The engineering of the removable operator: how it mounts on the machine's own seat pan, what it works, what it never connects to, what it records, and what a conversion takes from survey to hand-back. One fused feed from the accessory point is the only wire that crosses into the machine.
The case for converting the plant you already run is made on the front door. What follows is the engineering that case commits you to, machine by machine.
A machine built for earthworks can sit under a highwall, on contaminated ground, in a structure that is still moving, or on a route that has not been cleared. The seat cannot. Converting plant that is already in the yard or already in theatre puts the machine on that ground and leaves the person where the slope, the plume or the fire is not. Nothing is procured, shipped, parked or fuelled: the capability arrives as a dock, a fit kit and a unit.
What that commits you to is a machine-specific conversion rather than universal autonomy. Each configuration is surveyed, fitted with its own kit, calibrated and recorded before the unit will move anything on it, and the unit checks it is on that machine before it holds any authority to move. The supported list grows one qualified configuration at a time. The line is engineered and sold by machine family, and behind each family sits a controlled list of the exact supported configurations; the machines page carries the seven families and what a survey asks of you.
The interface is the human interface. A mixed fleet of different makes and ages is therefore approached as one system rather than one program per make and year, and a machine with no CAN bus, no ECU and no firmware is worked the same way as new iron. The kit is engineered around six interface families that recur in every cab, and it reads the gauges and warning lights by looking at them rather than by depending on the machine's own bus. Older machines are often the ones with the seat problem. The CDNS Autonomy front door carries the shorter case for the line and its two profiles.
Each qualified configuration leaves a body of work behind it, and that body is what the supported list is made of: the physical interfaces to the machine's own controls, the control-geometry survey, the actuator calibrations, the perception configuration, the machine dynamics, the safety case, the operator demonstrations, the validated skill packages and the field-service procedures, all held against that one configuration and signed with it. None of it is assumed for a machine that has not been through the survey, the fit, the calibration and the bounded commissioning. Until it has, the unit will not move it. The how it works page carries the mechanism in full, and operations carries what a converted machine does across a working day.
Only the last of those four is a wire into the machine.
The seat. The unit's body sits in a cradle resting on the machine's own seat pan, in the operator's seat, with the machine's own lap belt threaded through a closed tunnel between the cradle rails. The belt runs fore and aft because nothing fits across. There is no separate dock structure at the operator station, because there is no room for one; the dock is the machine's own anchors and pins.
The dock. The dock is the machine's own seat-belt anchors and pins, and it stays with the machine. It is fitted once, ahead of any call. With the unit out, the dock is part of the cab and the machine works as it always has.
The controls. Actuator modules pin to whatever the machine already has: hand levers and a tiller, the steering wheel from its centre through a machine-specific adapter plate, pedals, gates, rotaries and switch stations. Thirteen modules cover the family: the hands, the wheel, the pedals, the gates and rotaries, the switches, the sensing, the dock and the core. A camera reads the dash the way an operator would. Key rotation is left out of the actuator set on purpose, because a key is a person's authority token.
The wire. A fused feed from the accessory point is the only wire that crosses into the machine. The unit's own actuators, sensing and safety controller run on wiring of their own, and none of it touches the machine's. It brings its own eyes, its own cameras and proximity sensing carried on the unit, and never uses the machine's sensors or its bus. It reads the gauges and warning lights by looking at them.
Nothing on the unit transmits over the air, and nothing guides on a satellite. Guidance runs one of three ways, all of them without a radio.
The task program is loaded when the unit is set into the dock, and it runs with no link of any kind. Nothing is emitted, so there is nothing to jam and nothing to geolocate.
An optical fibre back to an operator at a stand-off station: command guidance that cannot be jammed, by construction, with a person authorizing every decision that matters and out of the seat while they do it.
Perception and planning on the unit, inside the sealed rule set. No emissions, no link, no GPS. The planner proposes; the rules govern; a person authorizes; safety keeps its veto.
There is no fourth tier and no radio option. The lease, the motion commands and the safety loop all travel by wire: CAN 2.0 and Ethernet carry every motion command, the safety loop is wired on its own, and wireless never carries either. The lease itself arrives by wire or is loaded at the dock, never over the air.
Machine-control and safety networks stay segregated from service and mission networks, so an external link that is lost or compromised cannot create actuator authority. Loss of a remote operator link ends in a defined stop or degrade, never in uncontrolled continuation. Mission runtime and safety functions execute on the unit, and a supported release operates and recovers locally, without a foreign cloud or service.
