Both halves of the enterprise run one rulebook. Every design holds one authority order and computes on board. Outside the two ruled mine clearance configurations, every design also guides by one of three means that are not in the radio spectrum, and senses without emitting. The fleet is here, and so is the stack inside CDNS Autonomy.
No radio and no GPS aboard the fleet, with the one ruled exception: the two mine clearance configurations, KAOS-MC Land and KMM-01, carry GNSS and command links, and KMM-01 also carries a marine radar and AIS to see traffic and be seen. Everywhere else, in air, on ground, in water or under ground, nothing transmits by radio and nothing guides on a link.
Ruling out the radio is a design call taken at the drawing board, not a patch applied later. Outside the two ruled mine clearance configurations, everything in the defence fleet guides by one of three means that are not in the spectrum: nothing at all, a physical optical fibre, or passive onboard sensing.
The rule does not bend for convenience, and no buyer has to work out which side of it a program sits on. In government-facing documents the same architecture reads as RF-independent by design, for operation in degraded and denied communications environments. Doctrine carries the rule, the refusals it belongs with and its one ruled exception, and the fleet carries it program by program across the four domains.
No tier carries a command radio or a satellite receiver, so there is no link to deny. Jamming denies the radio bands. A fibre and passive optics are not in them.
One design philosophy, three ways to guide a platform, and no radio in any of them. Every family is built against the same ladder across all four domains.
The path is computed before launch and nothing guides in flight. On the Goose CS-110 lead round that is literal: no battery, no motor, no guidance electronics. Nothing aboard can be jammed or spoofed, because nothing is aboard. Air interceptor rounds and one-way underground runs use it.
The platform trails an optical fibre and a person commands it down the wire. A physical link cannot be jammed, spoofed or direction-found, and it keeps a human in the loop by construction. This is the default tier across the fleet and the tether norm under water.
Passive onboard sensing: optical-AI on the air side, SLAM on the ground. The platform receives and does not transmit, so it needs no link and offers none to find. It is the capability ceiling, and it carries autonomy policy weight.
The ladder is an actuation ladder. Tier 1 sets its fins once, at launch, with no in-flight actuation and no electronics that have to survive the launch pulse. Tiers 2 and 3 need driven fins: actuators, power and control electronics that add cost and have to live through launch shock. Manoeuvre authority is bought with money and complexity, one tier at a time.
Under ground the fibre carries more than commands. It is the breadcrumb back out, and on the boring line it is the conduit product left in the bore.
Tiering is also a manufacturing strategy. All three tiers share the moulded airframe, the launcher family and the production line, and the differences live in the payload bay. One program, not three, because the tooling is the company's own. The CDNS UAV Platforms page carries the lead round; Manufacturing carries the shop that cuts the moulds.
The three-tier ladder is family doctrine, not a uniform spec sheet. Physics and mission bend it, program by program.
| Program | Tier posture |
|---|---|
| Goose · Air · CS-110 | Tier 1 in the lead-round configuration: no battery, no motor, no guidance electronics. Tiers 2 and 3 stay family doctrine; powered scope sits with CS-120. |
| CS-120 · Air | Tier 2 fibre-guided primary, human in the loop, with Tier 1 as the degraded mode. The Tier 3 seeker sits under a counsel-first policy review. |
| Water family · CS-310 / CS-320 | No ballistic tier at sea. The Tier 2 fibre tether is the workhorse and the norm in this medium, with bounded autonomy for long legs. |
| Underground family · CS-4xx | Tier 2 fibre-guided by default: guidance, communications, breadcrumb and, on the deep series, power in one strand. Tier 3 is mapping autonomy only, never engagement autonomy. |
Designations per the fleet roster. Where a family shares one posture, the family is named. Platform designs are held as proprietary know-how and trade secret.
Each posture is worked out in its own medium on the family pages: CDNS UAV Platforms in the air, the Water family in the water, and the Underground family under ground. The fleet holds them in one place.
Physics and mission, not preference, decide where a family leaves the ladder. Each divergence follows from what that platform can carry and what its medium allows.
The underground family caps autonomy at mapping. Engagement autonomy does not exist down there: a Trembler Line CS-435 cue is detect, localize and cue, and a human decides.
Autonomy has a governor on every platform that has any. Tier 2 keeps a person in the loop by construction, and it is the fleet default for that reason. The Tier 3 air seeker carries a counsel-first policy review.
Sensing is how a platform knows where it is and what is around it. None of it is a link, and none of it can start a machine.
