The emergency-services profile of CDNS Autonomy. A removable operator for the excavator, dozer, loader or tractor an agency already owns: the machine goes into the hazard and the crew stays out.
Reach, lift, mass and endurance stay the host machine's own figures: the unit adds an operator, not a chassis. Its own figures are counted in modules, wires, modes and states, and its case is the seat it empties.
Fire ground, structural collapse, hazmat, flood and wildfire earthworks put the seat inside the exposure. Responder sends the agency's own machine onto that ground with nobody in the seat.
It works the controls a person works, so an older machine counts the same as a new one. Nothing is cut, wired or reprogrammed, and the same machine takes a crew again the moment the unit lifts out.
On a burning structure or a failing slope, stopping to wait for a person can itself be the harm. Each task carries its own safe state, chosen ahead of the call and never in the moment.
The line refuses one thing: it never operates a weapon and never fires anything. Human safety comes first, and the wired stop and the manual release on every actuator always remain.
The functional specification of Responder CS-810, grouped the way a fleet buyer and a safety officer read it. No reach, lift, mass or endurance figure appears here, because those belong to the machine the unit sits in.
Host machines and fitSeat, dock and mountingControls workedElectrical, data and sensingGuidance and authoritySafety functionsEnvelope and scopeRecord, sustainment and trainingStandards, patent and export
| Parameter | Value | Basis |
|---|---|---|
| Engineering plant | Excavators, dozers, loaders, graders | a machine family on the Responder profile: hazardous earthworks, debris and rubble, route support |
| Terrain and base support | Tractors and implement carriers | a machine family on the Responder profile: firebreaks, snow and ice, terrain maintenance |
| Logistics and handling | Forklifts, telehandlers, material handlers | a machine family on the Responder profile: remote depots, hazardous handling, yard logistics |
| Customer-defined families | A machine family the agency names | a specific conversion follows an engineering survey and qualification |
| Model year | Not a requirement | the interface is the human interface; a machine with no CAN bus, ECU or firmware is worked like new iron |
| Changes to the host machine | None: nothing cut, wired, drilled, welded or reprogrammed | the conversion happens on the unit's side of the line |
| Supported list | One qualified configuration at a time | each machine surveyed, fitted with its own kit, calibrated and recorded |
| Reference machines | The group's own excavator, dozer and wheel loader | where the engineering-plant family's first configurations are worked out |
| Parameter | Value | Basis |
|---|---|---|
| Operator's place | The operator's own seat | the unit's body in a cradle resting on the OEM seat pan |
| Restraint | The machine's own lap belt | threaded fore and aft through a closed tunnel between the cradle rails |
| Dock | The machine's own seat-belt anchors and pins | fitted once, ahead of any call; it stays with the machine when the unit lifts out |
| Installation | Mechanical throughout | nothing welded and nothing drilled; every part built to come off and move to the next machine |
| Removal | Lifts out in minutes | the operator station returned to baseline and inspected; the machine standard again |
| Between callouts | The unit stays in its case | the machine works as it always has, with a person in the seat |
| Parameter | Value | Basis |
|---|---|---|
| Actuator modules | 13 across the family | working the machine's own joysticks, levers, wheel, pedals and switches |
| Interface families | 6 | dual-axis hand control, rotary control, linear foot control, discrete control, instrument observation, dynamic-state sensing |
| Controls worked | The machine's own joysticks, levers, wheel, pedals and switches | controls the manufacturer fitted for a person to use |
| Steering | From the centre of the machine's own wheel | through a machine-specific adapter plate; the wheel undrilled and the rim free for a person's hands |
| Steering drive | Back-driveable through a mechanical torque limiter | wheel position sensed independently; the adapter engages the wheel, not the column |
| Travel levers | A split clamp with a compliant insert | no drilling, no adhesive and no permanent change to the lever |
| Control force | Limited by machine type | the type is set in the software first; no control sees more force than that kind of machine should |
| Key rotation | Excluded from the actuator set | a key is a human authority token; a person starts the machine |
| Parking-brake control | Only through a higher-integrity module | under a completed machine-specific safety case with independent state confirmation; never the unit's stop path |
| Parameter | Value | Basis |
|---|---|---|
| Host bus connection | None | no link to the machine's CAN bus, ECU or firmware |
| Wires into the machine | 1: a fused feed from the accessory point | the only conductor that crosses between the unit and the machine |
