AI plans. Rules govern. Humans authorize. Safety has veto.
Steady Eddie carries its intelligence on board, in layers, each with a job and a limit. The layers that perceive and plan are software models, and we update them: as the models improve, every unit improves with them. The rules that govern the models, the controller that moves the machine and the safety system that can stop everything are not touched by an update, and no model can talk them out of it.
The machine working, turning in the engineering model.
What each line means in the seat.
Four sentences run the whole system. They are an order of authority, and the order runs one way.
- AI plans. The part that reads the job proposes what to do next: an ordinary bounded action, following a procedure written before the day started.
- Rules govern. Plain rules, the same every time, decide whether that proposal is admitted. No model sits inside them, and no model can read or write the limits they carry.
- Humans authorize. A named person approves a plan before it can be worked, and that approval has an end on it. Nobody widens it from the seat, and the machine cannot widen it at all.
- Safety has veto. The safety side stops everything above it without asking the software. Sensing can stop the machine. It can never start it.
A person can ask the machine to move. A person cannot ask it to stop being able to stop.
What proposes, what decides, what stops.
Every command passes down through this stack. The thinking is replaceable. The governing, moving and protecting parts are not, and they sit underneath, where a model cannot reach them.
- Language and reasoning.
Replaceable, advisory. It reads a plan, a question or a drawing and explains what Eddie intends, with no right to send anything to a part that moves. Every answer names the document, revision and section it came from, or the screen refuses it.
- Planning.
Replaceable, proposes only. It turns an approved job into ordinary bounded actions: a cut, a lift, a pass, a swing. A plan carries no forces and no pressures. It asks each control to go somewhere between the ends of its own travel, and it says when that ask runs out. It cannot ask for a force, because it has no way to name one.
- The scene it keeps.
Replaceable. It keeps two separate books: ground it has never looked at, and ground where its sensors disagree. One number would answer the same for both, and the two demand opposite responses. Neither carries any authority, and what the machine does next differs. It never becomes fully certain, so a pile that was there this morning can be revised this afternoon.
- Perception.
Replaceable, can only remove authority. Detection, classification and tracking, with a confidence on each. Nothing it produces can carry a command. It can say stop; it cannot say go.
- The rules.
Fixed, no model in it. Every command is admitted or rejected here against the limits a named person approved, by rules small enough to write out in full and to test in full.
- The controller.
Fixed, a fixed beat. It works each control on a fixed cycle, the way the calibration taught it and nothing else, on a small dedicated controller rather than on the computer that plans. A faster model makes a better decision; it does not open a hydraulic valve faster.
- Safety.
Fixed, independent, the veto. Its own wiring, its own power, no processor shared with the computer that plans. It is not a rank in the order: it is a plain yes or no, read as a level on a wire, before any comparison. Nothing outranks a thing that is not in the ranking. Under all of it sit the machine's own pilot circuit and main valves, which set how fast that machine answers for a person in the seat exactly as for Eddie.
Eight cameras on a ring, and one disc at the machine's own feet that no camera can see.
The ring is a calculated geometry rather than a camera bolted wherever there was room: how many lenses, at what height, tilted how far down, so that every patch of ground from the edge of the blind disc at its feet out to the visibility circle the standard draws around a machine of its class is seen, and the outer part of that circle is seen by two cameras at once, with a ring of ground just beyond the near band that only one lens sees. The geometry is calculated against a person standing and a person crouching. A plan drawn only against a standing person has not been drawn.
Why eight.
Seven cameras already leave no blind ground. What seven leave is a good deal of ground that only one lens sees. Ground covered by one lens goes blind the moment that lens is dirty, and a dirty lens is a certainty on a working machine, not a possibility. The eighth takes most of that away, and a target seen by two lenses has a distance rather than only a bearing. The ring is turned so no camera sits on the boom's centreline.
The blind disc, stated.
A camera high on a machine cannot see the ground at its own feet, so the geometry leaves a disc at the centre of rotation that the ring does not cover, and the drawing says so rather than hiding it. Part of that disc is the machine's own body, so the ground a person could actually stand on is smaller than the disc. It is why the near band exists: nothing may be in it when the machine is armed, and that rule, not the camera, keeps it clear.
The tilt has a cliff, and the pods sit in a shadow.
