CDNS Autonomy takes the person out of the seat of a machine on ground where the seat is the exposure. What follows is the safety architecture, laid out the way a safety officer walks a machine: what outranks what, what stops it, what it may never do, and what the site has to hold.
Nobody in harm's way, on any seat, whoever would have been in it. Everything below is that principle built into hardware.
CDNS Autonomy is a removable operator. It sits on the operator's seat of a machine the customer already owns, under the machine's own lap belt, and works the joysticks, levers, pedals and switches the manufacturer fitted. A camera reads the dash. When the job is done it lifts out and the machine is standard again. The person who would have been in that seat is outside the structure, off the slope and clear of the route.
Two profiles run on that one unit. Responder CS-810 is programmed for civil emergency services: fire ground, structural collapse, hazmat, flood and wildfire earthworks, rubble and route clearance. Defender CS-820 takes the seat for earthworks, berms and revetments, obstacle reduction, route and rubble clearance, remote handling and driving, on the ground and the machines defence engineering already runs, military-pattern vehicles included — each surveyed, fitted, calibrated and recorded like any other machine. The hardware does not change between them. The rule set does: the tasks each may run, the movement space it may use, and the safe state it goes to when something falls outside the rules, decided per task and in advance.
An empty seat changes every safety question on a site, so the architecture answers each one in hardware first and in software second. The stop is physical. Safety is independent of the computer that plans the work. Authority is settled before the day and it expires. The things the line will never do are properties of the build, not settings.
The planner proposes. The rules bound what may be proposed. A named person authorizes each job before it runs. Independent safety can only remove authority, and it does so without asking the software.
The two things a person reaches for when nothing else is working are mechanical, on the machine, and independent of every computer the unit carries.
The stop is a unit at the machine. Press it and it stays down, with two independent contact blocks and no software anywhere in its path. A pull-lanyard within reach of anyone working around the machine is wired into that stop as well. Press one or pull the other and every drive is stripped of the energy that moves it. Clearing it takes a person at the machine and a separate reset.
The manual release is on every actuator: one pull, by hand, no tool, in plain sight from the cab door. A spring performs the release, so it still works with the air gone and the power off. Each release separates that actuator from the control it drives, and the control is free for a person to work. It is reset by hand at the machine, and every release is checked again before the unit is trusted.
Three ways take control back by hand, and each works without the other two. Pull the machine's own pilot control lockout lever. Pull the manual release on any actuator. Or cut the unit's own energy: venting the air lets every drive that runs on it go at once, and the safety side cuts the power to the rest.
| Rank | What stops it | What happens | Who clears it |
|---|---|---|---|
| 1 | The stop and the pull-lanyard at the machine | Every drive loses its energy; no software in the path. | A person at the machine, with a separate reset. |
| 2 | The manual release | One actuator comes away from its control, by spring, by hand. | A person at the machine. |
| 3 | Approach sensing on the machine | A person inside the zone holds the machine, then a safe stop. | A person at the machine, once the zone is clear. |
| 4 | Authorization withdrawn, by wire or at the dock | A controlled stop at the next safe point, then the task's safe state and the minimum-risk condition. | Re-authorization; the unit stays installed and will not run until then. |
| 5 | The planner's own stop | The software standing itself down. | Nothing it does clears a stop above it. |
Nothing on this list can be cleared from a distance, by a clock or by a message, and nothing on it starts the machine.
The safety controller shares no processor with the computer that plans the work. Freedom from interference is a requirement, and a shared processor cannot demonstrate it.
The independent safety controller has its own power and its own wiring, and when it says stop, nothing above it gets a vote. It commands the energy path: the removal of the energy that moves the drives, the pneumatic dump and enable, and the proof that every control has gone back to neutral. It depends on nothing in the planning computer, its operating system or any model for a safety action, and none of it is an option or a tier: it ships in full on every unit, on both profiles.
It watches the things that decide whether the machine may hold authority.
Everything it can do is a subtraction. It can hold the machine, take run permission away, dump the energy and prove neutral. It cannot start the machine, arm it, grant authority or clear its own stop; a person at the machine does that.
Lose power to any safety output and it falls safe, by spring or by design. Halt the safety controller itself and the machine settles into its safe state; holding it anywhere else takes power. The cameras, the planner, the network and the record can fail together, and the worst that follows is a stopped machine.
The unit does what its rule set allows and nothing else, and the rule set is not a setting the customer edits.