| Supply | 24 VDC family-wide | a 12 V machine takes its conversion in the fit kit |
| Unit network | CAN 2.0 and Ethernet, wired only | the unit's own harness; that network never meets the machine's |
| Wireless | Never carries the safety loop or a motion command | a rule of the line, not a setting |
| Radios and satellite receivers aboard | 0 | guidance is preset, fibre or onboard optical-AI |
| Instruments | Read by a camera aimed at the dash | gauges, warning lights and displays observed rather than depended on |
| Perception | Onboard and passive | the unit's own cameras and proximity sensing; the machine's sensors are never used |
| Attitude | Measured on the unit's own instruments | the angle between house and tracks read optically, with nothing touching the machine's swing electronics |
| Network segregation | Machine-control and safety networks kept apart from service and mission networks | a lost or compromised external link cannot create actuator authority |
| Parameter | Value | Basis |
|---|---|---|
| Guidance tiers | 3: preset at the dock, an optical fibre to a stand-off station, onboard optical-AI | selected for the task; no fourth tier and no radio option |
| Authority modes | 7: off, manual, assist, approach, teleoperation, autonomous, maintenance | maintenance held apart from the working chain |
| Mechanical states | 5: OEM, installed and disengaged, armed, autonomous control, fault or safe | tracked independently of the authority mode |
| Authority order | Independent safety first; every person above the software | authority runs one way; each layer is built with a limit it cannot cross, and sensing can remove authority but never create it |
| Task authorization | A named person on the crew | before anything moves, machine by machine and callout by callout |
| Line authorization | A lease, signed and time-limited | issued and withdrawable by Canadian Shield; delivered by wire or at the dock, never by radio |
| Withdrawal or expiry | A safe stop, then the minimum-risk condition | the unit stays installed and will not run until re-authorized; the agency's machine is never touched |
| Rule sets and firmware | Signed and sealed | a hardware root of trust runs nothing unsigned; no debug access on a shipped unit |
| Tampering | Ends in a safe stop and a retained log | a property of the build, not a setting |
| Keys | Held in Canada | every change that reaches a machine is signed, and the authority to sign it is held there |
| Machine identity | Runs only on the machine it was set up for | a mismatch leaves no motion authority; wrong-side or wrong-configuration seating is blocked at armed |
| Starting the machine | A person, every session | the unit never turns a key, and never starts, wakes or inspects a machine |
| Parameter | Value | Basis |
|---|---|---|
| Stop | Wired into the unit's own safety controller | no software in the path; it stays down once pressed, with a pull-lanyard wired into the same path |
| Manual release | On every actuator: one hand, no tool | performed by a spring, so it releases with the air gone and the power off |
| Clearing a stop | A person at the machine, with a separate reset | no stop is cleared from a distance, by a clock or by a message |
| Independent safety controller | Its own hardware, power and wiring | it can hold the machine, take run permission away, dump the energy and prove neutral; it cannot start, arm or grant authority |
| Loss of power to a safety output | Falls safe | by spring or by design; holding the machine anywhere else takes power |
| Approach sensing | On the machine, wired | a person inside the zone stops the machine, and a person at the machine clears it; it can remove authority and never create it |
| External sensing | Can remove authority; never creates it | a clear picture is never a reason to proceed |
| Task safe states | One of three, set per task before the call | never improvised; stopping in place is not always the safe answer |
| After the safe state | The minimum-risk condition, then a person is called | whichever safe state the task reached |
| Degraded state quality | The task slows, stops, asks for human review or prohibits the skill | below the threshold set for the task; unknown state is a valid state |
| The machine's own safeguards | Left in place and working | seat belt, lockout lever, park brake, horn and lights checked working at every pre-start |
| Lockout and tagout | A written procedure | for service with the unit fitted, and for stripping the unit and the dock off a machine |
| Parameter | Value | Basis |
|---|---|---|
| Work area | Defined by someone on the crew | the boundary can only narrow the task, never widen it |
| Task limits | Speed, slope, reach and distance from the line | limits, not suggestions to the planner |
| Callouts in scope | Wildfire guard and fuel breaks; structural collapse; contaminated ground and spill; flood and breach closure; debris and rubble clearance; a slope after a failure | each with a defined work area and a person on hand to authorize and watch it |
