Responder CS-810 is the emergency-services profile of CDNS Autonomy: a removable operator that takes the seat of the excavator, dozer, loader or tractor an agency already owns, works that machine's own controls, and lifts out when the callout is over. No radio, no GNSS, and nobody in the seat.
A machine built for this work can go into a flood, onto a slope that is still moving, over burning or contaminated ground, downwind of a plume. It is built for exactly that ground. The seat is not.
Responder CS-810 is written for the seats that get people hurt: fire ground, structural collapse, hazmat, flood and wildfire earthworks, rubble and route clearance for civil agencies. It is a self-contained unit that sits in the operator's seat of a machine the agency already owns, under the machine's own lap belt, and works the joysticks, levers, pedals and switches the manufacturer fitted. A camera reads the dash. It never connects to the machine's CAN bus, ECU or firmware; the only wire between the two is a fused feed from the accessory point. When the seat is needed again it lifts out, in minutes, and the machine is standard.
The purpose is to put the machine into the fire, the flood, the collapse or the contaminated ground and leave the person outside it, standing somewhere the water, the slope or the plume is not.
The group's own crews have closed rock causeways and breaches across open water at Weed Lake, Alberta, working an amphibious excavator off the rock and a boat, with a person in the seat throughout. Responder is written for that ground, and for that seat.
It is one of two profiles on the CDNS Autonomy line. Its sibling, Defender CS-820, carries the same unit into defence engineering. The hardware does not change between them. The rule set does.
On a callout: the planner proposes the moves; the rule set written for that task bounds them; a named person on the crew authorizes the job before anything moves; and the stop and the manual release can only take the machine's authority away, never grant it.
Earthwork that comes with fire, rescue, hazmat and disaster response, on the machines an agency already runs, each with a defined work area and a person on hand to authorize and watch it.
Cutting line ahead of a fire and holding a guard on ground a crew would rather not stand on for the time it takes. Heat, smoke and a front that moves are the seat's exposure.
Clearing what a collapse left standing before anyone has to walk under it. The machine works the footprint with nobody inside its reach; people go in when it has stopped.
Working ground where the hazard is in it, not just on top of it, downwind of a plume nobody should breathe for a shift. The machine sits in the hot zone; the person authorizing it does not.
Berms and closures across moving or open water, and the rock and fill work that goes with them. The failing embankment is the one the seat would sit on.
Moving what a disaster left behind so that people and vehicles can move again, before anyone has to walk the pile.
Reopening a road or an access route so the rest of the response can follow it in. The route is closed to traffic while the machine works it, or the task is refused.
| Task | Verdict |
|---|---|
| Wildfire guard and fuel breaks | In scope; smoke can blind the sensing, and the task's safe state covers it |
| Structural collapse | In scope |
| Contaminated ground and spill | In scope |
| Flood and breach closure | In scope |
| Debris and rubble clearance | In scope |
| Route opening | In scope only with the route closed |
| A slope after a failure | In scope |
| Rescue with people inside the work area | Refused: people within the machine's reach |
| Public-road work during a response | Refused: public traffic within reach of the machine |
The seat is what this profile empties. It is never sent in with people inside the work area, and never run with public traffic within reach.
Three things define every Responder task before the call comes: the task it may run, the movement space it may use, and the safe state it goes to when something is outside the rules.
What the machine is allowed to do, written with entry conditions, an operating envelope and the perception confidence it needs before it moves. A situation the rules do not cover goes to the safe state and waits on a person.
A work area and a boundary that someone on the crew has defined. They limit where the machine goes and what it does, and the boundary can only narrow the task, never widen it. Speed, slope, reach and distance from the line are limits, not suggestions to the planner.
What the machine does when authorization ends, a limit is crossed or the sensing degrades: withdraw to the dock line, ground the implement and hold, or run to the tether end. It is chosen for that task, ahead of the call; the moment a limit is crossed is the wrong moment to decide what safe means.
The rules that hold all three ship sealed: signed rule sets and firmware, a hardware root of trust that runs nothing unsigned, no debug access on a shipped unit, and tamper detection that ends in a safe stop and a retained log. The keys are held in Canada. The rule set is not a setting the agency edits, and not one anyone else edits either.
How a task is taught by qualified operators, reviewed and released as a signed package is on the Autonomy page; how a machine is surveyed, fitted and commissioned to run it is on the Operations page.
Across the fleet, the default when something falls outside the rules is to stop, go to the minimum-risk condition and call a person. On the seats Responder is built to fill, that default can be wrong.
In a burning structure or on a failing slope, a machine that stops and waits for a person can itself put a person in harm's way. So each task in the Responder rule set carries its own defined safe state, one of three, and stop is not the only answer.
