A launch mount on a building roof, carried into the primary structure. A launch mount that stands on a building roof and puts every shot down through a dunnage frame into the building's own steel or columns, never into the roof deck.
The inherited pneumatic chain, a two-axis head, an in-house passive sensor head, and a steel frame that carries the shot past the deck and into the building. Two architectures are open for how the head stands over that frame.
The load path runs mount, dunnage frame, posts through curbed roof penetrations, and then the building's own steel or columns. Nothing bears on the roof deck or the membrane. The building's engineer of record reviews the building's capacity before anything is anchored to it.
The launch energy is compressed air from an electric compressor, held at 30 bar behind one normally closed valve per barrel. There is no propellant, no primer and no cartridge on the mount or in the round it launches.
Eight permissives stand in series ahead of the arm relay, and a ninth at a site that requires canopy rounds. The relay drops when the fire command completes, so one arm action releases one barrel and the mount returns to SAFE after every shot. There is no salvo code on these mounts.
The design carries no radio transmitter or receiver, no satellite receiver and no antenna. Detection, tracking and ranging are passive, the rangefinder emits only under the operator's hand, and video, status and control all ride fibre.
The inherited launch chain and the roof interface engineered on top of it, each figure with the basis it comes from. Figures that follow the tube count sit under Configurations, because the tube count is the owner's to rule.
The tube module, inherited unchangedLaunch, per barrelThe shot, into the structureThe roof interfaceSlewing, elevation and their limitsThe arm chain and safety functionsThe sensor headAir, power and the wired networkAnti-tamper and site securityEnvironment, maintenance and sustainmentWhat the design does not carry
| Parameter | Value | Basis |
|---|---|---|
| Bore | Ø90.00 mm | design value, the round's bore |
| Stroke | 3,000 mm | design value |
| Charge pressure | 30 bar, shop-air class | design value |
| Barrel length | About 3,500 mm: 3,000 mm of stroke and 500 mm of breech | from the shop drawing set, with the breech length assumed there |
| Barrel stock | Drawn-over-mandrel steel tube without a weld seam, to ASTM A519, AISI 4130 or equivalent | shop drawing general note |
| Barrel wall | 6 mm minimum | shop drawing general note |
| Barrel proof test | 45 bar | shop drawing general note |
| Barrel outside diameter | Ø102 mm | calculated: Ø90 + 2 × 6 mm of wall |
| Barrel mass | 42.6 kg at 3,000 mm; 49.7 kg at 3,500 mm | calculated from the section and steel density; four 3,000 mm tubes reproduce the shop drawing's 170 kg |
| Breech valve | Normally closed solenoid, energize to open, one per barrel | design definition, the breech and the pneumatic chain |
| Valve port area | 95 cm² minimum | design definition, so the valve is not the restriction |
| Valve opening time | <5 ms | design definition; the peak load does not shift |
| Valve pressure rating | 30 bar | design definition |
| Clamp preload | Safety factor of at least 2.0 on the 9,546 N mean base force | shop drawing, tube-to-cradle interface |
| Rounds carried | Goose CS-110 and Encapsulator CS-111, both 1.600 kg, fired unchanged | requirement R-08 in the design definition |
| Power or signal to the round | None | the round is unpowered; no conductor crosses the nose interface |
| Parameter | Value | Basis |
|---|---|---|
| Velocity at the muzzle | 189.2 m/s | design value, interior ballistics |
| Muzzle energy | 28.64 kJ | calculated: ½mv² |
| Bore area | 63.617 cm² | calculated from the Ø90 bore |
| Seal drag | 250 N | the round's design definition, assumed there |
| Gas load on the closed breech | 18,441 N | calculated: (p₀ − p_a) × bore area, at valve opening |
| Peak net reaction into the mount | 18,191 N | calculated at the start of the stroke, before the round moves, with the seal drag taken off |
| Mean base force over the stroke | 9,546 N | calculated: ½mv² divided by the stroke |
| Peak acceleration of the round | 1,159 g | the round's design definition, at the start of the stroke; 11,369 m/s² at 1.600 kg |
| Time to peak load | 0.14 ms | from the interior-ballistics run |
| Time in the barrel | 31.7 ms | calculated on constant acceleration: twice the stroke over the muzzle velocity |
| In-bore impulse | 357.3 N·s | calculated: the round's momentum plus the charge gas momentum in the bore |
| Parameter | Value | Basis |
|---|---|---|
| Equivalent static load, per barrel | 36,382 N | calculated: twice the peak net reaction, for a step-applied load |
| Factored load for member checks | 72,764 N | calculated: the equivalent static load at a member safety factor of 2.0 |
| Step-load factor carried | 2.0 | the undamped bound for a suddenly applied load; it stands until a modal analysis replaces it |
| Dynamic load factor on a roof | Not given; it follows the governing mode, and the governing mode is the building's | the design definition's hand estimate is of the pedestal's own cantilever and is not this mount's; only the building's engineer of record supplies the governing frequency |
| Direction of the reaction | Rearward along the bore; overturning is worst at low elevation | calculated components at quadrant elevation |
| Yaw torque on the azimuth axis | The peak reaction times the bore line's lateral offset from the axis | calculated relation; the offset follows the pod arrangement |
| Torque on the elevation axis | The peak reaction times the bore line's offset from the trunnion axis | calculated relation; one row pitch of offset is one pitch of lever |
| Axial wave speed in the barrel steel | 5,048 m/s | calculated from the modulus and density of steel |
| Axial wave transit, 3.5 m barrel | 0.69 ms | calculated; longer than the 0.14 ms rise, so the barrel does not respond as a lumped mass |
| Shot count over the mount's life | Set per site | no figure exists; commissioning and proof firing are expected to dominate the count at an institution |