| Route opening | In scope only with the route closed | the route is closed to traffic while the machine works it, or the task is refused |
| People inside the work area | Refused | a rescue with people inside the machine's reach is refused |
| Public traffic within reach | Refused | on every profile |
| Smoke on the fire ground | Can blind the sensing | the wildfire task's safe state covers it |
| Fitment | For a task, for an authorized period | never permanent and unattended; the dock stays, the unit does not |
| Production rate or response time | Neither is offered | the unit empties a seat |
| Weapons | Never operates a weapon; never fires anything | the line's one refusal |
| Parameter | Value | Basis |
|---|---|---|
| Record | Every act on one chained record | the person's and the machine's; nothing deleted |
| Configuration record | 13 domains | host platform, human controls, machine kit, energy, compute, sensors, harness, software, calibration, skills, safety, maintenance and release |
| Calibration | Every coupled control, every day it works | through neutral, limits and return; nothing trusted from the day before |
| Commissioning | A safety act, per machine | a defined sequence, completed before the configuration is signed and sealed with a rollback package |
| Coupler liner or insert change | Invalidates commissioning | the short proof runs again before motion authority returns |
| Way of working in the seat | Chosen by a person before every session | there is no default and no last-used, and the record carries the name of whoever chose |
| New behaviour | By signed release only | runtime learning gathers evidence and cannot promote a behaviour on its own |
| Training | By role: operator, maintainer, depot, engineering support | controlled publications for installation, operation, maintenance, recovery and safety; measured as independence |
| Repair | Serialized line-replaceable units and machine-family spares kits | depot repair and secure re-image in Canada and in selected allied depots |
| Updates | Offline and signed | authenticity, compatibility and rollback checked before install; a named person signs for each |
| Ownership | The agency owns the machine and the hardware | the configuration and application are Canadian Shield's, licensed and revocable |
| Parameter | Value | Basis |
|---|---|---|
| Standards named at design | ISO 12100 · ISO 13849 · ISO 17757 · ISO 19014 | an architecture of ISO 13849 for the safety functions, with independent means of removing control; a safety design built toward ISO 17757 |
| Safety case | Per machine, per task, per configuration | never generic |
| Patent | Patent pending | the designs on the line |
| Export | Subject to Canadian government permits, issued per shipment | export posture counsel-first |
Fire ground, structural collapse, hazmat, flood and wildfire earthworks, rubble and route clearance: a machine is built for that ground, and the seat inside it is not.
Responder CS-810 is a self-contained unit that sits in the operator's seat of a machine an agency already owns, under that machine's own lap belt, and works the joysticks, levers, pedals and switches the manufacturer fitted. A camera reads the dash. It never connects to the machine's CAN bus, ECU or firmware; the only wire between the two is a fused feed from the accessory point. When the seat is needed again the unit lifts out, in minutes, and the machine is standard.
The purpose is to put the machine into the fire, the flood, the collapse or the contaminated ground and leave the person outside it, standing where the water, the slope or the plume is not.
Responder is one of two profiles on the CDNS Autonomy line. Defender CS-820 carries the same unit into defence engineering. The hardware does not change between them; the rule set does: the tasks each may run, the movement space it may use, and the safe state it goes to when something falls outside the rules.
On a callout the planner proposes the moves, the rule set written for that task bounds them, a named person on the crew authorizes the job before anything moves, and the stop and the manual release can only take the machine's authority away, never grant it.
Earthwork that comes with fire, rescue, hazmat and disaster response, on machines the agency already runs, each with a defined work area and a person on hand to authorize and watch it.
Cutting line ahead of a fire and holding a guard on ground a crew would rather not stand on for the time it takes. Heat, smoke and a moving front are the seat's exposure.
Clearing what a collapse left standing before anyone has to walk under it. The machine works the footprint with nobody inside its reach, and people go in when it has stopped.
Working ground where the hazard is in it, not only on top of it, downwind of a plume nobody should breathe for a shift. The machine sits in the hot zone; the person authorizing it does not.
Berms and closures across moving or open water, and the rock and fill work that goes with them. The failing embankment is the one the seat would sit on.
Moving what a disaster left behind so that people and vehicles can move again, before anyone has to walk the pile.