Tilt the ring further down and the near edge of cover comes in, until the far edge falls inside the circle and a whole outer ring goes blind at once. The design point sits short of that, and tilt is set and recorded on the machine at commissioning. A standard also limits how much a fitting may block at the operator's eye line, so the pods go where the machine already blocks the view, onto the maker's own mirror and handrail points, never onto a roll-over structure.
Two lenses, one shutter, one rule about light.
The ring wants width. The tool wants detail. The cab shakes. The sun sits on the horizon at four in the afternoon in January. Each of those is a lens decision, made on paper before a camera was bought.
One camera cannot be two cameras.
Field of view and detail trade directly, so a lens that takes in a whole quadrant cannot also pick a person out at distance. Each ring camera carries a wide lens taking in a third of the horizon, and the eight overlap; the overlap is where depth comes from. A narrower lens on the roof watches the tool and the cut. The ring is all one focal length, because a lens cannot focus closer than its own near limit and that limit grows with the square of the focal length: a longer lens is disqualified from near ground by physics rather than preference.
The shutter, the light, and the glass.
A camera that reads its frame line by line, the way most phone cameras do, bends a straight post into a lean when the cab is shaking. What it produces is not blur but a shear: a geometric error that corrupts calibration and cannot be taken out afterwards without knowing the motion exactly, so Eddie's cameras read the whole frame at once. A low sun and a dark shop can be in the same frame, so the camera runs in its widest range and stays there: work lights strobe, and multiple exposures leave artifacts on a slewing machine. And a camera looking at mud still produces a picture: a confident picture of nothing. Each window is cleaned by ultrasound with no moving part to wear, heated against thin ice, and reports whether it is blocked every frame.
The dash, read the way you read it.
One camera in the cab reads the instrument cluster optically: engine running, temperature, fuel, the warning and fault lamps. No wire enters the machine to ask. The lamps are what it is trusted with, because a fixed set of lamps with fixed meanings is far easier to read correctly than a printed number. It can stop Eddie. It can never start the machine.
A spinning lidar, radar where the weather calls for it, and a plain account of what each one loses.
Cameras give the picture. The lidar gives structure and a direct range to everything it hits. Radar, an option where dust and snow are the normal condition, gives presence when they blind everything else. None of the three is trusted alone.
The lidar, and the ground it measures against.
A hundred-and-twenty-eight-channel spinning lidar sits on the cab roof, above the ring, with its channels stacked closely enough that a person at working distance comes back as a cluster of returns rather than one point. Before anything is an object it has to be separated from the ground, and on a slope the modelled ground surface carries its own error, which every object height inherits. A person crouching on a slope sits inside it.
Why dust needs radar and rain does not care.
It is a question of particle size against wavelength. A dust particle is a hard target to a lidar and almost nothing to a radar, while a raindrop is a hard target to both. Radar is a particle-size sensor rather than a weather-proof one, so it is fitted for the weather it buys: dust and snow, presence rather than position. Only the core of each radar's field is used, because the angles at its edge are far worse than at its centre.
The sweep, and the swing.
A machine that swings drags its own boom through the lidar's field, and Eddie takes it out from the joint angles rather than from a stored list. What is taken out counts as declared blind ground, and published measurements of person-detection on a working excavator are at their worst while the cab is turning.
Cameras and lidar lose it. Radar, where fitted, holds.
A filter low enough to keep the person keeps the noise.
Lidar loses first. Cameras hold longer.
The lidar's returns fall away in fog well before a camera's picture does.
Forward sensors bury. The ring holds.
Driving snow buries a forward-facing sensor quickly, and eight cameras do not all face it.
Radar loses it. Cameras and lidar hold.
A radar reading motion cannot see somebody standing still, and two people close together come back as one object.
Lidar loses it. Cameras hold, and radar where fitted.
Dark clothing returns almost nothing to a lidar.
Eddie removes its own authority.
When the sensors disagree or the weather takes them, perception does the one thing it may do with doubt: take authority away.
It knows which way is up, which way it is pointing, and where its bucket is.
A machine on a slope, swinging a load, is not the same machine as one on the flat. A small heading error at the end of a long boom becomes most of the error at the cutting edge, while the position error at the middle of the machine stays small, so this design buys heading, attitude and calibration first.
Two inertial units, not one.
One in the cab, one on the chassis. On an excavator they differ by the swing and by the cab's own mount, and treating them as one puts the bucket's edge badly out. An accelerometer measures gravity and the machine's own motion added together, so a sensor on a moving arm is a tilt sensor only while that arm is moving steadily or not at all.
