat-belt anchors and the pins on its own controls. The cradle rests on the seat pan, the lap belt threads the closed tunnel between the cradle rails, the camera is aimed at the dash, and the couplers land on the controls already there.
Before the first task the unit works every coupled control through its own routine: where neutral sits, where the limits are, how the control returns when released. Controls wear and no two machines are alike, so nothing is trusted from the day before.
A named person completes the pre-start, starts the machine, chooses whose way of working is in the seat and clears the task. The lease is confirmed by wire or at the dock, and the guidance tier is set. Wrong-side or wrong-configuration seating is blocked here, electronically.
The task runs inside its sealed rule set until it is done, until authorization is withdrawn, or until a limit is crossed. The unit then reaches the safe state that task was designed with: withdraw along the tether, ground the implement and hold, or complete to a defined stop line. Held there, it drops to the minimum-risk condition and a person is called.
When the seat is needed again the unit lifts out. Nothing was cut, wired or flashed, and the operator station is returned to baseline and inspected for damage or interference.
Every act of the day lands on one record, in order, each entry chained to the one before it. The daily report freezes when it is filed; a correction is a new entry naming the one it corrects. Nothing is deleted.
The walk-around a named person completes before a unit is armed, in five groups: the install and the host machine per unit; the work area, the people, and stop and recovery once for the whole job. No item passes until it is answered.
A blank or a fail stops the job. Most items are critical, and a critical fail cannot be cleared anywhere in the console: no force flag and no administrative path. A non-critical fail can be cleared by the supervisor, with the reason recorded. The checklist expires with the day it was completed. The safety reading of the same walk is on the Safety page.
On each unit. The dock installed and torqued to the drawing for this machine class. The unit latched, with a second means of retention. The manual release on every actuator present and reachable. Wired local control connected and the local stop within reach, with no part of the safety loop over the air. The profile, rule set and software identity confirmed for this machine.
On the host machine. Identified by make, model and serial or PIN, matching the profile loaded. The manufacturer's own walk-around completed today by a named person. Every control moving through full travel with the unit engaged and returning to neutral unaided. The machine stopping when a person stops it, from the seat, demonstrated today. No electronic tie-in of any kind. The hour meter written down.
The work area, once for the job. A boundary identifiable on the ground, not only on a screen. Ground conditions assessed. Overhead obstructions and the limit of approach written down. Exclusion zones set up on the ground and told to everyone on site. Traffic and pedestrian controls in place. Spoil placed outside every exclusion zone.
The people. The supervisor named, present and competent on this machine class and this task. Everyone on site briefed on what the unit is, what it is about to do and how to stop it. Nobody inside the work area who does not need to be. Emergency response written down.
Stop and recovery. Every person in the work area able to reach a stop. The minimum-risk condition for this machine and this task stated. The recovery plan if the unit stops mid-task: who goes, what they do first, who they tell. Human-only mode demonstrated today.
The supervising display is built for a decision rather than a data feed. It shows the state a person needs in order to hold authority over the machine, and it gives them a stop that does not run through the planner.
Alerts are actionable rather than raw output from the planner. The stop and the abort are controlled from outside high-level planning altogether. When the state quality a task needs falls below its threshold, the task system slows, stops, asks for human review or prohibits the skill on its own. Unknown state is a valid state: the machine is allowed to not know, and the person is told.
Training on this line is measured as independence. Operators, maintainers, depot and engineering support are trained by role, with controlled publications for installation, operation, maintenance, recovery and safety, so a customer runs and services the system without perpetual vendor dependence.
Procedures, training, exclusion zones, recovery and maintenance are part of the safety system. The safety case for this line is written per machine, per task and per configuration, and the people who work it are inside that case. A trained operator is a safety measure the same way a wired stop is.
Clears the job through the gates, completes the pre-start, starts the machine, chooses whose way of working is in the seat and holds the stop. Trained on the machine class and the task, and on what the display is telling them.
Daily calibration and what its record means; module exchange by slide-and-set and recalibration; the liner rule; field diagnostic tooling with bounded privileges; and the hand-back that returns the operator station to baseline.