On the fleet, the autonomous tier is passive optical: optical-AI in the air, SLAM on the ground. It reads light rather than a channel, so it gives an emitter nothing in the spectrum to find.
On a converted machine the perception set is local and mixed: cameras, lidar and proximity sensing, resolving objects, free space, hazards and the confidence attached to each. None of it is a radio and none of it is a command path. A camera reading the machine's own dash is how instrument state is taken, instead of a tap into the manufacturer's bus.
Heavy-equipment autonomy needs a state estimate closer to what an experienced operator actually perceives, so the state set is wider than a position: the mission frame, the chassis frame, the rotating upperstructure frame, the tool frame and linkage state, velocities and angular rates, ground slope and the local support plane, slip and traction confidence, load and tool interaction, pose covariance, sensor health and calibration validity, and confidence in dust, glare, precipitation, darkness and occlusion.
A machine can be locally collision-free and still be unsafe, because of slope, slip, load, hydraulic response, swing inertia, tool contact, ground failure or uncertain chassis orientation. On a continuously rotating excavator, upperstructure attitude is never silently substituted for chassis attitude.
Unknown state is a valid state. Uncertainty changes permissible behaviour: when state quality falls below what a skill requires, the task system slows, stops, asks for human review, or prohibits the skill. Safety-relevant sensors carry their own diagnostics and a defined failure response.
External sensing may remove authority. It may never create it. That holds whether the sensor is on a round in flight or on a machine in a yard.
Mission runtime and safety functions execute on board. There is no cloud in the loop, and no foreign service a mission depends on.
Offline-first is a design property rather than a deployment option. A supported release operates and recovers locally, with bounded behaviour when a link is lost. Offline build artifacts, signed images, dependency mirrors and recovery media are maintained for supported field versions, and the recovery image and its procedure are controlled.
Compute dependencies are abstracted, so a later processor migration does not require redesigning the boundary between the computer and machine control. Model weights, calibration assets, machine-skill manifests and maps are handled as controlled software and data configuration items.
External systems talk to a mission gateway, and the gateway translates only permitted request types into the approved local task vocabulary. Machine-control and safety networks stay segregated from service and mission networks. External link loss or compromise cannot create actuator authority.
Offline-first operation does not eliminate cyber risk, so the discipline is written into the release.
Core operations continue without a foreign cloud or service, one of the ten dimensions set out on Sovereignty, where control and recoverability are the measure rather than the nationality of every component.
The other half of the enterprise converts machines that already exist. The same rulebook applies, and the hardware boundary is the whole point.
The unit sits on the operator's seat under the machine's own lap belt. It works the joysticks, levers, pedals and switches the manufacturer fitted, reads the dash with a camera, and lifts back out. It never connects to the machine's CAN bus, its engine control unit or its firmware. The only wire between them is a fused accessory feed. It takes its work in one of three ways: loaded and sealed at the dock; a fibre tether to a person at a stand-off station; its own perception inside the same rules.
The dock is what stays when the unit leaves: the lap-belt anchors that hold the cradle on the seat pan, and the pinned receiver pockets the control platform stands on. Nothing is cut, nothing is tapped and no controller is flashed. The machine returns to a crew in minutes and is standard again, so one fleet serves crewed and uncrewed work.
Six interface families are what the kit is engineered around, not a machine: dual-axis hand control, rotary control, linear foot control, discrete control, instrument observation, and dynamic-state sensing. A new machine is a survey against those six.
Keeping the manufacturer's control is the governing rule. Steering is driven from the centre of the wheel through a machine-specific adapter plate: the wheel is not drilled, and the rim stays free for human hands. The drive is back-driveable, torque-limited and independently sensed, and it engages the wheel rather than the column.
The unit checks which machine it is on, and a mismatch carries no motion authority. A person starts the machine on Responder and civil work, every session. On Defender the machine may be started on a remote command from the stand-off station, over the tether, on ground closed to everyone the job does not need and with nobody at the machine; the authorization, the wired stop and the manual release are unchanged by it. Permanent unattended fitment, public-traffic work, and a guaranteed production rate or response time sit outside the line's scope on every profile. Inside the unit the control network is wired, and nothing wireless carries a safety loop or a motion command.
Machine identity, then control geometry, instruments and the machine's own limits, measured on that machine.
The removable kit, sensor mounts, compute, energy path and harness go on. Nothing is cut, and the accessory feed is fused.
Control zero, travel, force and rate maps, neutral proof, sensor calibration and time sync, then static diagnostics and fault injection.