The swing, and the cylinders.
The angle between the house and the tracks is measured directly rather than inferred, and a length sensor on each cylinder measures how far the boom, the stick and the bucket have gone. Measure close to the actuator for the fast loop, at the link for the pose that puts the cutting edge where it is.
Heading from two antennas, and the swing put back.
Gravity tells a machine which way is down and has no opinion on heading, so Eddie takes heading from the line between two satellite antennas on the roof. An antenna turning on its own axis also changes the satellite measurement by an amount that has nothing to do with the machine going anywhere, and one trench-to-truck swing is many times the whole error the position system is allowed. A truck never does this. A dozer never does this. An excavator does it all day, so the swing angle is fed into the position solution and the term is taken out on purpose. Position and force sensing on each control Eddie works closes the loop, the attitude sensors carry it between beats, and the satellite fix anchors the picture without ever closing one, with a survey-grade corrector where the job wants grade; a value is used only if its age is known.
Objects, the ground, the near band where it stops, the far band where it watches.
The sensing set is built for the ground we work: dust, snow, fog, dark, and a machine that swings.
An illustration of the picture Eddie builds: objects, the ground, the near band where it stops on entry, the far band where it watches. Not a live output.
The bands, and what each one asks for.
The space around the machine is read as bands rather than as one line. Something close enough to touch is the highest-priority ask for a stop; the band beyond it asks for a stop or a hold; the caution band asks the machine to slow, and asks when something outside it is on a course that will bring it in; the outer band reports what it sees and asks for nothing. Two more are shaped rather than round: the volume the tool sweeps, and the path the body will sweep as the machine turns. Nothing in that list is a stop by itself. Each band raises a request, each request is answered on its own by the safety side, which keeps the veto, and how far each band reaches is still to be set for each machine, from a survey of it.
What the bands are not.
The exclusion zone a site draws on the ground stays the thing that protects a person on foot. The bands are a useful working aid, and they are not what makes it safe to be near a working machine: the plan is still the gates, the spotters and the barriers, never the sensing. The one outdoor scanner in this field carrying a safety certificate protects out to a small fraction of the distance it will warn you about. That is where certified outdoor sensing stands today.
No performance level is claimed for the sensing set. Designed against ISO 13849 architecture, toward ISO 17757. No certification is claimed.
Each sensor on its own branch, so a failure has a name.
The picture is not one soup of pixels and points, the wiring is not one network, and the clock a stop is counted on is not the clock on the wall.
Read alone, combined late.
Each sensor is read on its own, judged on its own reliability, and only then combined at the level of objects, so that when one fails Eddie can say which one and carry on without it. Blending everything early is rejected on the published measurements: in dense fog the blended answer falls below what a single camera sees alone.
It is required to know when it cannot see.
Weather that scatters light is counted rather than assumed away. A sensor that quietly loses range as it warms is not trusted to say so, so its limit is set from outside it. A frozen camera is treated as worse than a lost one.
Kept apart by metal rather than by settings.
The safety wiring is not on a network at all, so a safety function cannot inherit a network's failures. The controller has one bus of its own with nothing else on it, the cameras send in one direction on a segment of their own, and one link leaves the machine and stops at the data side. A network setting is a configuration; a separate connector on a separate controller is a fact. A stop the safety side owns never travels over that link, a grant of motion never crosses, an approval crosses only signed, and a configuration change only logged.
Counted in beats, not in clock time.
Every safety-relevant sequence is counted in beats of the controller and in no other clock. A beat count is never adjusted, has no leap seconds, never steps backwards when a time source arrives, and cannot be reached from outside the machine, while a timeout on a wall clock can be defeated by moving the clock. The record carries both, and says which clock it is using.
An excavator has no route. It has a circle, a reach, and a list of things that must not come into it.
A road vehicle's operating domain says where the machine may go. An earthmoving one says what must not be allowed to happen, and this one takes the second form. Anything the domain does not name is excluded, because a domain that includes what it forgot lets anything nobody thought of count as permitted.
The machine, and the ground.