Reopening a road or an access route so the rest of the response can follow it in. The route is closed to traffic while the machine works it, or the task is refused.
| Task | Verdict |
|---|---|
| Wildfire guard and fuel breaks | In scope; smoke can blind the sensing, and the task's safe state covers it |
| Structural collapse | In scope |
| Contaminated ground and spill | In scope |
| Flood and breach closure | In scope |
| Debris and rubble clearance | In scope |
| Route opening | In scope only with the route closed |
| A slope after a failure | In scope |
| Rescue with people inside the work area | Refused: people within the machine's reach |
| Public-road work during a response | Refused: public traffic within reach of the machine |
The group's own crews have closed rock causeways and breaches across open water at Weed Lake, Alberta, working an amphibious excavator off the rock and a boat, with a person in the seat throughout. Responder is written for that ground, and for that seat.
Three things define every Responder task before the call comes, and on the seats this profile fills, stopping to wait is not always the safe answer.
What the machine is allowed to do, written with entry conditions, an operating envelope and the perception confidence it needs before it moves. A situation the rules do not cover goes to the safe state and waits on a person.
A work area and a boundary that someone on the crew has defined. The boundary can only narrow the task, never widen it, and speed, slope, reach and distance from the line are limits rather than suggestions to the planner.
What the machine does when authorization ends, a limit is crossed or the sensing degrades. It is chosen for that task ahead of the call, because the moment a limit is crossed is the wrong moment to decide what safe means.
In a burning structure or on a failing slope, a machine that stops and waits for a person can itself put a person in harm's way. So each task carries its own defined safe state, one of three, and stopping is not the only answer. Which one applies is set by the task and never improvised after the fact. If the machine reaches that state and stays there, it drops to the minimum-risk condition and a person is called.
Uncertainty narrows what the machine may do. When the quality of what it knows falls below the threshold set for the task, the task system slows, stops, asks for human review or prohibits the skill. None of this bends the authority chain for the tempo of an emergency: the rules ship sealed and signed, a person authorizes the task before it runs, and the physical stop and the manual release on every actuator always remain.
The unit is restrained by equipment the manufacturer already fitted, and every actuator pins to a control the machine already has.
The unit's body sits in a cradle resting on the OEM seat pan, and the machine's own lap belt threads through a closed tunnel between the cradle rails, running fore and aft because nothing fits across. The dock is the machine's own seat-belt anchors and pins, fitted once and left with the machine. Nothing is welded and nothing is drilled, and every part is built to come off and move to the next machine.
Steering is driven from the centre of the machine's own wheel through an adapter plate made for that wheel. The wheel is not drilled, the rim stays free for a pair of hands, the drive is back-driveable through a mechanical torque limiter, and wheel position is sensed independently. Key rotation is left out of the actuator set, because a key is a human's authority token. The parking-brake control is worked only through a higher-integrity module under a completed machine-specific safety case, with independent confirmation of the brake's state, and it is never the unit's stop path.
| Interface family | What it is in the cab | What the kit does with it |
|---|---|---|
| Dual-axis hand control | Joysticks and tillers | A module pins to the control and works it through the travel learned on that machine |
| Rotary control | Steering wheels and rotary selectors | Driven from the wheel's centre through a machine-specific adapter plate, the rim left free |
| Linear foot control | Brake, throttle and travel pedals | Worked through the stroke and released the way the machine's own return intends |
| Discrete control | Buttons, switches and selectors | One position at a time; the key stays a person's authority token |
| Instrument observation | The dash, displays and indicators | A camera reads them, so nothing is taken off the machine's bus |
| Dynamic-state sensing | Attitude, external perception and linkage state | Carried on the unit, on the unit's own wiring, borrowing nothing from the host |
The whole electrical boundary between the unit and the machine is a single fused accessory feed. The unit reads the dash through a lens, senses the world with its own instruments, and carries nothing that transmits.
The unit never connects to the machine's CAN bus, its ECU or its firmware. Its actuators, controllers, stop network and sensing run on a harness of their own, and none of that harness lands on the machine's. Inside the unit, modules talk over CAN 2.0 and Ethernet, wired only, and supply is 24 VDC across the family; a 12 V machine takes its conversion inside the fit kit.