| Parameter | Value | Basis |
|---|---|---|
| Load path | Mount, dunnage frame, posts through curbed roof penetrations, the building's primary steel or columns | design definition, the roof interface |
| Bearing on the roof | None. Nothing bears on the roof deck or the membrane. | design definition, the roof interface |
| Levelling jacks | The skid's screw jacks level it; they do not anchor it, and they do not bear on a roof deck | design definition, the roof interface and the architecture table |
| Anchorage | Through-bolted to steel, or cast into concrete, through curbs with flashing | design definition, the roof interface |
| Designer of record | A structural engineer licensed where the site is | requirement R-15 in the design definition |
| Design codes named | The National Building Code of Canada as the province adopts it; the anchorage provisions of CSA A23.3; CSA S16; welds to CSA W59 | requirement R-15; the welding standard from the shop drawing's general note. Named as design bases, with no conformity asserted. |
| Loads the interface carries | Dead load; snow drift against the unit; wind uplift; seismic anchorage of rooftop equipment; the shot reaction, applied repeatedly and dynamically into the building's lateral system | design definition, the roof interface |
| Building review | The building's engineer of record reviews the building's capacity for the mount | design definition, the roof interface; verification item V-INST-02 |
| Vibration into the floors beneath | Not given | no figure exists; it belongs to the building's engineer of record |
| First bending frequency on a roof | Not given | the governing mode is the building's, not the stool's, and only the building's engineer of record supplies it |
| Base level | A tilt switch confirms the base is within tolerance before the mount will arm | arm permissive P7 in the design definition; the tolerance is set per site |
| Access and lifting | A roof hatch or stair; guardrails or fall-arrest anchors to the provincial rules for work at height; a service platform around the head; lifting points on the head and each pod, with a davit or a crane lift plan for the head, the pods and the bank | design definition, roof access and maintenance access |
| Bonding | The protective earth bond ties to the building's grounding and lightning protection | design definition, the roof interface; the launcher's own bond conductor |
| Permits | A building permit and the building official's review; provincial pressure-equipment registration for the vessel and its relief device | design definition, the roof interface; the pneumatic schematic's registration note |
| Roof height and the footprint | From an illustrative 30 m of roof height, the low lays reach up to about 200 m farther than from ground level, at a drag coefficient of 0.35 on the Ø70 reference | calculated in the safety case; the 30 m is an illustrative roof height, not a site value, and every range figure carries its drag assumption |
| Parameter | Value | Basis |
|---|---|---|
| Azimuth | ±170° | the reference envelope, tied to the alignment software |
| Elevation | −3° to +75° | the reference envelope, tied to the alignment software |
| Envelope per site | Narrowed from the reference envelope in hardware, never widened | requirement R-10 in the design definition |
| Peak slew acceleration | Not given | the figure in the source set and the drive torque printed beside it do not agree with one another, and neither is carried here |
| Peak slew rate | Not given | no rate is published in the source set; it is an open owner decision because the drive, the conductor, the bus and the cabinet all follow it |
| Brakes | Spring-applied on both axes | design definition, brakes and stow |
| Design brake torque | Twice the worst per-shot torque of the configuration fitted | requirement R-32 in the design definition |
| Fire permissive on the brakes | Both brakes engaged before the breech may open | fire permissive F1 in the design definition |
| Stow | A sensed stow lock pins the head at a stow attitude whenever the mount is SAFE and unattended | design definition, brakes and stow |
| Limits, in four layers | Mechanical hard stops; cam-operated limit switches on both axes wired into the sector permissive; a software refusal before the drives move; and the site no-fire map as a cross-check that never replaces the cam switches | design definition, limits in four layers, each layer independent of the one above it |
| Cam set | Site hardware, cut from the site's surveyed footprint map, sealed, and changed only under a controlled procedure with a record | design definition, limits and anti-tamper; the safety case's site survey |
| Siting precondition | No mount is armed at a site without a surveyed footprint and a sector cam set cut for that site | requirement R-06 in the design definition |
| Parameter | Value | Basis |
|---|---|---|
| Inherited permissives | Four in series ahead of the arm relay: a dual-channel emergency stop, an area-clear key, a muzzle-cover switch and a relief-proven switch | the launcher's electrical schematic, control logic |
| Arm permissives added on this line | Sector permitted (cam switches on both axes), enclosure closed (every door and pod cover sensed), base level (a tilt switch) and wind within limit (a wired anemometer and a threshold relay), with a fifth — round type permitted, a breech switch reading a mechanical round-type key — at a site that requires canopy rounds. All hard-wired. | the interlock additions in the design definition |
| Fire permissive added on this line | Both axis brakes engaged before the breech may open | the interlock additions in the design definition |
| One shot per arm | The arm relay drops when the fire command completes, so the key is turned again for the next shot | relay logic in the design definition; the manual-arm-per-shot safety function |
| Control states | SAFE, ARMED, FIRING and FAULT | the launcher's interlock state machine |
| State after a shot | SAFE | design definition; it replaces the controller specification's automatic return to ARMED |