The rule is fleet-wide. No Canadian Shield design carries a radio or a GPS receiver, and the technology page carries that doctrine across Air, Ground, Water and Underground. CDNS Autonomy runs it from inside the cab.
Any seat, whoever is in it. The person who authorizes and watches the job stands where the water, the slope or the plume is not.
The lock is on the logic, never on safety. The physical stop and the manual release are never part of the authorization lease and never part of any rule set, so nothing that can be withdrawn, expired or tampered with stands between the person at the machine and the stop.
Stopping is not always safe. On a civil site, a situation the rules do not cover means stop and wait for a person; in a burning structure or on a failing slope, stopping in the open can itself be the harm. So each task in each profile carries its own defined safe state, decided with you before the job and never improvised during it. Once that state is reached and held, the unit drops to its minimum-risk condition and a person is called.
The standards named at design are ISO 12100, ISO 13849, ISO 17757 and ISO 19014. The safety page carries the whole architecture at full depth: the authority order, the stop, independent safety, lockout and the crew, the site rules, and what is refused on every profile.
The unit's mechanical state is tracked apart from whichever authority mode is selected, and the machine is untouched in the first of them.
| State | What it means on the machine |
|---|---|
| 0 · OEM | No unit fitted. The machine is exactly what the manufacturer built. |
| 1 · Installed, disengaged | The unit is in the dock and belted in; the actuators are parked on the controls, force-free. A person can sit down and drive. |
| 2 · Armed | Authorized and calibrated, holding. Wrong-side or wrong-configuration seating is blocked here, electronically. |
| 3 · Autonomous control | Running the authorized task, inside the defined movement space, under the guidance tier in force. |
| 4 · Fault or safe | Outside the rules, tampered with, or de-authorized: the task's own defined safe state, then the minimum-risk condition, then a person is called. |
The last row is where the two profiles differ. Each task in each profile carries its own defined safe state, designed in advance.
Seven authority modes sit above the states: off, manual, assist, approach, teleoperation and autonomous, with maintenance held apart from the working chain. What the unit may do is decided in advance by the mode and the state it is in, never improvised on the ground. A unit that is on the wrong machine, or seated wrongly on the right one, is blocked at armed and holds no authority to move.
A unit is built to arrive knowing how to run the common machines. Your own best operator teaches it your machine, your ground and your way of working, from the seat, while they drive.
Learning is by controlled demonstration, not self-training. A standalone recording kit goes into the cab with a person in the seat and the unit out of it, and the kit is wired to nothing on the machine and nothing on the unit. Several qualified operators perform a narrowly defined task; the demonstrations are segmented into task phases; approach geometry, sequencing, control timing, rate shaping, dwell and recovery are extracted; the operators are compared to find the common successful structure, the legitimate variation and the habits to leave out. Any demonstrated behaviour that violates an engineering or safety constraint is rejected, even when an experienced person performed it.
What survives review becomes a machine skill package: a signed, versioned unit of behaviour with its own entry conditions, an operating envelope for speed, slope, visibility, confidence, force, rate and distance, its own degrade and abort logic, and a manifest that ties it to the exact machine, hardware, software and calibration it was frozen against. Promotion is by signed release only. Runtime learning gathers evidence for the next revision and cannot promote itself. What runs on a machine is the package that was released for it, checked against that machine's configuration record before it loads.
The autonomy page carries the skill architecture in full, and the operations page carries training, sustainment and the terms that govern skills.
Every act lands on a record that cannot be quietly changed, and a later entry can add to that record but never rewrite what is already on it.
Who authorized the job, what the unit was set up to do, what it did and where it stopped, in order, each entry chained to the one before it. Nothing is deleted. The record stays with the unit and reads back by wire, and tampering with the unit ends in a safe stop and a retained log.
Behind it sits the machine configuration record, the unit's identity as a document rather than a label. It covers thirteen domains: the host platform, its human controls, the machine kit, energy, compute, sensors, harness, software, calibration, skills, safety, maintenance and release. A skill loads only against a configuration it was frozen for, and the customer can show at any time exactly what hardware, software and skill set is fielded on each machine.
A conversion is a controlled sequence, machine by machine, and the record of it is signed and sealed with a rollback package before the first task.
Machine identity first: make, model and year, the cab trim, and what the machine does all day and where. Then the control-geometry survey of the operator station: the seat, both consoles, the floor, the pedals and each control. Whether the public ever comes within reach of the machine is asked here, because public traffic within reach is refused.
The dock goes in once, at the machine's own belt anchors and pins. The cradle rests on the seat pan, the lap belt threads the tunnel, the actuator modules pin to the machine's own controls, the sensor mounts go up, and the fused feed from the accessory point is connected. Nothing is cut, tapped or flashed.
