CDNS KAOS goes into ground a person should not stand on, and the person who commands it is at the far end of a fibre. The command structure and the safety architecture follow: what outranks what, what the machine will not do until it agrees with itself, and what stops it.
The machine exists for one reason, and the architecture follows from it: the ground that would expose an operator is ground KAOS goes into alone.
CDNS KAOS is a Canadian-built heavy-duty tracked work platform that takes standardized mission modules and goes where the job is bad enough that nobody should be standing in it. Slope working loose, a face still moving, a route somebody has to open before anything else can pass. The machine goes in and the person stays out. Nobody in harm's way is not a phrase attached to the design afterwards; it is the requirement the design was drawn against.
That is a different answer from the other half of this house. CDNS Autonomy is a removable operator: it takes the seat of a machine the customer already owns, works the controls the manufacturer fitted, and lifts back out. KAOS is autonomous the whole way through, built that way from the frame up, so the command path, the safety domains, the brake and the service states are properties of the platform rather than additions to somebody else's machine.
The operator's path to the machine is a fibre tether run out from a station set back from the work, the same path every commanded machine in this house runs on.
A person sits at a station that is not on the machine, with the machine's own controls in front of them and a stop under their hand, and the command runs down a fibre. An optical fibre is unjammable by construction. It carries light inside glass, and there is no channel in the air for anything to reach into. Weather does not touch it, and nor does whatever else is transmitting nearby. The path is a physical object a person can see, walk and cut.
Cutting it is not a failure the machine has to reason its way out of. Loss of command is a designed condition with a designed answer: the machine goes to the state defined for what it was doing, settled before the work starts.
The machine is not uncrewed and it is not crewed. It is configured, and the cab is where that choice becomes visible.
Two cabs are offered on the same platform. One has a wheel and pedals, for transit, for yard work, and for any task where the sensible answer is a person driving the machine. The other has a seat and no driving controls: the machine drives itself under command, and a person who needs to be aboard rides.
Seat and no controls is not the same thing as uncrewed, and the difference is worth holding onto. The machine carries people. It is not driven by them. Somebody aboard a control-free cab is a passenger with a view of the work and a stop within reach, not an operator whose hands are the last line of anything. That is a different safety problem from an empty machine, and the stop stations, the protective zones and the service states here assume a person may be aboard.
Neither cab is the exception. Control type is one of the choices that names a configuration, settled with the rest of them on Configurations and the deck.
Four things have a say in what this machine does, and they are built apart from each other deliberately. What each one cannot do is what makes the separation hold.
The person at the station is the command source. Independent safety holds the final veto over hazardous motion, and can only take authority away rather than grant it. Vehicle control runs the machine itself, torque and energy and the working hydraulics, and only inside the permission safety has granted. Planning and perception sit in a third place and reach neither.
The shape is three sentences. A person commands the machine. It can be handed a bounded task and carry it out while that person watches. Nothing the planner decides becomes torque without passing through both of the others, and nothing it decides reaches the brakes.
The planner proposes. The rules bound what it may propose. A named person authorizes the work before the machine does any of it. Independent safety takes authority away without consulting anything that thinks.
Independent safety owns a small number of things and owns them outright. Writing that boundary out is worth more than any adjective anyone could attach to it.
A safety function is a named condition, a named trigger and a named thing that happens, held by a part of the machine that does nothing else. Everything not on this list belongs to the vehicle controller, which works inside the permission the list grants.
| Safety function | What triggers it | What the machine does |
|---|---|---|
| Emergency stop | A stop station pressed at the machine. | Traction torque inhibited and the brakes applied. A person clears it at the machine. |
| The brake safe state | Control power lost, or the safety controller no longer executing. | The safe outputs de-energize on their own and the brakes close. |
| Permission for traction | Brake state, contactor feedback or the interlock loop disagreeing with the command. | Torque is not permitted. The machine does not move on a disagreement. |
| Overspeed | Speed past the envelope permitted for the work, against a second independent estimate. | Traction inhibited and the brakes applied. |
| Tilt | Attitude outside the envelope set for the ground and the module. | Hazardous motion removed and the machine held. |
| Critical high-voltage conditions | An isolation fault, or a critical condition on the high-voltage chain. | Energization blocked, or a controlled isolated state, by what has failed. |
| The protective zones close in | A person inside a protective field around the machine. | The machine holds, then goes to a safe stop. |
What independent safety owns, what fires it, and what the machine does.
A stop that has to arrive somewhere and be acted on is a stop that can fail to arrive. This one is the condition the machine reaches when anything stops working.
Stop stations sit on the machine itself, front and rear, on dual contacts. Press one and traction torque is inhibited and the brakes go on. That path is wired and short, with no software standing in it.
The more important property is what happens when nothing is asked at all. If the safety controller stops executing, the safe outputs de-energize on their own. If control power is lost, the brakes apply. A machine that must receive an instruction to become safe is unsafe the moment it cannot get there. This one falls into the safe state, and getting it out again takes an intact, powered, agreeing machine and a deliberate act.
Human safety comes first, on every line in this house, and this is where that becomes an arrangement of hardware rather than a value. A person clears a stop by walking to the machine. Nothing clears it at a distance or on a timer.
Slowing the machine with the motors is an ordinary way to drive it. Stopping it is a separate job, given to a separate thing, for reasons that are structural.