| Salvo code | None on these mounts | design definition; the pneumatic schematic fires one barrel at a time |
| Fail direction | Every link fail-open; any loss of power, bus, arm relay or interlock returns the mount to SAFE with the breech closed | requirement R-12 in the design definition |
| Watchdog | A hardware watchdog de-energizes every output; controller failure resolves to SAFE without software | the controller specification, a hardware design requirement |
| Safety chain | Hard-wired and dual-channel, never on a network | requirement R-18 in the design definition |
| Fire command | A local operator action, at a station inside the site's secure area with a direct view of the mount and its sector | the definition of local proposed in the design definition |
| Arm and fire from the network | None. No workstation elsewhere on the network can arm or fire. | design definition, the operator station |
| Cue | Bearing, range and height, as a permissive; no fire command crosses the interface | requirements R-03 and R-05; the capped fire-control interface and its reserved message set |
| Event record | Every arm, fire and fault event recorded with time, operator and imagery, and not editable in the field | requirement R-20 in the design definition |
| Full-power firing | Blocked in the launch chain's own safety functions | the safety-function summary carried through to this line |
| Parameter | Value | Basis |
|---|---|---|
| Who builds it | Canadian Shield, in-house | owner ruling of 2026-09-11 |
| What it does | Detect, track, classify and range; the output is bearing, range and height to the laying solution | requirement R-05 in the design definition |
| Channels | A day camera with zoom; a thermal imager; an eye-safe laser rangefinder; a wide-field situational camera; an optional passive acoustic array for bearing-only cueing | the sensor scope the design definition recommends |
| Not carried | Radar, radio-frequency detector, satellite receiver, antenna | requirement R-04 in the design definition |
| Aperture rule, every channel | Clear aperture of at least 1.22 × wavelength divided by the element's angular subtense, so the detector and not diffraction sets resolution | requirement R-33, calculated |
| That rule at 10 µm | 0.102 m against a 120 µrad element | calculated; a smaller thermal aperture is diffraction-limited and throws away resolution the detector could give |
| Rangefinder wavelength class | An eye-safe band above 1.4 µm | named as a design basis; a necessary condition, not a sufficient one |
| Rangefinder laser class | Class 1 at the aperture to IEC 60825-1, classified by an accredited laboratory | requirement R-33; the classification is the laboratory's, not the design authority's |
| Beam divergence | No more than 0.55 mrad at 1,000 m, 0.275 mrad at 2,000 m and 0.183 mrad at 3,000 m | calculated: the beam must not overspill a 0.55 m target at that range |
| Pointing stability | About one third of the beam divergence | calculated design rule; it bears on the drives, the encoders, the bearing clearance and the brakes |
| Laser emission control | On the operator's command or an active track only, and interlocked off when the stow lock is in | design definition, laser emission control |
| Links off the head | Duplex single-mode fibre for video, status and sensor control. The only copper leaving the head is the 24 VDC feed and the protective bond. | requirements R-04, R-18 and R-33 in the design definition |
| Time reference | From the site network by IEEE 1588, or from the cabinet's own clock | design definition; there is no satellite receiver aboard |
| Detection range for a named target class | Not given | no measured figure exists; the optical figures in the design definition are resolution ceilings, not detection ranges |
| Parameter | Value | Basis |
|---|---|---|
| Air bank | A certified, registered pressure vessel, in a protected enclosure | requirement R-13 in the design definition; the roof interface |
| Stored energy in the bank | 4.66 kJ per litre at 30 bar | calculated as adiabatic expansion energy; the formula reproduces the reference bank's published figure |
| Relief valve | 33 bar set point, 110 % of working pressure | set point on the pneumatic diagram |
| Relief capacity | Sized for full compressor flow and proven by a switch in the arm chain | requirement R-13 in the design definition |
| Relief and vent discharge | Routed clear of people and of the building's air intakes | design definition, stored air on the roof |
| Pressure reading | A transmitter on the bank, 0 to 40 bar, and a local gauge | the pneumatic equipment list |
| Isolation and venting | A manual isolation valve locked open in operation, and a manual vent and drain that takes the bank to zero, confirmed on the local gauge | requirement R-17 in the design definition; the pneumatic energy-isolation note |
| Compressor | Electric, 17 kW shaft power, on three phase | the reference design's sizing |
| Site supply | Three phase; 480 V in the reference design. The motor and the supply are specified per site. | the supply the reference electrical design is drawn to; Canadian institutional sites commonly run at 600 or 208 V |
| Control bus | 24 VDC, physically segregated from the three-phase side | the launcher's bus architecture |
| Voltage-drop limit on the control bus | 3 % | the limit the inherited load analysis sets itself |
| Uninterruptible supply | Carries an orderly return to SAFE and keeps the sensor head running on loss of supply; it does not carry the drives | design definition, power |
| Loss of supply | Safe regardless, because the breech is normally closed | design definition, power |
| Electrical installation | To CSA C22.1, with the three-phase and 24 VDC buses physically segregated | requirement R-19 in the design definition. Named as a design basis, with no conformity asserted. |
| Control link | CAN 2.0B, point-to-point from the controller to the operator station, at 250 kbit/s; 40 m on copper at that rate, and over fibre beyond it together with the interlock loop | the controller specification's limit; the fibre rule added in the design definition |
