A person is in charge,
and the site can still read the machine.
An empty seat changes every safety question on a site. So this page is laid out the way a safety officer walks a machine on the day they visit: what you are told before you come, what you watch, what you put a hand on, what you pull, what stops it, and what you read. Three people usually decide whether a machine gets a robot in the seat: the safety officer, the maintenance lead and legal. A crew works beside it every day. It is written for all of them.
Where this stands.
The first thing you are told, because everything after it depends on it.
The three ways to take control away by hand are on the machine today, and we will demonstrate every one of them for you at our own Test Facility in Alberta. The spine is designed into the unit we have built. The five site tools, the pre-start and the hazard analysis are designed, specified and written down, and that design is what we will put in front of your safety people. No assessment against ISO 13849 or ISO 17757, the standards we design against, has been performed. We would rather you read that here than find it out for yourself later.
What each line means on the machine.
- AI plans. The planner reads the situation and proposes what to do. The procedure it follows is written in advance; it never makes one up.
- Rules govern. Machine limits, site rules and job rules decide what is allowed, and the response to each situation is fixed in advance, not improvised.
- Humans authorize. Hard safety limits outrank every person, and every person outranks the software. Anyone at the machine can override anything downstream of them. Nobody can talk a hard limit out of the way.
- Safety has veto. The safety side stops the system without asking the software. Sensing can stop the machine. It can never start it.
What ships on every unit and cannot be optioned out.
Eight things ship in full on every unit, in every configuration, at every price. Not options, not tiers, and not on the table when somebody wants the number lower. The rule is one sentence: you cannot strip the system away to get the price down.
- An independent safety controller.
Its own power, its own wiring, and no processor shared with the computer that plans the work. Freedom from interference is a requirement, not an optimization, and a shared processor cannot demonstrate it. When it says stop, nothing above it gets a vote.
- A stop with no software in the path, and a pull-lanyard at the machine.
Press the one or pull the other and every drive loses the energy that moves it. Only a person at the machine can clear it.
- A red manual release on every actuator.
One pull, no tool, visible from the cab door. A spring does the releasing, so it works with no air and no power anywhere in the system.
- A wired control path.
Every command that moves the machine, and the whole safety circuit, travel on a wire. Wireless never carries either.
- A safe state that needs no computer.
Every safety output goes safe when its power goes, by spring or by design. If the safety controller itself halts, the machine goes to its safe state. It takes power to hold it anywhere else.
- It runs only on the machine it was set up for.
The unit checks which machine it is on before it is allowed any authority. On the wrong machine it has none, because every limit in it was set for one machine.
- Sensing on the machine that can only stop it.
It takes authority away without asking anything, and it can never grant it.
- A record that cannot be quietly changed.
Every intervention, every safety-software version and every safety decision, kept. An incident is the difference between what was commanded and what actually moved, and you cannot report that unless both were recorded.
Cameras, the planner, the network and the record can all fail at once, and the worst outcome is that the machine stops. Anything that cannot survive all four is not a spine.
A person starts the machine, every session.
The day begins the way it always has. A person walks around the machine, completes the pre-start inspection, starts it and clears it for operation. Only then does Eddie engage the controls: every session and every machine on that ground. Eddie does not start, wake or inspect a machine on this work.
Nobody can change that setting, because it is not a setting. Nobody arrives in the morning to find a machine that woke itself up.
Three independent ways to take control back, by hand, at the machine.
- Pull the machine's own pilot control lockout lever.
Fitted by the manufacturer, part of the machine. Eddie works it exactly as an operator does. It was on the machine before we arrived and it stays after the unit lifts out.
- Pull the red manual release on any actuator.
One hand, no tool, no air, no power. Each release separates that actuator from the control it drives.
- Vent the air.
On the systems that carry air, every drive lets go at once. On STE Precision, the safety system cuts power to every drive instead.
Each of the three works without the other two. A person can walk to the machine and pull the lockout lever. A technician can reach any actuator and pull its release by hand. Anyone can vent the air. No single failure takes out more than one of the three. The lever is the machine's own. The release and the vent are Eddie's, and Eddie's own safety controller and stop wiring sit beside them on Eddie's side of the line, never touching the machine's.
Every actuator has a red release you can pull by hand.
It works when nothing else does: no tool, no air, no power anywhere in the system. We demonstrate it on the machine, actuator by actuator, with your people watching and counting. It is the first thing a safety officer can check for themselves, and we would rather show it than describe it.