A camera is aimed at the dashboard, so gauges, warning lights and displays are read optically rather than depended on, and a machine that publishes nothing on a bus is as readable as one that publishes everything. Perception is onboard and passive: the unit carries its own cameras and proximity sensing and never borrows the machine's sensors. Attitude is measured on the unit's own instruments, and on a machine that rotates, the angle between house and tracks is read optically, so upperstructure attitude is never quietly substituted for chassis attitude.
Machine-control and safety networks stay segregated from service and mission networks, and the loss or compromise of an external link cannot create actuator authority. A link can ask for less, and never for more.
| Path | How it travels |
|---|---|
| Motion commands | CAN 2.0 and Ethernet, on the unit's own wiring |
| The safety loop | Wired on its own; wireless never carries it |
| The authorization lease | By wire or at the dock, never by radio |
| Tier 2 guidance | An optical fibre to a person at a stand-off station |
| The machine's instruments | A camera on the dash, never the machine's bus |
| Power into the unit | One fused feed from the machine's accessory point |
| Radios and satellite receivers aboard | None |
A machine with no CAN bus, no ECU and no firmware is worked exactly like new iron, because the unit only operates what a person operates. There is no integration work to buy and no new fault codes waiting in the shop.
The dock goes on once. What follows is the cycle a crew runs on the day, and the machine is standard again at the end of it.
The dock anchors to the machine's own seat-belt anchors and pins, ahead of any call. The machine goes back to its ordinary work with a person in the seat and nothing changed, and the unit stays in its case until a seat needs filling.
On the callout the unit sets into the dock and belts in, the couplers land on the machine's own controls, the camera is aimed at the dash, and the rule set for the task loads before anything moves.
The unit works each coupled control through neutral, its limits and how it returns when released. Controls wear and no two machines are alike, so nothing is trusted from the day before.
The lease arrives by wire or at the dock, the guidance tier is set, and a named person clears the task. It then runs inside its sealed rule set until it is done, authorization is withdrawn or a limit is crossed.
When the task is done or the seat is needed again, the unit lifts out. Nothing was cut, wired or reprogrammed, and the machine is what its manufacturer built.
A person on the crew completes the pre-start and starts the machine, every session, and every item on the pre-start is answered by a person on the day. The unit never starts, wakes or inspects the machine.
Before every session a person also chooses whose way of working is in the seat. There is no default and no last-used, and the record carries the name of whoever chose.
Nothing runs until a named person clears it, and nothing that can expire, be withdrawn or be edited stands between a person at the machine and stopping it.
Independent safety outranks everything. A person comes next, and anyone at the machine can take control away with one hand, at any time. Every person outranks the software: the controller executes approved motion inside the machine's limits and cannot widen the envelope a person approved, and the planner proposes and cannot energize an actuator or grant itself authority. External sensing can remove authority and never create it.
| Rank | What stops it | What happens | Who clears it |
|---|---|---|---|
| 1 | The stop and the pull-lanyard at the machine | Every drive loses its energy, with no software in the path | A person at the machine, with a separate reset |
| 2 | The manual release | One actuator comes away from its control, by spring, by hand | A person at the machine |
| 3 | Approach sensing on the machine | A person inside the zone stops the machine | A person at the machine, once the zone is clear |
| 4 | Authorization withdrawn, by wire or at the dock | A controlled stop at the next safe point, then the minimum-risk condition | Re-authorization; the unit stays installed and will not run until then |
| 5 | The planner's own stop | The software standing itself down | Nothing it does clears a stop above it |
It fits the plant an agency already owns, because it works through the controls a person uses and never through the machine's electronics.
The machines that dig, push and load: hazardous earthworks, debris and rubble, route support. The group's own excavator, dozer and wheel loader are the family's reference machines.
Firebreaks, snow and ice, terrain maintenance and the work around a base or a camp, on the tractor a county already runs.
Remote depots, hazardous handling and yard logistics, on the plant a depot already operates.