| Video and track network | Ethernet over fibre, segregated, view-only status to site security | design definition, the network in three parts |
| Cybersecurity | Designed to IEC 62443. Named as a design basis, with no conformity asserted. | design definition, the network in three parts |
| External data ports | None on the mount; the fire-control connector is physically capped when not in use | design definition, the network in three parts |
| Earthing and surge | The protective bond, surge protection on every copper entry, and fibre for every data run off the mount | design definition, earthing |
| Parameter | Value | Basis |
|---|---|---|
| Arm key | Under key control, with a two-person rule optional; there is no arm path from the network | design definition, anti-tamper |
| Opening the mount | Tamper switches on every door and pod cover; opening one drops the arm relay, latches FAULT and alarms to site security over a wired input | design definition, anti-tamper |
| Anchors | Unreachable from outside, or behind a locked shroud, with tamper-evident marks on the nuts | design definition, anti-tamper and base options |
| Rounds | In a locked magazine, or behind a locked and sensed pod cover, and counted at every watch change | design definition, anti-tamper |
| Stored air when unattended | The bank ventable to zero, with the isolation valve lockable | requirement R-17 in the design definition; whether it is vented on watch is an open owner decision |
| Anything in reach | Anti-climb, with no ligature point | design definition, anti-tamper; a requirement set for correctional sites |
| Remote attack surface | There is no remote arm or fire path to attack | design definition, anti-tamper and the network |
| Parameter | Value | Basis |
|---|---|---|
| Low-temperature design case | −30 °C | the round family's environmental design case |
| Upper temperature | Set per site | requirement R-14 in the design definition, where the upper end is assumed to cover southern Canadian summers with solar gain |
| Outdoor enclosure | IP65 | requirement R-14 in the design definition, for driving rain and snow |
| Condensate | A dryer with a dew point below the site minimum, and drains | requirement R-14; compressed air carries water that freezes at the low-temperature design case |
| Inherited maintenance schedule | Each use: interlocks, emergency stop and breech fail-closed. Monthly: harness and slew checks. Quarterly: compressor service and breech seal inspection. Per certificate: vessel hydrotest and relief proof. | the inherited maintenance schedule |
| Breech seals | Logged by shot count | the inherited maintenance schedule |
| A lapsed vessel certificate | Takes the mount out of service | the inherited maintenance schedule |
| Added for this line | Sensor window cleaning; dryer and desiccant service; cam-set inspection and seal check; anchor preload check; foundation and roof-penetration inspection; brake holding test; tilt-switch check; uninterruptible-supply test | design definition, maintenance access |
| Isolation points | The main disconnect, the compressor, the isolation valve, the vent and the local gauge | design definition, maintenance access; the pneumatic energy-isolation note |
| Parameter | Value | Basis |
|---|---|---|
| Warhead, fuze, primer, propellant or energetic material | None, on the mount, in any round it fires, or in the miss canopy option | requirements R-01 and R-21; the launch chain's safety-function summary |
| Radio transmitter or receiver | None | requirement R-04 in the design definition |
| Satellite receiver | None aboard either mount | requirement R-04 in the design definition |
| Antenna | None. The design carries no antenna, and no antenna mount, feeder route or emission case is reserved for one. | requirement R-04 in the design definition, verified by inspection and design review |
| Automated or remote-only fire path | None | requirement R-03 in the design definition; the capped fire-control interface |
| Jammer, spoofer or other radio-frequency effect | None | the line's charter |
| Electronics or power in the canopy option | None. It opens by a positive mechanical action and initiates nothing. | requirement R-21 in the design definition |
A roof is not a foundation. The whole of the roof interface is the business of getting a repeated 36 kN past the deck and the membrane and into something that was built to carry load.
The load path is fixed even though the architecture above it is not. The mount stands on a steel dunnage frame; the frame stands on posts; the posts pass through curbed roof penetrations and land on the building's primary steel or its columns. The curbs are flashed to the detail the roof membrane's own warranty conditions require. Where the head sits on a short stool instead, the stool is set directly over a column.
Nothing bears on the roof deck or the membrane. That rule governs the Launch Platform skid's screw jacks in particular: they level the skid and they do not anchor it, and they are not a way of standing on a roof. A frame is still required beneath them.
The interface carries more than the shot. Dead load, snow drift piling against the unit, wind uplift and the seismic anchorage provisions for rooftop equipment all belong to it, and the shot reaction arrives on top of them repeatedly and dynamically into the building's lateral system. Two things the mount's own engineering cannot supply: the vibration transmitted into occupied floors beneath, and the building's first mode. The stool's own bending frequency is not the roof mount's frequency, because the building's frame is far softer than the stool, and only the building's engineer of record can give the governing number.
The footprint map, the ground a miss can reach, and the sector cells the site can permit. No mount is armed at a site without a surveyed footprint and a cam set cut for it.
A structural engineer licensed where the site is designs the frame and the anchorage. The building's engineer of record reviews the building's capacity for the mount.