The rules ship sealed. Rule sets and firmware are signed. A hardware root of trust runs nothing unsigned. There is no debug access on a shipped unit. Tamper detection ends in a safe stop and a retained log, and the signing keys are held in Canada. Tamper resistance is chosen into the parts rather than bolted on afterwards, and a tampered unit stops being an operator.
Authorization is a lease: time-limited, signed, issued and withdrawable by Canadian Shield, and delivered by wire or at the dock, never by radio. An approval has three parts: what was approved, who approved it and when it ends. An approval with no expiry is not an approval.
Withdrawal and expiry end the same way: a controlled stop at the next safe point, then the task's own safe state, then the minimum-risk condition, never an instant stop over a wireless link. A de-authorized unit stays installed and will not run until it is re-authorized. The host machine is never touched: the operator can be withdrawn; the customer's iron cannot be reached.
Capability is not authorization. Prepared, installed and authorized are three separate states, and every screen, every gate and every record holds them apart. A boundary can only narrow: the work area, the exclusion zones and the route take permission away and never grant it.
The customer owns the machine and the hardware. The configuration and the application that make the hardware a Responder CS-810 or a Defender CS-820 are Canadian Shield's, licensed, sealed and revocable. That division is what puts the limits in the unit itself.
The physical stop and the manual release on every actuator are never part of the lease. A unit that has lost its authorization can still be stopped, released and lifted out by hand.
Most safety doctrine ends one way: leave the rules, reach a minimum-risk condition, call a person. On the ground this line is built for, a machine stopped in the open and waiting can itself be the harm.
In a burning structure or on a failing slope, stopping and waiting for a person can put a person in harm's way. So each task in each profile carries its own defined safe state, designed before the call and never chosen in the moment: withdraw to the dock line or along the tether, ground the implement and hold, or complete to a defined stop line.
That safe state is settled for each machine and each task ahead of the job, and written down at the pre-start. A single answer covering every machine would itself be unsafe. Every machine skill package carries its own abort and degraded-state logic. After any abort the machine reaches its safe state, then the minimum-risk condition, and then a person is called.
Uncertainty changes what the machine is permitted to do. Unknown state is a valid state: when the quality of what the machine knows falls below the threshold set for the task, the task system slows, stops, asks for human review or prohibits the skill. A machine can be clear of every obstacle and still be unsafe, because of slope, slip, load, swing inertia, tool contact, ground failure or an uncertain chassis orientation, and on a rotating machine the attitude of the upperstructure is never silently substituted for that of the chassis.
| State | What it means | What can happen |
|---|---|---|
| 0 · OEM | No unit fitted. The machine is exactly what the manufacturer built. | A person operates it. |
| 1 · Installed, disengaged | In the dock and belted in; the couplers parked on the controls, force-free. | A person can sit down and drive. The unit has no authority. |
| 2 · Armed | Authorized and calibrated, holding. Wrong-side or wrong-configuration seating is blocked here. | Waiting for the task, under a live lease. |
| 3 · Autonomous control | Running the authorized task, inside the defined movement space, under the guidance tier in force. | Every stop above the planner stays in reach. |
| 4 · Fault or safe | Outside the rules, tampered with, or de-authorized. | The task's own safe state, then the minimum-risk condition, then a person is called. |
Seven authority modes run beside the five states, from off through manual, assist, approach and teleoperation to autonomous, with maintenance held apart. The mode-and-state pairs that must never happen are written down as forbidden.
The unit operates the machine through its own controls, so everything the manufacturer built into it is still there and still doing its job.
No harness is tapped, no controller is flashed and no manufacturer software is touched, so the machine's own safety systems are left in place and operating. The pilot control lockout lever was on the machine before the unit arrived and stays after it lifts out; the unit works it exactly as an operator does. The seat belt, the lockout lever, the park brake, the horn and the lights are checked working at every pre-start, as the machine's own.
The park brake stays the machine's protection and is never the unit's stop path. The unit may apply and release the machine's parking-brake control only through a higher-integrity module, under a completed machine-specific safety case, with independent confirmation of the brake's state. Defeating the park brake, or using it as the unit's stop, is banned.
Where the unit drives a steering wheel, it drives from the wheel's centre through a machine-specific adapter plate; the wheel is unmodified, the rim stays free for a person's hands, the drive is back-driveable with a mechanical torque limiter, and the wheel's position is sensed independently. Key rotation is left out of the actuator set: a key is a person's authority token.
The machine's diagnostics stay the machine's. No diagnostic path for it runs through the unit and there are no new fault codes in the shop, because nothing of the unit's is on the machine's electronics.