A machine family an agency names. A specific conversion follows an engineering survey and qualification.
| Machine | What the unit works |
|---|---|
| Tracked excavators | Two joysticks, two travel controls, the throttle dial and the machine's own pilot lockout lever |
| Dozers | Steering, forward-neutral-reverse, the gear selector, the parking brake, the blade and the ripper |
| Wheel loaders | Wheel steering, the pedals and the implement joystick |
| Compact track and skid steers | Joysticks and auxiliary functions in a compact cab |
| Backhoes | Driving controls at the front, hoe controls at the rear |
| Forklifts | Steering, directional control, throttle and brake, and the mast levers |
| Telehandlers | Steering, travel, the boom and the attachment controls |
| Tractors and implement carriers | Steering, pedals, implement controls, hydraulic valves and the power take-off |
What a survey measures.
What a survey decides.
A mixed municipal or contractor fleet is one system, not one program per make and year, and older machines are often the ones with the seat problem in the first place. Each machine is surveyed, fitted with its own kit, calibrated every day it works and recorded, and the same fleet serves crewed and uncrewed work.
Operators, maintainers, depot and engineering support are trained by role, repair is domestic, and every converted machine carries a record of exactly what is fielded on it.
Clears the job, completes the pre-start, starts the machine, chooses whose way of working is in the seat and holds the stop, trained on the machine class, the task and what the display is saying.
Daily calibration and what its record means, module exchange and recalibration, field diagnostic tooling with bounded privileges, and the hand-back of the operator station.
Serialized line-replaceable units, machine-family spares kits, repair-triggered recalibration and secure re-image, in Canada and in selected allied depots.
The survey and qualification path that adds a machine to the supported list, and the signed release that carries a new skill to a unit.
Every act on a shift, the person's and the machine's, lands on one chained record, and nothing is deleted; a correction is a new entry naming the one it corrects. Behind it sits the configuration record, thirteen domains from the host platform and its human controls to the skills, safety, maintenance and release, and a skill loads only against the configuration it was frozen for. The agency owns the machine and the hardware. The configuration and the application that make it Responder CS-810 are Canadian Shield's, licensed and revocable, so Canadian Shield can withdraw the operator and can never reach the machine.
Every row is a property of how the unit is built, not a setting an agency can change.
| It never | Because |
|---|---|
| Operates a weapon, or fires anything | Human safety comes first, on every line. It is the line's one refusal. |
| Starts the machine | A key is a human authority token. Key rotation is left out of the actuator set on purpose, and a person starts the machine. |
| Works with public traffic within reach | Public-traffic work is refused on every profile. The work area is closed ground with a person authorizing it. |
| Runs with people inside the work area | The seat is what it empties. A rescue with people inside the machine's reach is refused. |
| Stays fitted permanently and unattended | It is fitted for a task, authorized for a period, and lifted out. The dock stays; the unit does not. |
| Connects to the machine's CAN bus, ECU or firmware | It works the controls a person works. The one wire is a fused feed from the accessory point, and nothing is cut, wired or flashed to accept it. |
| Carries a radio or a satellite receiver | Guidance is preset, fibre or onboard optical-AI, and wireless never carries the safety loop or a motion command. |
| Runs outside its rule set, or while de-authorized | The rules ship sealed and signed; a de-authorized unit stays installed and will not run, and the agency's machine is never touched. |
| Promises a production rate or a response time | It empties a seat. Neither a rate of work nor a time to arrive is offered. |
Responder runs the same three guidance tiers as Defender. The tier is chosen for the task rather than for the customer, and there is no fourth tier and no radio option.
The task program is loaded when the unit is set into the dock. While it runs nothing is emitted and nothing is received, so there is no link to deny and no emission to find.
An optical fibre runs back to a person at a stand-off station, out of the seat and authorizing every decision that matters. It is a physical line, not a channel in the radio bands.
Perception and planning run on the unit inside the sealed rule set, with no emissions, no link and no satellite. The planner proposes, the rules govern, a person authorized the task and safety keeps its veto.
The lines that hold on every Responder task, for every agency and on every machine.
The page this sheet specifies, and the sheets beside it in the line.
The page this sheet specifies, with the pictures and the reasoning.
Every product and platform on one sheet each, on the web and as a PDF.
Tell us which machines the agency runs and the seat you would rather nobody sat in. The reply names which of them the line covers and what a first task on your own ground would look like. Every enquiry is screened before any discussion, and supply is subject to Canadian export permits issued per shipment.
Patent pending. Export-controlled: international transfer is subject to Canadian government permits. Designations and profile names are current as issued and subject to change without notice. Nothing on this sheet is an offer, a commitment or a representation to any government body.