Posts through curbed, flashed penetrations onto primary steel or columns. Through-bolted to steel, or cast into concrete.
Anchorage to the loads of the design definition, including reversal. The protective earth bond ties to the building's grounding and lightning protection.
A building permit and the building official's review, and provincial pressure-equipment registration for the vessel and its relief device.
Anchor proof, cam set cut and sealed, tilt switch set, interlock proving, and the key procedure handed to the site's named operator.
A roof frame the owner has shown puts the skid's screw jacks straight onto a wet roof deck with no frame beneath them. The design does not carry that, and this sheet does not show it.
The design definition puts two architectures on the table and recommends one for study. The choice is the owner's, so this sheet carries both with what follows from each.
R1 sets the Launch Platform skid on a steel dunnage frame. It inherits the skid layout whole: the receivers along the flank, the cabinet at one end, the cradle in the middle. What it costs is a long, heavy frame, and a machine whose own levelling jacks cannot be used to stand on the roof. A thirty-two-tube array of the kind the owner's roof frame paints carries 1,363 kg of barrels alone.
R2 sets the Pedestal Mount's slewing head on a short stool over a building column. It concentrates the load over one column and gives the line one head design for both products, on a small footprint. What it needs is a column with the capacity for it, and room on the roof for the air packaging.
The design definition recommends R2 for study, on the ground that it gives both products one head. It does not decide, and neither does this sheet.
| Architecture | What it is | For | Against |
|---|---|---|---|
| R1 | The Launch Platform skid, set on a steel dunnage frame | Inherits the skid layout: receivers along the flank, the cabinet and the cradle | A long, heavy frame. The jacks level but do not anchor. A 32-tube array is 1,363 kg of barrels before its frame. |
| R2 | The Pedestal Mount's slewing head on a short stool over a column | One head design for both products. Load concentrated over one column. A small footprint. | Needs a column with the capacity for it. The air packaging must fit on the roof. |
The mass ledger prices the difference. R2, taking the rotating head, the bearing, the drives, a 0.60 m stool and a spreader grillage, runs from 1,159 kg at six tubes to 2,257 kg at sixteen, and from 1,410 kg to 2,627 kg once a separate cabinet and the bank are counted. R1 is heavier: the skid at thirty-two tubes is 3,532 kg dry, and a dunnage frame long enough to carry a 3.5 m skid onto roof columns adds of the order of 800 kg again, for about 4,300 kg before its rounds. Nothing in that ledger has been weighed.
The peak load lands 0.14 ms after the valve opens, before the round has moved. Against a structure whose first period is tens of milliseconds, that is a step, and a step is worth up to twice its static value.
Two loads matter and they are not the same load. The gas load on the closed breech end, the valve body and the barrel-to-breech joint is the charge pressure less ambient over the bore area: 18,441 N. The net reaction into the mount is that figure less the obturator's seal drag, which pulls the tube forward: 18,191 N. The second number is the one the frame carries, and it reproduces the source's peak base force and its 1,159 g exactly.
For first sizing the structure takes twice it, 36,382 N per barrel, and member checks then take a safety factor of 2.0 on top of that for 72,764 N. The factor of 2.0 is the undamped bound for a suddenly applied load, and it stands until a modal analysis replaces it. What that analysis needs first is the governing frequency, and on a roof it is not this mount's to publish. The design definition works a first bending mode for the pedestal's own cantilever, standing on its own foundation. A mount on a building stands on a frame far softer than anything the mount brings with it, so the governing mode is the building's, and only the building's engineer of record can supply it. No first bending frequency for a roof mount is given on this sheet, and no margin is worked against one.
What the hand estimate does not cover is worth saying plainly: local modes in the pod and the head frame, the slewing bearing's own flexibility and clearance, base-plate bending and anchor stretch, and the barrel as a wave-bearing member. That last one is the sharpest. An axial wave runs steel at 5,048 m/s, so it crosses a 3.5 m barrel in 0.69 ms – longer than the 0.14 ms rise. The barrel does not respond as a lumped mass; a stress wave runs its length and reflects, and the tube clamps see a travelling load that no lumped model sees.
The reaction acts rearward along the bore, so its share between the frame's horizontal and vertical directions follows the lay. Overturning is worst at low elevation, where nearly the whole 18,191 N is horizontal; at the high lays the load turns down into the frame instead. The impulse governs base rocking and anchor fatigue; the peak force governs strength.
| Quadrant elevation | Horizontal | Vertical | Basis |
|---|---|---|---|
| −3° | 18,166 N | 952 N upward | Calculated |
| 0° | 18,191 N | 0 | Calculated |
| 45° | 12,863 N | 12,863 N down | Calculated |
| 75° | 4,708 N | 17,571 N down | Calculated |
The Roof Mount inherits the Launch Platform's tube module whole. Nothing in the bore, the stroke, the charge or the valve moves because the machine is on a building.
Each barrel is a drawn-over-mandrel steel tube without a weld seam, of at least 6 mm wall, proof-tested at 45 bar, bored to Ø90.00 mm and about 3,500 mm long: 3,000 mm of stroke and 500 mm of breech. At Ø102 mm outside that puts the pod pitch at about 110 to 130 mm, and one 3.5 m tube weighs 49.7 kg before anything is bolted to it.