Serialized line-replaceable units, machine-family spares kits, repair-triggered recalibration, and secure re-image from controlled recovery media, in Canada and in selected allied depots, so a repaired unit comes back to a known configuration.
The survey and qualification path that adds a machine to the supported list, the operator capture that teaches a new way of working, and the signed release that carries it to a unit.
Service access is role-based and separated from developer privileges, and there is no debug access on a shipped unit. A maintainer's tools do what a maintainer needs and nothing more.
Three ways of working can sit in the seat, and a person chooses which one before every job. What differs between them is whose way of working it is, who owns what is built from it, and how it ends.
Every unit arrives knowing how to run the common machines in its family, from recorded hours of qualified operators on real ground. Fit it, calibrate it, and it works the way a competent hand would. A starting point, not a limit.
Put the capture kit in the cab and your best operator in the seat for a while. It learns that machine, in that cab, on your ground, from the person who already runs it best. That way of working stays yours, and it goes nowhere else.
A named operator's way of working, licensed for your job under their name, for the machine family it was taught on, and paid for every hour it runs. Never blended with your own or with the basic set, and it ends with the job.
Teaching is a disconnected state. Your operator sits in the seat and runs the machine the way they always have. The unit is out of the seat and nothing of the unit's is connected. What does the recording is a separate kit, one per machine family, wired to nothing on the machine, so nothing in the cab can move anything. It records the controls, the machine's answer and the display against one clock, and a camera frames the display and the operator's hands. Every session says who was in the seat, which machine and how the kit was fitted, and is admitted or refused by name.
The learning happens away from the machine. Demonstrations are compared across operators for the common successful structure, and any behaviour that violates an engineering or safety constraint is rejected even if an experienced person performed it. What comes back is a signed machine skill package with entry conditions, limits, abort conditions and the perception confidence it needs, frozen against the exact machine, hardware, software and calibration it was built for. A named person signs for the update that carries it to a unit. The full pipeline is on the Autonomy page.
A way of working proposes. It never authorizes. Hard safety limits outrank every person, every person outranks the software, and a loaded skill is software.
Sustainment is engineered into the line rather than sold beside it. Repair, calibration and recovery are designed to be done domestically, by the customer's own maintainers and by depots in Canada and selected allied countries.
Recovery does not need a network. Offline build artifacts, signed images, dependency mirrors and recovery media are maintained for every supported field version, with a controlled recovery image and a disaster-recovery procedure behind them. Serviceability is one of the environmental disciplines the kit is engineered against, alongside temperature, vibration and shock, ingress, EMC and EMI, power quality, corrosion, optics, harness and connectors, and cyber recovery.
Commissioning after a repair is a safety act. Control zero, travel, force and rate maps and proof of neutral come first; then static diagnostics and fault injection; then bounded controlled motion under qualified supervision. Only then is the configuration signed and sealed again, with a rollback package beside it.
Every converted machine has a record of exactly what hardware, software, calibration and skill set is on it. A skill is frozen against that record, and a unit on a machine whose identity does not match it has no motion authority.
The record covers thirteen domains: host platform, human controls, machine kit, energy, compute, sensors, harness, software, calibration, skills, safety, maintenance and release. Model weights, calibration assets, skill manifests and maps are controlled configuration items, not files on a drive. When a configuration is accepted for its intended envelope it is signed and sealed with a rollback package, and the signed manifest verifies at deployment that the skill on the machine is the skill that was released.
The record is also what sustainment is planned against. A line-replaceable unit is exchanged by serial against it and a field issue is filed against it, so nobody planning sustainment is guessing which revision of which module sits in which cab. The customer can prove, at any time, exactly what is fielded. The survey that starts a record is on Machines and families.
| What changes | What the record does about it |
|---|---|
| A module is exchanged | Exchanged by serial against the record, then recalibrated under the repair-triggered recalibration rule. |
| A coupler liner or insert is changed | Commissioning lapses; the short proof is re-run before the unit holds motion authority again |
| A new skill is loaded | Only a skill compatible with the exact configuration will load, and the signed manifest is verified at deployment |
| A unit is set into a different machine | Identity mismatch: no motion authority |
| A repair is completed | Recalibration under the repair-triggered rule, then the configuration is signed and sealed again with a rollback package |
Five changes to a converted machine, and what the configuration record does about each.