The same parts, drawn.
Every part named above exists in the engineering model. The first three are cutaways from it. In each cutaway, grey is framing and mounting plates, white is an actuator with a red coil spring on its shaft, black is a post, an arm or a cable run, and the small red rings are the release. The red in each frame is not styling. It is the release, and it is red everywhere on this system for one reason: it is the thing a person reaches for when nothing else is working.
Pull the red ring. The drive lets go.
The left joystick pod, cut away; the faint grey boxes are the cab around it. Each drive has a red ring. One pull by hand and the actuator comes away from the joystick it moves, and a spring does the releasing, so it does not matter whether the unit is on. Walk up to the seat, pull the ring, and the drive lets go.
Return by spring. Release by hand.
The pedal pod: an angled plate presses the pedal. The plate meets the machine's own pedal the way a boot would, and nothing is cut into the machine. The coil springs are for the return: take power away and each actuator comes back to its safe position on its own. Pull the ring and the actuator separates from the pedal it drives. The pedal is free for a person to work.
The tracks let go the same way.
The travel pod, on the excavator's own travel levers, the controls that drive the tracks. Ball ends grip the levers. Nothing is cut, tapped or wired into the machine. The springs return each actuator without power. Pull the ring and the actuator lets go of the lever.
The unit, on a tractor.
The unit, fitted to a tractor's own controls in the engineering model, with nothing cut into the machine. It is the same unit, with the same red releases, and a person still starts the machine.
What stops it, ranked.
Five things can stop the machine, and they are ranked. The ranking decides what a higher one may take away, never what a lower one may grant. No stop on this list clears remotely, on a timer or on a message, and nothing on it can start the machine. The second is the release you have just pulled.
- The stop and the pull-lanyard at the machine.
One unit that stays down once it is pressed, with two independent contact blocks and no software anywhere in the path. The lanyard is a cord run where somebody working around the machine can reach it, wired into that same stop. Press the one or pull the other and every drive loses the energy that moves it, of every kind Eddie brings to the machine. Cleared only by a person at the machine, with a separate reset.
- The red manual release.
Mechanical, one hand. Separates that actuator from the control it drives. A person at the machine puts it back, and every release is checked again before the unit is trusted.
- Approach sensing on the machine.
Wired to the safety side, and able only to take authority away. A person inside the zone, or a sensor that cannot be sure, holds the machine. If that goes on, the machine goes to its safe stop. A person at the machine clears it once the zone is clear.
- The hold request anyone carries.
A request, not a stop. Any registered device pressed by anyone removes run permission and the machine comes to a controlled stop; only a person at the machine clears it. Losing one device's signal never stops the machine and never starts it.
- The planner's own stop.
The lowest rank: the software stopping itself. It also stands itself down when every hold-request link on site is lost at once and the site's own rule says stop.
A stop ends in the machine's minimum-risk condition: what this machine, on this task, does when it stops. It is the state the machine is in when a person walks up to clear it. It is decided per machine and per task before the job and written down at the pre-start, because one blanket answer for every machine would itself be unsafe. On the machine we build on today, every drive lets go and the air is vented.
A commanded stop never looks like a fault. A machine that has been asked to stand down shows amber. Red is kept for a fault, steady and never flashing.
Two different things get called a lanyard, and the difference is the whole point. The one at the top of the ranking is wired to the machine and is part of the stop: it is designed to be safety-grade, and pulling it stops the machine. The one a person carries around a site is the hold request, which asks over the air and is not an emergency stop. We keep the two apart in the hardware, in the legend printed on each of them, and in the words we use, because nobody's safety should ever rest on being wrong about which one is in their hand.
What we refused to build.
The question that started this was a fair one: hand twenty people on a site twenty lanyards, each with a kill for the machine. We built the request and refused the kill. A stop that has to travel by radio can be late, jammed, flat or out of range, and the person holding it cannot tell which. Protection that people's lives rest on has to be local to the machine and wired to it. So the thing a person carries asks, the thing on the machine protects, and we will not sell you the first as though it were the second.
Authority is settled before the day, and it expires.
- Capability is not authorization.
Prepared, installed and authorized are three different states, and every screen, gate and record keeps them apart. A unit can be fitted, calibrated and ready and still have no authority to move anything.
- An approval has three parts, and one of them is when it ends.
What was approved, who approved it, and when it expires. An approval with no expiry is not an approval, and authority that has expired is authority that has been withdrawn.