Behind each bore sits its own normally closed solenoid valve, energized to open, rated at the bank's 30 bar, with a port of at least 95 cm² so the valve is never the restriction, opening in under 5 ms so the peak load does not shift. The clamps holding the tube to the cradle are preloaded at a safety factor of at least 2.0 on the mean base force. One barrel is fired at a time.
Both rounds cross the same mechanical nose interface and weigh 1.600 kg, so a mixed load is allowed and the mount does not care which head is in the breech. No power and no signal cross that interface in either direction.
| Element | Figure | Basis |
|---|---|---|
| Bore | Ø90.00 mm | Design value |
| Stroke | 3,000 mm | Design value |
| Charge pressure | 30 bar | Design value |
| Barrel wall | 6 mm minimum, proof-tested at 45 bar | Shop drawing general note |
| Barrel outside diameter | Ø102 mm | Calculated |
| Breech valve | Normally closed, <5 ms, 95 cm² port minimum, one per barrel | Design definition |
| Round | Goose CS-110 or Encapsulator CS-111, 1.600 kg | Requirement R-08 |
| Muzzle velocity | 189.2 m/s | Design value, interior ballistics |
| Muzzle energy | 28.64 kJ | Calculated, ½mv² |
A pod of six to sixteen tubes raises the head's inertia by an order over the four-tube reference cradle. The drives are re-sized for it, and the shot is held by the brakes, not by the drives.
The laying envelope is no wider than the reference: ±170° of azimuth and −3° to +75° of elevation, narrowed per site in hardware and never widened. Neither a peak slew acceleration nor a peak slew rate is offered here. The acceleration figure in the source set and the drive torque printed beside it do not agree with one another, so neither is carried; and no peak slew rate is published anywhere in that set. The rate is an open owner decision, and it decides the drive torque, the conductor, the bus voltage and the cabinet together.
The shot torque is the reason the brakes exist. A barrel whose bore line sits a lateral distance from the azimuth axis applies the peak reaction times that lever, and that product is two orders above any drive torque in the inherited set. So the design rule is to keep the bore lines as close to both axes as the pod allows, and the fire command waits on both brakes being set. The design brake torque is twice the worst per-shot torque of the configuration fitted.
A brake that slips slightly does not spoil the shot in flight. The angular impulse of one shot turns a sixteen-tube head at about 2.1°/s, so over the time the round is in the bore the head moves well under a tenth of a degree. What a slipping brake does instead is back-drive the reducer and the motor, and move the lay for the next shot. The brake is sized on torque, not on rotation.
The mount inherits four arm permissives from the launch chain and adds four of its own, a fifth where the site requires canopy rounds, plus a fire permissive on the brakes. Every one of them is hard-wired, and the relay they guard drops after every shot.
Four permissives come with the chain: a dual-channel emergency stop with cross-fault detection, an area-clear key, a muzzle-cover switch and a relief-proven switch, all in series ahead of the arm relay. To a series chain a cut wire and a pressed stop are the same event, and any one of them open leaves the relay de-energized.
This line adds four arm permissives, a fifth at a site that requires canopy rounds, and one fire permissive. The control states are SAFE, ARMED, FIRING and FAULT; on these mounts the state after a shot is SAFE, which replaces the controller specification's automatic return to ARMED, and the salvo code does not exist. Loss of power, of the bus, of the arm relay or of any interlock returns the mount to SAFE with the breech closed, and a hardware watchdog de-energizes every output without software's help.
The fire command is a local operator action. At a fixed institution that is given a definition: a station inside the site's secure area with a direct view of the mount and its engagement sector, joined to the arm relay by a hard-wired dual-channel interlock loop, with a second emergency stop left at the mount. Beyond the copper run both the control link and the interlock loop go over fibre, and the fibre interlock is designed and proven as a safety function in its own right. No workstation elsewhere on the network can arm or fire; the site's security operations room sees video and status only.
| Permissive | Kind | What it confirms |
|---|---|---|
| Emergency stop, dual channel | Inherited | Two normally closed channels agree that no stop is pressed, with cross-fault detection at the arm relay |
| Area-clear key | Inherited | A named person has walked the near zone, as defined per site, and turned the key |
| Muzzle cover | Inherited | The cover is off the muzzle |
| Relief proven | Inherited | The relief path is proven before the mount will arm |
| P5 · Sector permitted | Added, hard-wired | Cam switches on both axes confirm the tubes point into a permitted cell of the site's cam set |
| P6 · Enclosure closed | Added, hard-wired | Every cabinet door and pod cover is shut and sensed; opening one drops the relay and latches FAULT |
| P7 · Base level | Added | A tilt switch confirms the base is within tolerance |
| P8 · Wind within limit | Added | A wired anemometer and a threshold relay |
| P9 · Round type permitted | Added, hard-wired, at a site that requires canopy rounds | A breech switch reads a mechanical round-type key and confirms the selected tube holds the round type the site requires |
| F1 · Brakes set | Added, fire permissive | Both axis brakes are engaged before the breech may open |
Detect, track, classify and cue are Canadian Shield's own. What crosses to the controller is bearing, range and height. The interface is physically capped when not in use, its message set stays reserved, and with it open or absent a local arm action is still required.
The head detects, tracks, classifies and ranges, and hands the laying solution a bearing, a range and a height. It does all of that without emitting anything but the operator's own rangefinder pulse.