No radio and no GNSS anywhere on this line. Nothing aboard transmits by radio, nothing guides on a link, and nothing that people's lives rest on is carried over the air.
The idea comes up on every site: hand each person a lanyard with a kill for the machine. It is refused. A radio stop can arrive late, meet a jammed band, run on a flat battery or fall out of range, and the person holding it cannot tell which. Protection people depend on belongs on the machine itself, wired to it. So the stop, the pull-lanyard and the approach sensing are on the machine, on wire, and there is no carried wireless button on this line.
Wireless never carries the safety loop or a motion command. That is a rule of the line, not a configuration. Radios and GNSS receivers aboard: none. The authorization arrives by wire or at the dock, and a withdrawal is a controlled stop at the next safe point on the wired safety loop, never an instant stop over a link.
The three guidance tiers keep the same rule.
Loss of the fibre causes a defined stop or degrade, never an uncontrolled continuation. No external link, lost or compromised, can create actuator authority: the machine-control and safety networks stay segregated from the service and mission networks.
Every connection the unit makes to the machine is mechanical or optical, with one exception: a fused feed from the accessory point. Nothing of the unit's touches the CAN bus, the ECU or the firmware.
The dock is the machine's own seat-belt anchors and pins, and it stays with the machine. The unit's body sits in a cradle on the seat pan, with the machine's own lap belt threaded through a closed tunnel between the cradle rails. Actuator modules pin to controls that are already there: hand levers, a tiller, the steering wheel from its centre, pedals, gates, rotaries and switch stations. A camera reads the dash, so the unit takes the machine's instruments by looking at them rather than by tapping its bus.
The one wire is a fused feed from the accessory point. The unit runs its modules at 24 VDC family-wide; a 12 V machine gets conversion in the fit kit. The unit's own modules talk to each other on the unit's own CAN 2.0 and Ethernet, wired, and that network never meets the machine's.
The unit brings its own eyes: its own cameras and proximity sensing, all of it carried on the unit; it never uses the machine's sensors or its bus. A new machine and one older than the crew running it are handled the same way: if a person can work the controls, the unit can. The mechanism, piece by piece, is on How it works.
On an older machine, worn and sloppy controls are the normal condition, and no two behave alike. So the unit calibrates every day it works, and everything it does is written where nothing can be quietly changed.
Before the first task of the day the unit works each coupled control through a set of steps: it finds neutral, it finds the limits, it measures the slack before the machine answers, and it checks how the control returns when it is let go. Nothing is trusted from the day before.
Commissioning is a safety act, done per machine: control zero, travel, the force and rate maps and the neutral proof are established on the machine; static diagnostics and fault injection follow; bounded controlled motion runs under qualified supervision before the envelope is accepted and the configuration is signed and sealed. Any change to a coupler liner or insert invalidates that commissioning; the short proof is run again before motion authority.
Every act goes on one chained record and nothing is deleted: every intervention, every safety decision, every safety-software version, every calibration and every authorization, tied to the machine it was on. An incident is the difference between what was commanded and what actually moved, and it cannot be reported unless both were recorded. After an event the record produces the evidence package.
A person walks around the machine and completes the pre-start inspection. A person starts the machine on Responder and civil work, every session. On Defender the machine may be started on a remote command from the stand-off station, over the tether, on ground closed to everyone the job does not need and with nobody at the machine; the authorization, the wired stop and the manual release are unchanged by it.
Removable by design means the machine is a machine again in minutes, and there is a written procedure for every state in between.
Power isolated, the unit's air vented and every manual release pulled, in the machine's own names for its energy sources.
A named person tags the unit. Before anyone signs the machine back, it is proven to be a machine again.
Unbuckle it and lift it out. The dock stays: the belt anchors and the pins. The return of the operator station to standard is documented and inspected.
Human-only operation is a designed state, demonstrated at every pre-start before the unit is trusted: the unit released, the machine run by hand and returned to a safe state.
Two jobs follow the same written lockout and tagout procedure: service work while the unit is fitted, and stripping the unit and the dock off a machine for good. What the unit touches is the machine's own controls and nothing else. If the unit stops mid-task, the recovery plan is stated before the job: who goes, what they do first and who they tell.
Teaching is a disconnected state. When an operator's technique is being captured, a person is in the seat and the unit is out of it; the capture instrument is a standalone rig wired to nothing on the machine and nothing of the unit's. Nothing it records reaches a control path in any mode. How captured technique becomes a signed skill is on the Autonomy page; the crew's procedures and training are on Operations.