Electric braking is useful and it is not a brake. It works while the electronics are alive and the battery can take the charge coming back at it, and a brake has to work when neither is true. So each side carries a mechanical brake held open by power, closed by spring the moment power goes. The machine's resting state is stopped: energy releases the brake rather than applying it.
It is sized on its own terms rather than against what the motors can do, and two of those terms are different questions with different answers: holding a loaded machine on a grade with no power, and absorbing an emergency stop. A third is heat, because a brake that will hold a hill can still cook on repeated stops.
Brake state is monitored independently of brake command, so the machine knows the difference between telling a brake to release and its having released, and traction is not enabled against a state that does not agree. Braking is left out of the electrical story on Power and energy on purpose: a safety function that depends on the bus being healthy is not one.
Two conditions hold before any torque is permitted: the machine agrees with itself about its own state, and the high-voltage bus came up the way it was supposed to.
Both brakes report the state they were told to be in. Speed is checked against a second independent estimate rather than trusted from the motor producing it. A main contactor detected welded shut blocks re-enable, because a contactor that cannot open is a machine that cannot be disconnected.
The machine comes up on its low-voltage system first and boots its controllers. Nothing high-voltage is live while that happens.
It self-tests, loads its configuration and reads the electronic identity of whatever is bolted to the deck. A module it cannot identify gets no power and no hydraulics.
Isolation, the stop circuits, the brakes, the contactor feedback, the interlock loop and the battery's availability. A condition that does not hold ends the sequence.
A precharge path closes and brings the high-voltage bus up gradually, watched for a timeout and for the voltage behaving as it should. The main contactors close after that, not before.
The service state is keyed and has traction inhibited, so a machine being worked on is a machine that cannot drive away.
The response is chosen by the class of fault, because a machine that de-energizes indiscriminately can leave a person somewhere worse than one that keeps what is still helping.
Reduce torque in a controlled way where that is available. Inhibit immediately where it is not. Apply the brakes. Then act on the high-voltage system by the class of the fault rather than the fact of one. A machine that answers every fault the same way has stopped choosing, and a loaded deck stopping suddenly on a slope is its own hazard.
It stops offering what it can no longer support and comes back to the person at the station, who has the controls and the stop.
Stored energy gets the machine off the ground it is on. That is a different job from working, and it is treated as one.
The work circuit can be isolated on its own. Losing the tool is not the same event as losing the platform.
Recovery has an envelope of its own, at lower speed and lower torque, because a machine being pulled out is not a machine doing its job. The recovery points sit outside the pinch zones, taken on the drawing rather than on the day: nobody should be reaching between a track frame and a deck to hook onto a machine that has stopped.
A technician's safety here is a procedure and a set of physical states, and the machine sits on the wrong side of the assumption until every one of them is met.
High voltage on a work platform is not a hazard that announces itself, and a switch in the off position is a claim rather than a condition. So the machine is treated as energized by default, and making it safe is a sequence ending in a state somebody has confirmed.
Where a conductor runs, what it runs beside, and how it crosses a bulkhead are settled by what the wire does, and not by what is convenient at the time.
High voltage runs on its own protected routes, kept apart from sensor and data harnesses. Safety wiring runs on direct controlled routes to the safety controller, because a safety signal that has been through three junctions and a shared loom is a safety signal with three more things that can go wrong with it. High-current low-voltage loads are grouped away from safety-sensor wiring for the same reason. Bulkhead crossings use sealed connectors, not a bundle pushed through a grommet and hoped for.
A harness on this machine is a documented object rather than a habit: a drawing number, a revision, a serial, and a continuity and insulation record that belongs to that serial. The wiring inside a given machine can then be known from outside it, by somebody who did not build it.
The machine reports what is wrong in a form somebody can act on, and it declines to let one class of that be waved away at a distance.
Every strategic unit publishes its identity, its software version and its health, so what is installed does not depend on a memory. Faults carry unique codes and a severity class. On a motion-critical fault the machine freezes a frame of that instant: speed and torque, the state of the brakes, and which authority it was under.
The application software is signed and the configuration checked before the machine is allowed to move at all.
Calibration and engineering access sit apart from what an operator needs, and a safety limit changed anywhere is logged against the machine.
Event logs are protected against casual alteration and timestamped together, so what the machine says happened is what is read later.
A safety fault cannot be cleared by a remote command alone where local inspection is required. Somebody has to walk to the machine. That is a deliberate cost, paid every time, and the one place in this architecture where inconvenience is the feature: a fault a person had to stand in front of is a fault a person has looked at. What the machine is made of opens from the machine.
Three people usually decide whether a machine of this kind comes onto a site, and a crew works beside it afterwards.
The conversation starts with a screened enquiry, the ground you are trying to keep somebody off, and the work that still has to happen on it.
Bring the site, the task and the hazard rows your own analysis already names. Every enquiry is screened before any discussion, supply is subject to Canadian export permits issued per shipment, and export posture is counsel-first. The reply comes in writing, from a person. Nothing on this page is an offer.
The platform as a whole is on CDNS KAOS. The engine, the generator and the bus everything hangs off are on Power and energy. What crosses the deck, and what a module must bring, is on Configurations and the deck. The buyer's door is Who it is for.