The head is built in-house and specified by function and class. It carries a day camera with zoom for identification, a thermal imager for night detection and track, an eye-safe laser rangefinder for the range in the cue, a wide-field camera for the near zone, and optionally a passive acoustic array that gives a bearing-only cue under a few hundred metres. It carries no radar, no radio-frequency detector, no satellite receiver and no antenna. Every link off it is fibre; the only copper leaving it is the 24 VDC feed and the protective bond.
The doctrine has a cost and it is stated rather than softened. Electro-optical and infrared detection is limited by fog, snow and rain, and without radio-frequency detection there is no warning of a drone before it can be seen. No detection range for a named target class exists, and none is offered on this sheet: the optical figures in the design definition are resolution ceilings set by the physics, not detection ranges.
Two requirements do follow from the physics and both size the head. The first is the aperture rule: a channel's clear aperture must be at least 1.22 times the wavelength divided by the angular subtense of one detector element, or diffraction and not the detector sets the resolution. At 10 µm against a 120 µrad element that is 0.102 m, which is why a thermal channel on this head is a large-aperture channel. The second is the rangefinder's beam: it must stay on the target or it ranges the background, so divergence is capped at the target's width over the range – 0.55 mrad at 1,000 m, 0.275 mrad at 2,000 m, 0.183 mrad at 3,000 m. Holding a beam on a moving target needs pointing stability of about a third of its divergence, and that lands as a hard requirement on the drives, the encoders, the bearing clearance and the brakes.
The charged air bank holds more energy than anything else on the machine, including the round. On a building that bank stands over occupied floors, and where it vents becomes a design question rather than a detail.
Air at 30 bar stores 4.66 kJ per litre as adiabatic expansion energy, and the formula reproduces the reference bank's own published figure. The bank's volume follows the tube count and the salvo basis the owner rules, so no volume is fixed on this sheet, but the arithmetic scales with it and a bank for an institutional pod is a large stored-energy source standing on a roof.
The vessel is certified and registered, sits in a protected enclosure, and carries a relief valve set at 33 bar, 110 % of working pressure, sized for full compressor flow and proven by a switch in the arm chain. A transmitter reads it for the controller, a local gauge reads it for a person, a lockable isolation valve takes it out of the machine and a vent and drain take it to zero. On a roof the relief and vent discharges are routed clear of people and clear of the building's own air intakes.
One inherited rule does not transfer cleanly and is recorded rather than waved through: the charging zone is to be kept clear of personnel and charged from the console. On a roof above occupied floors, or in a correctional yard, that zone holds people all day. Whether the bank stands charged or is charged only on a manned watch is an open owner decision, and the safety case carries it as one.
| Element | Provision | Basis |
|---|---|---|
| Working pressure | 30 bar | Design value |
| Stored energy | 4.66 kJ per litre | Calculated, adiabatic expansion |
| Vessel | Certified and registered, in a protected enclosure | Requirement R-13 |
| Relief | 33 bar set, full compressor flow, proven in the arm chain | Pneumatic diagram; requirement R-13 |
| Discharge routing | Clear of people and of the building's air intakes | Design definition, stored air on the roof |
| Isolation and venting | Lockable isolation valve; vent and drain to zero, read on the local gauge | Requirement R-17 |
| Air treatment | Inlet filter, check valve, dryer below the site dew point, drains | Requirement R-14 |
| Compressor | Electric, 17 kW shaft power, three phase, in a separate enclosure | Reference design sizing |
One heavy alternating-current load, one segregated control bus, a hard-wired safety chain that is never on a network, and fibre for every data run that leaves the mount.
The compressor is the only large load and it runs on three phase. The reference electrical design is drawn to 480 V; Canadian institutional sites commonly have 600 V or 208 V, and many sites abroad run at 50 Hz, so the motor and the supply are specified per site. Everything else runs on a 24 VDC control bus kept physically apart from the three-phase side. Enclosure heating and cooling are deliberately put on the alternating-current side, to keep a load that is large at −30 °C off a control bus that is already working hard.
An uninterruptible supply carries an orderly return to SAFE and keeps the sensor head running through a loss of supply. It does not carry the drives, and it does not need to: loss of power is safe regardless, because every breech valve is normally closed.
The network is in three parts and they do not touch. The safety chain is hard-wired and dual-channel and never rides a network. The control link is a point-to-point bus from the controller to the operator station, running to 40 m on copper at its rate and over fibre beyond that. Video and track run on a segregated fibre Ethernet, one-way to site security. There are no external data ports on the mount, and the fire-control connector is physically capped when it is not in use.
Dual-channel, fail-open, in series ahead of the arm relay. A hardware watchdog de-energizes every output and the controller resolves to SAFE without software.
A controller-to-station bus at 250 kbit/s, good for 40 m on copper at that rate. Longer runs put both the link and the interlock loop on fibre, and the fibre interlock is proven as a safety function.
Imagery and status reach site security one way. Cybersecurity is designed to IEC 62443 as a design basis. Fibre off the mount gives galvanic isolation and emits nothing.
Until a hit probability is measured, the safety case treats every round fired as a miss. What follows from that is the first design driver on the line, and it is set out before anything else is offered.