The customer owns the machine and owns the hardware. The configuration and the application that turn it into CDNS Autonomy are Canadian Shield's, licensed and revocable. Rights to machine data, operator data, derived skills and logs are defined in the terms.
That division is what the limits rest on. Canadian Shield can withdraw the operator. It can never reach the machine.
Every act on a shift is added to one chain and never overwritten. An entry with no actor is refused, because an entry nobody put a name to is not a record. A correction is a new entry naming the one it corrects, and every export says that the chain is tamper-evident. After an event, the record is what produces the evidence package.
What stays with the customer stays by design. The console runs with no network, and everything entered on it stays on that computer. Nothing on the line transmits, so nothing leaves the site over the air. A way of working taught on your machine by your operator is yours and is never folded into something sold elsewhere. Where each operator record came from, who authorized it and what it may be used for are captured with it, and the host machine carries no record of the task at all.
| The thing | Whose it is | What a withdrawal does to it |
|---|---|---|
| The machine and the hardware | The customer's | Nothing. The machine is never touched |
| The configuration and the application: rule sets, profiles, calibration, the authority model | Canadian Shield's, licensed and revocable | The unit will not run until re-authorized |
| A way of working taught on your machine | The customer's, and it goes nowhere else | Untouched |
| A named operator's technique, in their own hands | The operator's, and not for sale | Untouched |
| The recording of a named operator working | Information about that person, held under licence | Deleted, raw and derived alike |
| The skill built from that recording | Canadian Shield's | Out of service, because the licence under it is gone |
The first three rows hold on every job. The last three are the hired case.
Every change that reaches a machine is signed, and the authority to sign it is defined and held in Canada. Rule sets, firmware, software, models and calibration packages travel under signature, offline, with authenticity, compatibility and rollback checked before anything is installed.
Promotion is by signed release only. Runtime learning collects evidence for the next revision and cannot promote itself, so the behaviour on a machine changes only when a person with the authority to sign has signed. Offline-first operation does not eliminate cyber risk, and the line is not built as though it did.
The same authority answers the questions procurement puts to an operations manager: who can authorize a field software or model change, whether core operations continue without a foreign cloud or service, and whether the customer can prove what is fielded. The full set of ten is on the Sovereignty page.
The principle behind the line is that nobody is in harm's way, whichever seat it is. On a shift it reads as a list of things your people no longer do.
What the unit itself never does is fixed on every profile: it is never fitted permanently and unattended, never works in public traffic, and never carries a guaranteed production rate or response time. Human safety comes first, on every line. The unit never operates a weapon and never fires anything, on either profile, and weaponization is not a product decision. Defender CS-820 takes the seat for earthworks, berms and revetments, obstacle reduction, route and rubble clearance, remote handling and driving, on the ground and the machines defence engineering already runs, military-pattern vehicles included — each surveyed, fitted, calibrated and recorded like any other machine.
The line is run by a crew that already runs the machines. It fits operations that can name the seat nobody should sit in, and it turns down the ones that cannot keep people and public traffic out of the work area.
Tell us the machines, the crew that runs them and the ground they work, and we will say what a day with the unit looks like on your site: who holds authority, who calibrates, who maintains, and what the record shows.
Every enquiry is screened before any discussion. Supply is subject to Canadian export permits issued per shipment, export posture is counsel-first, and Controlled Goods Program status is disclosed to qualified enquiries. Nothing on this page is an offer, a commitment or a representation to any government body. The line itself is on the CDNS Autonomy hub, and how governments, primes and suppliers are routed is on Partners and Procurement.
Patent pending. Export-controlled: international transfer is subject to Canadian government permits. Designations and profile names are current as issued and subject to change without notice. Nothing on this page is an offer, a commitment or a representation to any government body.