- A boundary can only narrow.
The work area, the exclusion zones and the haul route limit where the machine goes and what it does. They can take permission away. They never grant it.
- What Eddie may do is decided in advance, never on the ground.
Seven authority modes, from off through manual, assist, approach and remote to autonomous, with maintenance kept as a mode of its own. And the unit's five mechanical states: standard, installed, armed, under autonomous control, and fault or safe. Mode and state together decide what it may do, and the pairs that must never happen are written down as forbidden.
- Every control checks itself before it is trusted.
Eddie runs a self-calibration on every control each day. Key rotation stays outside this system, on purpose: a key is a human's authority token, not a machine's.
The job is cleared before the machine is.
Every job goes through the STE Site Foreman before it goes near the machine: define, ground, clearance, prove, record, in that order, through six gates that each close on something a named person wrote down today. It holds no session with Eddie and cannot start anything. The furthest it can take a job is ready to ask. The pre-start it walks is below, in the order it is asked, and every item on it is answered by a person on the day.
- The dock is fitted and torqued.
- The unit is latched, and held a second way.
- The red release on every actuator is present, clear and reachable from the seat.
- Every actuator is on the control it is meant to be on and fouls nothing.
- Wired local control is connected and the local stop is within reach, with nothing of the safety circuit carried over the air.
- The unit can be removed and the machine handed back to a person.
- No cable crosses the way out of the cab.
- The profile and rule set on the console are the ones intended.
- Identified, and matching the profile that was loaded.
- The manufacturer's own walkaround done today by a named person: fluids, tracks, guards.
- The machine's own safety systems working: seatbelt, lockout lever, park brake, horn, lights.
- The implement pinned and its coupling locked.
- With Eddie fitted, every control moves freely through full travel and returns to neutral unaided.
- The machine stops when a person stops it, from the seat, demonstrated today.
- No electronic tie-in of any kind.
- The boundary marked on the ground, not only on a screen.
- A valid locate ticket covering the dig, every marked service walked, hand-expose zones marked and understood, the owner asked about private services.
- Overhead limits set.
- Ground conditions assessed: bearing, slope, edges, water, frost.
- Exclusion zones set and told to everyone.
- Traffic and pedestrian controls in place.
- The foreman, a named person, present and competent on this machine and this task.
- Everyone on site briefed: what Eddie is, what it is about to do, and how to stop it.
- Nobody inside the area who need not be, and everyone remaining knows they are inside it.
- A way to reach everyone, tested.
- Emergency response stated: address, muster point, first aid, the number to call.
- The site owner told that remote or autonomous work is happening here today.
- Every person in the area has a way to stop it within reach, and has been told what it is.
- The minimum-risk condition for this machine and this task is stated.
- If Eddie stops mid-task, the recovery plan is stated: who goes, what they do first, and who they tell.
- Human-only mode demonstrated today: Eddie released, the machine run by hand, and returned to a safe state.
- The unit files its own declaration.
- A person accepts it by typing their name. There is no override, no forced approval and no administrative path around that.
- The highest state a unit can reach on its own is ready to ask.
- Accepted is a person's word.
The hardest safety problem is not the machine. It is everyone else.
A machine with nobody in the seat is not the difficult part. The difficult part is the rest of the site: the truck backing to a load-out point, the person walking behind the tracks, the grade checker who used to catch the operator's eye. A person in the seat gave all of that away for free, a glance, a pause before the swing, a tap on the horn. When the seat is empty those signals are gone, and nothing filed at seven in the morning replaces them at two in the afternoon.
So we took the problem apart into five pieces and engineered each one on its own.
Five tools, for everyone who is not in the seat.
Each closes a different side of the gap an empty seat opens, and each is its own piece of engineering rather than a feature bolted to the same box. What each one is for, and the one rule that shapes it.
A hold a person can carry.
On a working site the person who first sees a problem is almost never the person at the console. This is the tool that gives every one of them a way to act. It is a handheld on a lanyard, designed to be issued to anybody on site. Press it and the request is designed to latch until somebody at the machine clears it. You do not have to walk into the machine's reach, and you do not have to be the person who authorized the job. It needs no training beyond knowing what the button is for, and the morning briefing covers that.
That makes it the one most likely to be pressed on any given day, so it is issued as standard rather than kept for supervisors. What it does not do is protect somebody who has already walked in. That job belongs to the machine's own sensing, the next tool, which is wired and designed to be safety-grade. This one asks, over the air: it can take run permission away, it cannot start anything, and losing one device's signal never stops the machine either.