Bounded motion commissioning under supervision, compatible skills only, then the configuration is signed and sealed with a rollback package.
That supported list grows one qualified configuration at a time, and the line publishes machine families rather than individual machines: engineering plant, logistics and handling, terrain and base support, and customer-defined families. The group's own 290G, D6T and 930 are the first reference iron. On removal the operator station is returned to baseline and inspected. CDNS Autonomy carries the line in full, and How it works takes the six interface families one at a time.
A converted machine does what its rule set allows and nothing else. The rule set is signed and sealed, the authorization is a lease, and the physical stop sits outside both.
The rules ship sealed: signed rules and firmware, a hardware root of trust, no debug access, and tamper detection that ends in a safe stop with the log retained. Signing keys are held in Canada. The seal is chosen into the parts rather than bolted on afterwards.
Authorization is a lease. It is time-limited and signed, issued against a machine and a task, and withdrawable by wire or at the dock. Withdrawal or expiry ends in a safe stop at the next safe point and a minimum-risk condition. It is never an instant stop sent over the air, and the safety loop stays wired. A de-authorized unit stays installed and will not run, and the host machine is never touched.
One hardware family is programmed apart.
Responder CS-810 works fire ground, structural collapse, hazmat, flood and wildfire earthworks, and rubble and route clearance for civil agencies.
Defender CS-820 takes the seat of the machines defence engineering already runs, military-pattern vehicles included, each one a surveyed configuration of its own.
Human safety comes first, on every line. It never operates a weapon and never fires anything.
Seven authority modes and five mechanical states set what is possible: off, manual, assist, approach, teleoperation, autonomous and maintenance, against a machine that is in its factory state, installed and disengaged, armed, under autonomous control, or in fault and safe. The tasks a profile may run, the movement space it may use and the safe state it goes to are decided per task, in advance, and never in the moment.
A minimum-risk condition is task-specific rather than universal. In a burning structure, stopping and waiting for a person can itself be the harm, so each task carries its own. The physical stop and the manual release on every actuator always remain, on every profile. Safety carries the whole architecture.
Hardware is bought and owned by the customer. The configuration and the application are licensed, sealed and revocable.
What a converted machine can do arrives as controlled packages with a fixed anatomy, each frozen against one exact configuration.
Every machine skill package carries the same parts.
An accepted skill is frozen against an exact machine, hardware, software and calibration configuration. Promotion happens by signed release only. Runtime learning gathers evidence for the next revision and cannot promote itself. What runs on a machine is what was released, and the manifest and the compatibility check make that a property of the system.
Skills come from controlled learning from qualified operators, not from self-training. Demonstrated behaviour that violates an engineering or safety constraint is rejected even when an experienced human performed it. What results is a library of approved technique elements: a skill may select among them on machine state, terrain, attachment, task objective and confidence, and every element stays traceable to its own evidence. The operator's knowledge is preserved without turning anecdotal human behaviour into unbounded machine policy.
The machine's identity is a record rather than a label, across thirteen domains: host platform, human controls, machine kit, energy, compute, sensors, harness, software, calibration, skills, safety, maintenance and release. A customer can prove exactly what hardware, software and skill set is fielded. Autonomy and machine skills carries the stack in full.
Technology enquiries are screened before any discussion, and technical detail is released in steps.
Every enquiry is screened. Supply is subject to Canadian export permits issued per shipment, and the export posture is counsel-first. Release of technical data follows screening of the recipient and the destination, and a permit where one is required.
What is public is capability and sanitised architecture: this page. Program briefs and sanitised interface control documents, then configuration records, integration, cyber and support documentation, then drawings, bills of material and restricted technical data, open in four tiers under non-disclosure, export and security controls. Procurement sets out what each tier holds.
For an integrator the boundary is a controlled external interface document over a wired or at-the-dock connection: mission objects, status, health and events, with the internal implementation protected. An external system requests work in that vocabulary and receives no actuator authority. Primes and OEMs carries the integration and licensing route.
Designs are patent pending. Nothing on this site is an offer, and no prices appear on it.
The architecture on this page is built for a particular reader and a particular kind of work. The boundaries are part of the design.
Bring the environment, the fleet and the task. The first conversation is about which tier the work needs and what the machines already have.
An enquiry is screened, a technical brief follows, and a conversion begins with a survey of a machine rather than the sale of a vehicle. Bring the denied condition you have to work in, the machines you already own, and the ground you cannot put a person on.