Each refusal is a property of how the unit is built, with the reason beside it. None of them is a setting.
An empty seat is not the difficult part. The difficult part is everything around it: the truck backing in, the person walking behind the tracks.
Procedures, training, exclusion zones, recovery and maintenance are part of the safety system. The exclusion zone is drawn from the machine's reach and how fast it swings, and it is marked on the ground, not only on a screen. Segregation comes first: gates, spotters, barriers and a sweep before work. Approach sensing on the machine is the last resort, never the plan.
What a crew used to read off the operator's face is put back where it can be seen from a distance: a light tower on the machine, an indicator giving the direction of the swing, and a broadband warning sound. White while the unit is working, amber for a machine asked to stand down, red for a fault, steady and never flashing. The signal is advisory; it stops nothing. A named person, competent on this machine and this task, is present. Everyone on site is briefed on what the unit is, what it is about to do and how to stop it, and every person in the area has a way to stop it within reach.
On the fibre tether, the person at the stand-off station sees the current mode and authority chain, the approval envelope and when it ends, the active skill, calibration health, perception confidence and the independent safety status. The job is cleared before the machine is. The unit files its own pre-start declaration and a person accepts it by typing their name; there is no override, and the highest state a unit can reach on its own is ready to ask. The full pre-start is on the Operations page, and every item on it is answered by a person on the day.
| What can go wrong | What answers it |
|---|---|
| A person on foot inside the machine's reach | Segregation first; sensing on the machine is the last resort, never the plan. |
| Struck-by at load-out, with no operator body language | Haul routes and load-out lanes planned before any signal is relied on; the machine only reports its own state, and the driver keeps every decision. |
| A unit accepting its own paperwork | Every path to acceptance ends in a typed human name. |
| A machine that woke itself up | It cannot wake itself. Every start is a person's act at the machine or a person's command from the stand-off station, and key rotation is never in the actuator set. |
Machine-specific hazards feed the FMEA, the hazard analysis and the test plan for every configuration.
Four standards are named at design. The safety case is never generic: it is written for one machine, one task set and one configuration.
The safety functions are designed to the architecture of ISO 13849, with independent means of removing control. ISO 17757, the standard for autonomous earth-moving machinery, is the one this safety design is built toward. ISO 12100 and ISO 19014 are named at design beside them.
The safety case is per machine, per task and per configuration. An independent safety authority, a named function with the right to hold a release, stands apart from the program that builds the unit.
| The claim | How it is engineered |
|---|---|
| The planner cannot energize an actuator | Privilege separation between the planning computer and the actuator path. |
| Independent safety can remove motion energy | The electrical and pneumatic design of the energy path, exercised by fault injection at commissioning. |
| The machine reaches a defined safe state after an abort | Neutral, pressure and position evidence read back, never assumed from the command. |
| Commands stay within machine limits | The controller's firmware limits and the calibration limits set on that machine. |
| Degraded perception is detected | Diagnostics on every safety-relevant sensor, with thresholds and a defined response. |
| The skill on the machine is the skill in the case | A signed manifest checked against the machine's configuration record at deployment. |
| Human intervention works in every defined mode | The stop, the release and the lockout lever, with the procedures walked at every pre-start. |
Each claim, and the engineering that carries it.
The unit operates a machine through its own controls, and nothing is cut, tapped or flashed. That is an engineering property, not a legal opinion. Whether an installation bears on a warranty, a conformity assessment or a liability position turns on the machine, the jurisdiction and the contract, and that question belongs to counsel.
Three people usually decide whether a machine gets an operator in the seat: the safety officer, the maintenance lead and counsel. A crew works beside it every day.
The conversation starts with a screened enquiry and the machines you already run. Nothing on this page is an offer.
Bring the seat you cannot fill safely, the machine it is in and the hazard rows your own analysis names. Every enquiry is screened before any discussion; supply is subject to Canadian export permits issued per shipment, export posture is counsel-first, and Controlled Goods Program status is disclosed to qualified enquiries. The reply comes in writing, from a person.
The line as a whole is on the CDNS Autonomy page. The mechanism is on How it works. What the planner may propose, and how a skill earns its place, is on Autonomy. The pre-start, training and the crew's procedures are on Operations. The two profiles have pages of their own: Responder CS-810 for emergency services and Defender CS-820 for defence engineering.
Patent pending. Export-controlled: international transfer is subject to Canadian government permits. Designations and profile names are current as issued and subject to change without notice. Nothing on this page is an offer, a commitment or a representation to any government body.