A request, never an emergency stop, and its own legend says so. Its place in the ranking above is about grade, not importance: it is the one a site reaches for most, and a device people believe is an emergency stop, and is not, is worse than no device at all.
The machine holds, and a person clears it.
The other half of that problem, and the half that does the protecting. Sensors on the machine, wired to its safety side, and the only thing they can do is take authority away. A person inside the working zone, or a reading the sensor cannot make sense of, holds the machine. If that goes on, the machine goes to its safe stop, and a person at the machine clears it once the zone is clear.
Nothing on the planning side can switch it off, because there is no wire by which it could. The zone is drawn from the machine's own reach and how fast it swings rather than chosen to suit us, and it is sized for the person carrying nothing at all, because that is exactly who it exists for.
It can only ever take authority away. Sensing stops a machine; on this system it never starts one.
What a crew used to read off the operator's face.
A crew reads a person in the seat continuously and without noticing: a glance, a pause before the swing, the engine note changing. This puts those signals back where they can be seen from a distance and from a cab: a light tower on the machine, a broadband warning sound, and an indicator that shows which way the swing is coming.
White while the unit is working. Red kept for a fault, steady and never flashing. Amber for a machine that has been asked to stand down, so a machine stopped on purpose never looks like a machine that has broken. Every lamp reports back, so a failed lamp is a known state instead of a silent gap, and the colours are chosen against the provincial vehicle lighting rules.
It is advisory and says so. It shows what the machine is doing; it stops nothing.
The device in the other machine's cab.
The one tool aimed at somebody who is not an operator of ours at all: the driver of the truck backing in to load out. It gives that driver a display of what the unit is doing and a button to ask it to stand down. A set order of moves for the load-out stands in for the eye contact, the wave and the tap on the horn two people used to trade.
One sentence governs every message it carries: the unit never authorizes a driver's approach or departure. It reports its own state, and the driver keeps every decision, exactly as they would with a person in the other seat.
Advisory, and labelled so on every screen. A driver's judgement is informed by it and never replaced by it.
The unit on the roster.
The paperwork that makes a unit a member of the crew. Each one is registered the way a person is, with a number and a mailbox of its own, so the signed tailgate your crew already produces reaches the unit and becomes the day's limits, each limit tracing back to the line it came from.
The line never moves: a unit prepares its own paperwork and a person accepts it by typing their name, as the pre-start above says, with no override and no way around it. The part of the unit that reads the tailgate can only read it.
A unit files; a person accepts. Only a typed human name turns ready to ask into cleared to work.
The five are designed as one set, so that a carried hold, a sensed approach, a signal, a truck's device and a unit's paperwork agree with each other instead of each solving its own corner. The ranked stop set above is where they meet: what is sensed on the machine is designed to be safety-grade, what is carried is a request, and the ranking keeps them in that order.
What can go wrong, and what answers each.
Every line here is a row in our own hazard analysis, with the measure that answers it. This is the plain-English version; the analysis is longer, and it is the one we put in front of your safety officer.
- Struck-by at load-out, with no operator body language. A load-out sequence in which the machine only reports its own state, a broadcast every truck can read, and a hold in the driver's cab. The driver keeps every decision.
- A swing into a walkway. The walkway is excluded from the work area when the job is planned, and a signal sounds and shows before the machine moves.
- A blind quadrant. An audible warning mounted in more than one place, so a body between you and the machine does not hide it.
- A person on foot inside the machine's reach. Segregation first: gates, spotters, barriers and a sweep. Approach sensing on the machine is the last resort, never the plan.
- A vehicle inside the machine's reach. Haul routes, staging and load-out lanes are planned as part of the site before any signal is relied on.
- A stale, missing or mis-read tailgate. A corrected tailgate is recognized by its content, not its filename. No tailgate means no limits and no work. A mis-read counts as a failure, never a pass.
- A unit accepting its own paperwork. Every path to acceptance ends in a typed human name.
- False confidence in a device that is not a safety device. The hold request's legend says NOT AN EMERGENCY STOP. Every screen in a truck says it is advisory.
- A warning tuned out. Each state has its own tone, the stop tone belongs to nothing else, and the volume follows the noise around it.
- A failed lamp nobody notices. Every lamp reports back to the safety side, so a failed lamp is a known state and not a silent gap.