A 1.600 kg round that misses lands out to 1,659 m from the mount, at a drag coefficient of 0.35 on the Ø70 reference, and at the mount's +75° limit it is in the air for 28 s. Swept across every quadrant elevation, no landing falls below 7.3 kJ. The round's terminal velocity is 137.9 m/s, so it never slows below about 95 m/s on any arc; steep lays bring it down nearer, not softer. If a fairing halved the drag, the reach would grow to 2,215 m and the lightest landing rise to 11.5 kJ.
Sectors and elevation limits change where a miss lands, not how hard it lands. Launched from an illustrative 30 m of roof height – not a site value – the low lays reach up to about 200 m farther than from ground level. The answer the launch chain carries – an exclusion zone over the full muzzle arc and downrange, held clear while armed and firing, with an area-clear key made to arm – needs ground the operator owns and can walk. Around a building in a town that ground belongs to the public, a host state or neighbours.
The line's design answer to that is a miss canopy, offered as an option on the round, and it is in engineering. A packed canopy sits in the round's forward body bay aft of the nose interface, carries no energetic material, no electronics and no power source, and opens by a positive mechanical action that initiates nothing. It works only on steep lays, it drifts with the wind over a footprint as large as the ballistic one, and a canopy that fails to open leaves a ballistic miss. Nothing about it has been tested and no test result exists.
| Quadrant elevation | Range | Time of flight | Impact speed | Impact energy |
|---|---|---|---|---|
| 5° | 525 m | 3.20 s | 144.5 m/s | 16.7 kJ |
| 10° | 894 m | 6.10 s | 120.5 m/s | 11.6 kJ |
| 30° | 1,597 m | 15.64 s | 95.3 m/s | 7.3 kJ |
| 45° | 1,633 m | 21.14 s | 99.6 m/s | 7.9 kJ |
| 75° | 788 m | 28.05 s | 110.0 m/s | 9.7 kJ |
The line's charter sets a gate of seven conditions covering the canopy test program, hardware enforcement at the mount, the site's acceptance of the drift footprint, counsel's written answers, a classification opinion, the owner's open rulings and the frames. None of the seven is met, so no page, sheet, brochure or alt text on this line says that either mount suits a correctional facility, a diplomatic mission, a compound or any other occupied site, or that a miss comes down under a canopy.
Two things stay with any site whatever the design does. The target's own fall is a hazard for every way of defeating a drone, including the drone's own crash, and the mount must not make it worse. And a person at an ordinary walking pace covers tens of metres in the 28 s the round can be aloft, so ground that was clear when the key was turned is not the ground the round lands on.
How the machine stands on the roof, how many tubes it carries and how it is loaded are open owner decisions. Each is given here with what follows from it, and none is presented as settled.
The skid set on a dunnage frame whose posts pass through curbed penetrations onto the building's primary structure. It inherits the skid layout whole – receivers along the flank, cabinet at one end, cradle in the middle. It is the heavier of the two: a thirty-two-tube skid is 3,532 kg dry before its frame, and the frame adds of the order of 800 kg again. The skid's screw jacks level it; they do not anchor it and they do not bear on the deck.
The same slewing head on a short stool set directly over a building column, concentrating the load where the building can take it and giving the line one head design for both products on a small footprint. It needs a column with the capacity for it and room on the roof for the air packaging. The design definition recommends it for study; the choice is the owner's.
The tube count is an open owner decision, and it moves the loads, the bank, the drives, the mass and the lift plan together. The azimuth moment runs 646 kg·m² at six tubes to 1,738 kg·m² at sixteen. The worst shot yaw torque runs 2,183 to 3,274 N·m on a single centred pod, and the design brake torque follows at twice it, because the brakes and not the drives carry the shot.
Twin pods move each pod's mass out to a lever and take the shot torque with it: at an illustrative half-metre offset the worst yaw torque rises to 12,370 N·m and the design brake torque to 24.7 kN·m, against 6.5 kN·m for a sixteen-tube centred pod. A single centred pod is cheaper in brakes by about a factor of four, which is the strongest engineering argument in this decision.
The reference auto-index magazine holds twenty-four rounds behind a lock, with a motor and an encoder and no pyrotechnics. Pre-loaded pods hold one ready round in each tube behind a locked, sensed cover, reloaded at the breech or by pod exchange, with no indexer to design. Which one a site gets is an open owner decision.
A packed canopy in the round's forward body bay, offered as an option on both rounds, with no energetic material, no electronics and no power source aboard. Where a site requires it, the mount enforces it in hardware: a breech switch reads a mechanical round-type key, and the site's cam set carries the minimum lay elevation the release needs. Nothing about the option has been tested and no test result exists.
The lines this mount holds on every architecture, on every roof and for every customer.
The page this sheet specifies, and the sheets beside it in the line.
The page this sheet specifies, with the pictures and the reasoning.
A slewing pedestal for the Ø90 bore at a fixed site.
Every product and platform on one sheet each, on the web and as a PDF.
A first conversation needs the building, its engineer of record and what its primary structure can take; the three-phase power and the roof space for the air; the airspace the mount would cover and who else uses it; the ground within the survey radius that a miss can reach and who owns it; and who would hold the arm key.
Not an offer. Enquiries are screened, international transfer is subject to Canadian export permits taken per shipment, and all designs, systems and technologies shown are patent pending.