Before there is any authority: it is the machine this unit was set up for; a person walked around it, started it and cleared it; the machine's own pilot lockout is not locked; and every control was at its own detent when the unit armed, because arming onto an off-centre control commands motion at the moment of arming. The machine's own brake and steering performance are demonstrated by hand first: what Eddie adds sits on top of the base machine's standards. Ground bearing, overhead clearance, and buried or overhead services are declared by the site rather than sensed; slope is declared and then watched; and a declaration expires. Expiry is the cheapest defence against the machine's picture of a site drifting away from the site.
The task.
Trenching to a fixed grade, bulk excavation to a stockpile, and backfilling and levelling are in. Loading trucks is conditional, because the hazard is the interaction rather than the dig, and so is travelling, because the hazard footprint moves with the machine. Out: work with a person in the trench; lifting a suspended load, because a stop turns momentum into a swing and nothing of Eddie's may hold a gravity load; and work next to live services, invisible to every sensor fitted. Out for now: demolition and sorting, and work in the dark.
Seven modes, five states, and the pairs that must never happen.
Seven authority modes, from off through manual, assist, approach and remote to autonomous, with maintenance kept as a mode of its own; and the unit's five mechanical states: standard, installed, armed, under autonomous control, and fault or safe. The mode says who may command motion; the state says what is physically connected to the machine's controls. Set them out as a grid and every square is either allowed or written down as forbidden, and each forbidden square becomes a test the machine must be shown to fail. Remote operation is manual operation with the person somewhere else, and with no supervisory function active the machine does not operate.
Authority is not a ladder anyone can climb.
A move happens only when the safety system is clear, a named person has signed for this plan, the move is inside the limits that person approved, and the rate, force and position clamps are satisfied. All four, every time, or the machine does not move.
Why four yeses and not a ranking.
A ranking has an order, and an order can be got wrong: five ranks sort a hundred and twenty ways and one of them is right. Four yeses have no order at all, so there is nothing to sort and nothing to invert. Write the decision out and it is sixteen lines, of which exactly one lets the machine move, and a decision small enough to print in full is small enough to check line by line.
The approval is bound to the plan.
An approval carries a fingerprint of the plan it was given for, and the rules check that fingerprint on every command, so a plan changed after approval has every command under it refused. It also carries an end: it stops at the earliest of supervision ceasing, a change to the safety software, a change to the site model, or the end of the session. A missing fingerprint, or a plan that no longer matches it, is a rejection: the absence of something to check against is never the absence of the requirement.
What the intelligence may never decide.
These are not settings, and not policies enforced by a check that runs afterwards. Each is something the system gives the models no way of expressing.
- Restore motion after a stop. Coming back is a person's act.
- Start the machine. There is no start in the product, and a key is a person's authority token.
- Widen its own limits. The approval is signed, and planning has no path by which to write to it.
- Release the machine's own pilot lockout to enable it. That one is one-way in software: it can be driven to locked, and a person puts it back.
- Grant a permission on the strength of what it can see. Sensing removes authority and never creates it.
- Keep working from a stale picture. Every action carries the moment it expires, and an expired action is never re-used.
- Take any safety credit. No model appears in any safety function.
Nothing unsigned runs on a machine that can move.
The rules are the line, so they have to be the hardest thing on the machine to change quietly.
The keys that matter are not on the machine.
The key that signs a release lives offline and is used at release only, so getting into a machine cannot produce signed software. The key that signs an approval is not on the machine either: it is on a token held by the person, because an approval signed by the machine about to carry it out is not an approval. Service access is time-bounded and needs physical access to a connector that is dead while the machine can move. Every intervention goes into the record, the authorized ones as well as the rest, because what has to be provable afterwards is that the machine still conforms after a change we made ourselves.
It checks which machine it is on, two ways that fail differently.
A passive coded fitting in that machine's own dock harness is read by the safety side and sits in the wired path; a signed profile is the record of which machine this is. Both must agree, because a coded fitting cannot be forged from a distance and a signature cannot be moved with a harness. On the wrong machine the unit has no authority at all, and wrong-side seating is blocked the moment the unit arms rather than at boot or at the first command. The record of who authorized what is kept where the day-to-day log cannot overwrite it, verified with a public key alone, off the machine.
How a new model earns its seat.
Perception and planning models move faster than anything else on this machine, and Eddie is built to take the next one. What changes is the bar a new model has to clear.
Four gates.