- Lamps that mimic an emergency vehicle. Red is steady and never flashing, and the colours are chosen against the provincial vehicle lighting rules.
- A lost or faked wireless link. Losing a link never stops the machine and never starts it. Every device is registered, and the worst a faked one can do is take authority away.
- Two units on one site. Every message carries the identity of the unit it is about.
- Public or livestock entry on a rural site. Gates, spotters, barriers and a sweep before work, as for any person on foot.
- A release out of reach, or winter gloves. The pre-start checks that every release is reachable from the seat. Where the releases sit on a person's stance, and how they pull in cold-weather gloves, are questions our own analysis names as open work.
- A machine that woke itself up. It cannot. A person starts the machine, every session, and Eddie does not start, wake or inspect one on this work.
When the seat is a person's again.
- What it touches. The machine's own controls, and nothing else. The dock is the machine's own seat-belt anchors and the pins on its controls.
- What is new to diagnose. Your machine's diagnostics stay your machine's, and no diagnostic path for your machine runs through us. Everything the unit adds to the cab is walked at the pre-start.
- How it is serviced. Service work with the unit fitted, and taking the unit and the dock off a machine for good, both follow a written lockout and tagout procedure. It uses the machine's own names for its energy sources: power isolated, air vented, every release pulled, the unit tagged by a named person, and the machine proven to be a machine again before anyone signs it back.
- How the seat comes back. Eddie is removable by design. Unbuckle it and lift it out, and the machine is what it was, with nothing else left behind. Human-only operation is a designed state, not an afterthought, and it is demonstrated at every pre-start before the unit is trusted.
Teaching is a disconnected state. While a person drives and the STE Trainer records, nothing of Eddie's is connected, control units included, and STE Trainer has no authority of any kind: nothing it produces reaches any control path, in any mode, ever.
What we claim, and what is for your counsel.
- ISO 13849. The safety functions are designed against that standard's architecture, with three independent means of removing control.
- ISO 17757. The standard for autonomous earth-moving machinery, and the one this safety design is built toward.
- Where we stand. We claim no certification and no performance level for this system. Today no body issues a certificate for an autonomous operator on earth-moving machinery against ISO 17757: the standard says what such a system must do, and no scheme certifies to it yet. The certificates that exist in this field cover parts and software under the general functional-safety standards, and we claim none of those either. What we do put in front of you is the machine itself: come to our own Test Facility in Alberta, take control away each of the three ways with your own hand, and watch Eddie let go.
Warranty, conformity and liability. Steady Eddie operates a machine through its own controls. Nothing is cut, no harness is tapped, no controller is flashed and no OEM software is touched, so the integration and intellectual-property work that an electronic conversion requires does not arise, and the machine's own safety systems are left in place and operating. That is an engineering property and we can show it to you on the machine. It is not a legal opinion. Whether any particular installation affects a warranty, a conformity assessment or a liability position depends on the machine, the jurisdiction and the contract, and it is a question for your counsel. We will not give you a legal opinion, and you should not accept one from any vendor.
Short answers, for the crew and for the people who can say no.
Before it moves, somebody has told you what it is, what it is about to do, and how to stop it. The hold you carry asks it to stand down, and only a person at the machine clears it. It keeps a zone around itself. Walk into that zone and it holds. The plan is still the gates, the spotters and the barriers, never the sensing. It never starts itself. White means it is working, amber means it has been asked to stop, steady red means a fault. And the stops that need no radio are on the machine itself: the lever, the ring and the air.
One fewer person in a hazardous seat. It cannot start on its own: a person walks around the machine, starts it and clears it, every session. Three independent ways take control away by hand, and a red release sits on every actuator: one hand, no tool, no air, no power. If the safety controller itself halts, the machine goes to its safe state. Anyone on site can ask it to stand down, it holds when a person walks in, and it says out loud what it is doing. The stop set is ranked, the pre-start reads line by line, and the hazard list can be set beside your own, with our own open items named in it. Count the releases yourself.
Nothing new to diagnose. Nothing cut, tapped or flashed. The dock is mechanical, the unit lifts out, and no diagnostic path for your machine runs through us. What is new in the cab is on the pre-start, line by line.
We make no representation about your machine's warranty, its conformity or your liability position; those depend on the machine, the jurisdiction and the contract, and they are for your counsel. What we can show you on the machine is an engineering property, not a legal opinion. We claim no certification and no performance level. Our own warranty on the unit is on the Pre-order page.