The unit works each control through its steps and learns where neutral sits, where the limits are, how much travel there is before the machine answers, and how the control comes back when released. Static diagnostics and fault injection follow, then bounded, controlled motion under qualified supervision. From then on the calibration runs every day the unit works, because controls wear and no two machines are alike.
A qualified person approves the bounded operating envelope, the task and the rules for stepping in. Authorization arrives as a lease: time-limited and signed, issued and withdrawable by Canadian Shield, delivered by wire or at the dock. The configuration is accepted for its intended envelope, then signed and sealed with a rollback package. Only skills compatible with that configuration will load.
A person starts the machine and clears it. The task runs inside its sealed rule set under the tier in force until it is done, until authorization is withdrawn, or until a limit is crossed, and it ends in the safe state that task was designed with. Every act lands on the unit's chained record as it happens.
When the seat is needed again, the unit lifts out. The operator station is returned to baseline and inspected, and the machine is standard again, with nothing to undo. The record of the task stays with the unit's log, not with the machine, and the same fleet serves crewed work the moment a person climbs back in.
The operations page walks a day with the unit in a crew: the site role, the lease, daily calibration, the task and the return. The machines page lists what the survey needs from you.
The capability travels as a dock, a fit kit and a unit, to machines already on the ground, and it is sustained by field tooling at the machine and depot repair in Canada and selected allied countries.
One dock per machine, fitted once and left in place; one unit that goes where the work is. The unit and its actuator modules lift out and move to the next machine; the dock stays where it was fitted. The machine goes back to a crew in minutes: unbuckle the unit, lift it out, and the seat, joysticks and pedals are exactly what they were. The same fleet serves crewed and uncrewed work, and at the end of a deployment there is nothing to hand back except the unit.
Training is measured as independence: customer operators and maintainers run and maintain the system without perpetual dependence on the vendor. Hardware, machine engineering for a new configuration, software and support, a bounded evaluation lease or pilot, and training and sustainment packages are the lines a program is built from; how they are engaged is on the procurement page.
Sovereignty here means control and recoverability: who holds the design, who signs the software, who owns the data, and who can repair and recover the system without asking anyone abroad.
Ownership follows the same split as authorization. You own the machine and you own the hardware. The configuration and the application that turn it into Responder or Defender are Canadian Shield's, licensed and revocable. Canadian Shield can withdraw the operator; it can never reach your iron. The sovereignty page carries all ten dimensions for the whole fleet.
The conversation begins with screening, then a fit assessed machine by machine, and a first job scored on your own ground before anything further is discussed.
Every enquiry on this line is screened first, because export control requires it.
Supply is subject to Canadian export permits issued per shipment, and the posture is counsel-first: counsel is taken on the case, and a permit is sought for the shipment. What you send is used only to work out what may lawfully be discussed and supplied; what you tell us is stated by you, and Canadian Shield may decline any enquiry without giving a reason.
Nothing on this page is an offer, a commitment or a representation to any government body. Patent pending. How access escalates from this page to the two program briefs, to an evaluation and to controlled technical data is on the procurement page, the interface posture a prime or an integrator meets is on primes and OEMs, and the screened form is on enquiries.
This line works the machines a customer already owns. The rest of Canadian Shield is a fleet of its own, under the same doctrine.
This one converts machines that are already on the ground. The other is a sovereign fleet built here, across Air, Ground, Water and Underground: the Goose CS-110 launch chain in the air, moulded platforms designed for low signature on the water, and a drill and its family beneath it. The Forward Manufacturing Cell ships a containerized slice of that production line so the rounds are moulded on an ally's own floor rather than shipped across an ocean to it. The sovereign defence line carries the fleet, the four domains, the Forward Manufacturing Cell and the manufacturing floor behind them.
A conversion starts with one machine and the station inside it: the seat pan, the consoles, the pedals, and every control a person touches to work it.
It starts with a screened enquiry naming the machines you run and the callouts you send them on. Cleared, the conversation moves to the two profile pages, Responder CS-810 and Defender CS-820, and then to a control-geometry survey of one cab: where the seat pan will take a cradle, what the machine's own belt anchors will hold, which of the six interface families that station uses, and where the accessory point is. A fit is assessed machine by machine and a first job is scored on your own ground before a bounded, time-limited evaluation lease is discussed. There is no checkout on this site, and nothing here is an offer.
Patent pending. Export-controlled: international transfer is subject to Canadian government permits. Designations and profile names are current as issued and subject to change without notice. Nothing on this page is an offer, a commitment or a representation to any government body.