Which one applies is set by the task, never improvised after the fact. If the machine reaches that state and stays there, it drops to the minimum-risk condition, and a person is called.
Back out of the work area to the line it was set in from, clear of the hazard, and hold there.
Put the bucket or blade on the ground, hold position, and wait. Nothing is suspended over anyone.
Follow the optical fibre back along the way it came in, to the end of the tether, and hold there.
None of this bends the authority chain for the tempo of an emergency. The planner proposes inside its sealed rule set; the rule set governs what may be proposed; a person authorizes the task before it runs; and the physical stop and the manual release on every actuator always remain. The lock is on the logic, never on safety. The stop, the release and the architecture behind every safe state are on the Safety page.
It fits the excavator, dozer, loader or tractor the agency already owns. Older machines count the same as new ones, because it works through the controls a person uses and never through the machine's electronics.
The machines that dig, push and load: hazardous earthworks, debris and rubble, route support. The group's own 290G excavator, D6T dozer and 930 loader are the family's reference iron.
Firebreaks, snow and ice, terrain maintenance and the work around a base or a camp, on the tractor a county already runs.
Remote depots, hazardous handling and yard logistics, on the plant a depot already operates.
A machine family an agency names. Specific conversions are subject to an engineering survey and qualification.
A mixed municipal or contractor fleet is one system, not one program per make and year. Each machine is surveyed, fitted with its own kit, calibrated every day it works, and recorded; the supported list grows one qualified configuration at a time. The dock is the machine's own seat-belt anchors and pins, fitted once, ahead of any call. The unit stays in its case until a seat needs filling, and the machine works as it always has in the meantime; the same fleet serves crewed and uncrewed work.
Nothing on the host machine is cut, wired or reprogrammed to take it. There is no integration work to buy, no new fault codes in the shop, and nothing to undo when the unit comes off. The seven families and what the unit works in each cab are on the Machines page.
The dock goes on once, ahead of any call. What follows is the cycle a crew runs on the day: set in, calibrate, authorize, lift out.
The dock anchors to the machine's own seat-belt anchors and pins, ahead of any call. The machine goes back to its ordinary work with a person in the seat and nothing changed.
On the callout the unit sets into the dock and belts in. Couplers land on the machine's own joysticks, levers, pedals and switches, the camera is aimed at the dash, and the rule set for the task loads before anything moves. A person on the crew starts the machine.
Before the first task the unit works each coupled control through neutral, its limits and how it returns when released. Controls wear and no two machines are alike, so nothing is trusted from the day before. Then a named person authorizes the task, and the lease arrives by wire or at the dock.
When the task is done, or the seat is needed again, the unit lifts out. Nothing was cut, wired or reprogrammed; the machine is what its manufacturer built, and the record of the task stays with Canadian Shield, not with the machine.
Nothing runs until someone clears it, machine by machine, callout by callout. Authority on a Responder task runs in a fixed order, and it only ever flows down.
| In charge, in order | Who or what | What it can do |
|---|---|---|
| 1 | Hard safety | The stop wired into the unit's own safety controller, with no software in the path, and the manual release on every actuator: one hand, no tool, no air, no power. It can only remove motion authority. Nothing outranks it. |
| 2 | The person at the machine | Anyone at the machine can stop it. A person can ask the machine to move; a person cannot ask it to stop being able to stop. |
| 3 | The authorized remote | The person at the stand-off station on the fibre, authorizing every decision that matters, out of the seat while they do it. |
| 4 | The deterministic controller | Executes approved motion within the machine's limits. It cannot invent intent or widen the approved envelope. |
| 5 | The AI planner | Proposes and sequences the task and reads its own progress. It cannot energize an actuator or grant itself authority. It is last. |
External sensing can remove the machine's authority. It can never create it.
Authorization is a lease. It is issued for a period, signed, and withdrawable by Canadian Shield; it is delivered by wire or at the dock, never over a radio link. Withdrawal or expiry ends in a safe stop and then the minimum-risk condition. The unit stays installed and will not run until it is re-authorized, and the agency's machine is never touched.
Every act, the person's and the machine's, lands on one chained record. Nothing is deleted.
Guidance is selected for the task: preset at the dock, with nothing emitted or received while it runs; fibre-tethered, with a person at a stand-off station over an optical link with no radio in it; or onboard optical-AI inside the sealed rule set, with no emissions, no link and no satellite anywhere on the line.