The model, its weights, where it was trained and the interface it claims are signed, and the signature is checked before the file is mapped into memory. There is no unsigned mode on a machine that can move: unsigned software loads only in maintenance, with the actuators released. It must fit its interface, keep to its share of the time and the memory, give the same answer to the same input, and be able to say stop: a model that can only ever emit a trajectory has no way to, and no training gives it one. A model whose only output is a trajectory is ruled out on that point, however it is trained. It then runs in shadow beside the model it would replace, with no authority, its outputs recorded and thrown away, until it has agreed for long enough to trust.
Swapped at a beat, with the old one still there.
Both models stay loaded, the swap happens at a beat of the controller, and no frame is handled by both. Rolling back takes longer than one planning beat, so anything in flight at that instant is thrown away rather than finished against a mixed picture, and it drops the approval: a person signs again, and there is no reverting to the last command.
A separate rig records how good operators move.
With a person in the seat and the unit out of it, a separate recording rig takes down what a skilled operator's hands actually did, and what the machine did back, because a record of the hands without one of the machine is a gesture rather than a technique.
Teaching is a disconnected state.
While a person drives and the STE Trainer records, nothing of Eddie's is connected, control units included, the rig is wired to nothing on the machine, and it has no authority of any kind: nothing it produces reaches any control path, in any mode, ever. Learning happens off the machine, is reviewed by a named person and ships signed. Your work is held alongside other people's and never blended into theirs, so it can still be pointed at, counted and taken out. Nothing learns on the machine and no weight changes itself in the field. Ours are the first machines any update is written for.
It plans, it records, and it holds no authority at all.
The computer that plans is the shortest-lived part on the machine and the one most likely to be replaced. How it is fitted follows from that.
What it may do, and what it may never do.
It may read every sensor, propose a command into limits already set below it, record and hash the evidence, serve the screen in the cab and the one approved link, and be replaced in the field. It may never grant, restore or extend motion; never be a credited input to any safety function; never be needed for the machine to reach its safe state; and never carry a veto over any link. Nothing the machine does when something goes wrong needs it, so its power can be taken away and every one of those responses still happens. Folding it into the safety cabinet would save an enclosure and cost the physical separation the whole product rests on, so it stays two boxes, carries no radio, and exposes nothing to the machine's own electrical system.
Built so its own successor drops in.
Silicon has a commercial life shorter than a machine's working life, so the module sits behind interfaces a successor can meet: the same footprint, the same thermal interface, one wire to the controller at the same rate with the same behaviour on a timeout, and the same record format. A new generation changes the board it sits on and the software that drives it, and the checks are done again.
The hands, drawn from the model.
Every control unit is drawn in the engineering model as built: the joystick pods, the pedal pod, the travel pod and the platform they sit on. One set of parts goes on every machine; what changes is which are selected, and the numbers in that machine's own profile.
Where this stands.
The first thing you are told, because everything after it depends on it.
The intelligence on this page is designed, specified and written down, and that design is what we will put in front of your engineers and your safety people. Each replaceable seat is filled by whatever model clears those admission rules, and a name earns nothing on its own. No assessment against ISO 13849 or ISO 17757, the standards we design against, has been performed. We would rather you read that here than find it out for yourself later.
Where the job is prepared.
Before Eddie moves, the job is prepared off the machine, and that preparation never touches the machine, holds no session and moves no control. The furthest it can take a job is ready to ask, and turning that into permission is a person's act. The STE Site Foreman is where that preparation lives, and how it works covers the day around it.
Short answers, for the crew and for the people who can say no.
It keeps bands around itself: the near one it stops for, the far one it watches. Walk into the near one and it holds, and a person at the machine clears it. The plan is still the gates, the spotters and the barriers, never the sensing. It can stop itself on a warning lamp, and it can never start the machine.
The models propose; plain rules with no model in them admit or refuse every command. A named person signs for a plan, and that signature is checked against a fingerprint of the plan on every command. Four separate yeses are needed for any move. Nothing below the rules changes when a model is updated, no model is credited in any safety function, and no performance level is claimed. The stops that count are wired, on the Safety page.
No wire enters the machine, and the dash is read optically. The computer holds no authority, is not needed for the safe state, and can be taken out. The service port is dead while the machine can move, and the settings for your machine are recorded at commissioning.
Nothing here is credited in a safety argument and nothing here is certified. What is written down is the design: the authority order, the admission rules a model must clear, what the models may never decide, and the ends on every approval. Learning reaches a machine only as a signed release, logged.