Every row below is a property of how the unit is built, not a setting an agency can change. The reason for each one sits in the second column.
| It never | Because |
|---|---|
| Operates a weapon, or fires anything | Human safety comes first, on every line. It is a carrier and an operator, not a munition, and weaponization is not a product decision. |
| Starts the machine | A key is a human authority token. Key rotation is left out of the actuator set on purpose; a person starts the machine. |
| Works with public traffic within reach | Public-traffic work is refused on every profile. The work area is closed ground with a person authorizing it. |
| Runs with people inside the work area | The seat is what it empties. A rescue with people inside the machine's reach is refused. |
| Stays fitted permanently and unattended | It is fitted for a task, authorized for a period, and lifted out. The dock stays; the unit does not. |
| Connects to the machine's CAN bus, ECU or firmware | It works the controls a person works. The one wire is a fused feed from the accessory point; nothing is cut, wired or flashed to accept it. |
| Carries a radio or a satellite receiver | Preset, fibre or onboard optical-AI. Wireless never carries the safety loop or a motion command, on this line or anywhere in the fleet. |
| Runs outside its rule set, or while de-authorized | The rules ship sealed and signed; a de-authorized unit stays installed and will not run. The agency's machine is never touched. |
| Promises a production rate or a response time | It empties a seat. Neither a rate of work nor a time to arrive is offered. |
What Responder never does, and the reason beside each.
The left column is the agency and the contractor it calls on. The right column holds on every callout, whoever is asking and however fast the ground is moving.
Fit, control, authority, security and compliance, grouped the way a fleet buyer compares them. Reach, lift, mass and endurance are the host machine's own figures: the unit adds an operator, not a chassis.
| Group | Item | Responder CS-810 |
|---|---|---|
| Interface and fit | Dock | The machine's own seat-belt anchors and pins. It stays with the machine |
| Seating | The unit's body in a cradle on the OEM seat pan, in the operator's own seat | |
| Restraint | The machine's own lap belt, through a closed tunnel between the cradle rails | |
| Host machines | Excavator, dozer, loader or tractor. The agency's own, unmodified | |
| Drive and control | Actuator modules | 13, working the machine's own joysticks, levers, wheel, pedals and switches |
| Steering | From the centre of the machine's own wheel through a machine-specific adapter plate; the wheel unmodified | |
| Host bus connection | None. No link to the CAN bus, ECU or firmware; one fused feed from the accessory point is the only wire | |
| Electrical | 24 VDC family-wide. A 12 V machine takes its conversion in the fit kit | |
| Communications | CAN 2.0 and Ethernet, wired only. Wireless never carries the safety loop or a motion command | |
| Radios and satellite receivers aboard | 0 | |
| Calibration | Every coupled control, through neutral, limits and return, every day it works | |
| Key rotation | Excluded from the actuator set. Keys are human authority tokens | |
| Authority and states | Authority modes | 7 · OFF · MANUAL · ASSIST · APPROACH · TELEOPERATION · AUTONOMOUS · MAINTENANCE |
| Mechanical states | 5 · 0 OEM · 1 INSTALLED/DISENGAGED · 2 ARMED · 3 AUTONOMOUS CONTROL · 4 FAULT/SAFE | |
| Task safe states | Withdraw to the dock line · ground the implement and hold · run to the tether end. Set per task, in advance | |
| Physical release | A physical stop and a manual release on every actuator. Always mechanical, always available | |
| Security and authorization | Rule sets and firmware | Signed and sealed. A hardware root of trust runs nothing unsigned; no debug access on a shipped unit; tampering ends in a safe stop and a retained log |
| Authorization | A lease, issued and withdrawable by Canadian Shield. Delivered by wire or at the dock, never by radio | |
| Withdrawal or expiry | Safe stop, then the minimum-risk condition. The unit stays installed and will not run until re-authorized; the machine is never touched | |
| Keys | Held in Canada | |
| Ownership | The agency owns the machine and the hardware. The configuration and application are Canadian Shield's, licensed and revocable | |
| Compliance | Designed against | ISO 12100 · ISO 13849 · ISO 17757 · ISO 19014 |
| Patent | Patent pending | |
| Export | International transfer subject to Canadian government permits, issued per shipment; export posture counsel-first |
Each machine is surveyed, fitted with its own kit, calibrated and recorded. The supported list grows one qualified configuration at a time.
Tell us what machines your agency runs and the seat you would rather nobody sat in. The reply names which of them the line covers, and what a first task on your own ground would look like.
Every enquiry is screened before any discussion. Nothing on this page is an offer, a commitment or a representation to any government body. Supply is subject to Canadian export permits issued per shipment, export posture is counsel-first, and Controlled Goods Program status is disclosed to qualified enquiries. This page carries the profile in full; the CDNS Autonomy page carries the line it belongs to.
Patent pending. Export-controlled: international transfer is subject to Canadian government permits. Designations and profile names are current as issued and subject to change without notice. Nothing on this page is an offer, a commitment or a representation to any government body.
